Management of memory firewalls in system on a chip

Abstract

The present disclosure relates to management of memory firewalls in a system on chip. In accordance with one embodiment, a system on chip includes a plurality of master agents, a plurality of slave resources, wherein a slave resource of the plurality of slave resources comprises a memory device, the memory device comprising a first memory region, an interconnect circuit, and an inspection circuit. A first master agent is configured to define initial access rights for the first memory region and delegate access management of the first memory region to a second master agent. The second master agent is configured to define specific access rights for the first memory region in accordance with the access rights rules and the initial access rights associated with the first memory region; and the inspection circuit is configured to use the applicable access rights associated with the first memory region to inspect whether a transaction intended for the first memory region is indeed authorized to access the first memory region.

Description

[0001] Cross-references to related applications

[0002] This application claims the benefit of French patent application number 2112501, filed on November 25, 2021, which is incorporated herein by reference. Technical Field

[0003] The implementation methods and embodiments relate to integrated circuits, and more particularly to the management of memory firewalls in a system-on-a-chip (SOC). Background Technology

[0004] To help ensure the reliability of an on-chip system, it may be necessary to restrict access to specific slave resources by one or more master devices. Those skilled in the art use the term "firewall or isolation" to designate such a feature.

[0005] These access restrictions can also be managed, which is easy to implement and enforce, especially when such management is dynamic, such as when it depends on the application being considered for the system-on-chip (e.g., an application considered on multiple cores of the chip).

[0006] Another system-on-chip, such as a microcontroller or microprocessor, can be proposed that allows for all usage scenarios from various users of the system-on-chip and all configurations in a flexible manner, including, in particular, low-power modes.

[0007] A French patent application (hereinafter referred to as the “French patent application”), also published as U.S. Patent Publication No. 2021 / 01610134 and published as U.S. Patent Publication No. 3103586, describes an example of an on-chip system with the above advantages. Both applications are incorporated herein by reference.

[0008] However, improvements are still needed for such on-chip systems, particularly regarding the management of memory access and the configuration of their firewalls, especially when the memory is divided into several memory regions.

[0009] More generally, there is a need to simplify the configuration of firewalls that are inside or outside the system-on-chip but coupled to the system-on-chip's memory, especially when modifying access permissions to a portion of the memory, or when the system-on-chip is in a low-power mode. Summary of the Invention

[0010] According to one embodiment, a system-on-a-chip includes: a plurality of master devices; a plurality of slave resources, wherein at least one of the slave resources includes a memory device, the memory device including a first memory region; interconnect circuitry coupled between the plurality of master devices and the plurality of slave resources, the interconnect circuitry being configured to route transactions between the plurality of master devices and the plurality of slave resources; and checking circuitry. A first master device among the plurality of master devices is configured to define initial access permissions for the first memory region and delegate access management of the first memory region to a second master device among the plurality of master devices; the second master device is configured to define specific access permissions for the first memory region based on access permission rules and the initial access permissions associated with the first memory region; and the checking circuitry is configured to use applicable access permissions associated with the first memory region to check whether a transaction intended for access to the first memory region is indeed authorized to access the first memory region. Applicable access permissions include initial access permissions, specific access permissions, or other access permissions, and the applicable access permissions apply when a transaction is received.

[0011] According to another embodiment, a method for managing memory access to a system-on-a-chip (SoC) includes a plurality of master devices, a plurality of slave resources, and interconnect circuitry coupled between the master devices and the slave resources. The interconnect circuitry is configured to route transactions between the master devices and the slave resources, wherein at least one of the slave resources includes a memory device comprising a first memory region. The method includes: defining initial access permissions for the first memory region by a first master device; delegating access management of the first memory region to a second master device by the first master device; defining specific access permissions for the first memory region by the second master device based on access permission rules and the initial access permissions associated with the first memory region; and checking whether a transaction intended to access the first memory region is indeed authorized to access the first memory region using applicable access permissions associated with the memory region. Applicable access permissions include initial access permissions, specific access permissions, or other access permissions, and the applicable access permissions apply when a transaction is received.

[0012] According to another embodiment, a method of operating a firewall includes: receiving initial access permissions for a first memory region of a plurality of master devices from a first master device; receiving from the first master device a command to delegate access management of the first memory region to a second master device among the plurality of master devices; receiving from the second master device a command to restrict specific access permissions for the first memory region based on access permission rules and the initial access permissions associated with the first memory region; and using applicable access permissions associated with the memory region to check whether a transaction intended to access the first memory region is indeed authorized to access the first memory region. Applicable access permissions include initial access permissions, specific access permissions, or other access permissions, and the applicable access permissions apply when the transaction is received. Attached Figure Description

[0013] Other advantages and features of the invention will become apparent upon review of the detailed description of the embodiments and implementations (non-limiting) and the accompanying drawings, in which:

[0014] Figure 1 The illustration shows a block diagram of the system-on-a-chip of an embodiment;

[0015] Figure 2 The diagram illustrates the configuration information set of an embodiment;

[0016] Figure 3 The diagram illustrates the memory partitioning of an embodiment;

[0017] Figure 4 The diagram illustrates the operation of a delegate register according to one embodiment;

[0018] Figure 5 The illustration depicts an example of initial access permissions according to one embodiment;

[0019] Figure 6 and Figure 7 The illustration depicts a specific access permission according to one embodiment;

[0020] Figure 8 A table illustrating example access permission rules according to one embodiment is shown;

[0021] Figure 9 The diagram illustrates a delegate for access control management according to one embodiment;

[0022] Figure 10 The illustration shows the content of a transaction according to one embodiment;

[0023] Figure 11 The illustration shows a schematic diagram of the system of the embodiment; and

[0024] Figure 12The diagram illustrates the memory partitioning of an embodiment. Detailed Implementation

[0025] The implementation methods and embodiments relate to integrated circuits, particularly systems-on-a-chip (SoCs), such as microcontrollers (multi-core or single-core) or microprocessors, for example, managing the operation of such SoCs, and more particularly managing access to memory divided into several memory regions and configuring firewalls for managing such memory.

[0026] According to one aspect, a system-on-a-chip (SoC) is proposed, comprising several master components, such as a microcontroller, at least one microprocessor, and generally several microprocessors and a direct memory access (DMA) controller; these examples are not limiting. The SoC also includes several slave resources.

[0027] By way of non-limiting example, a resource may belong to a group consisting of at least one peripheral device, such as I. 2 Peripherals of type C (“Inter-Integrated Circuit”), type SPI (“Serial Peripheral Interface”), type UART (“Universal Asynchronous Receiver Transmitter”); or real-time clock (RTC); features of the peripheral (e.g., alarm lines of an RTC peripheral).

[0028] The system-on-chip also includes at least one slave resource, which contains a memory device, the memory device including at least one first memory region.

[0029] The term "memory device" has a very broad meaning, for example, encompassing memory circuitry within a system-on-a-chip, or a memory interface within a system-on-a-chip that is intended to be coupled to memory circuitry outside the system-on-a-chip, such as memory of the DDR SRAM ("Double Data Rate Synchronous Dynamic Random Access Memory") type.

[0030] The system-on-chip also includes an interconnect system (known to those skilled in the art by the name “interconnect”) coupled between the master device and the slave resource and capable of routing transactions (e.g., write or read transactions) between the master device and the slave resource.

[0031] In the primary equipment, a first primary equipment (e.g., but not limited to a microprocessor) is configured (e.g., during the execution of a user program after a cold start phase) to restrict initial access to the first memory region and to delegate the management of access to the at least one first memory region to a second primary equipment at least temporarily.

[0032] The second main device, preferably different from the first main device, is configured to define specific access permissions for the at least one first memory region based on access permission rules and initial access permissions associated with the first memory region. These access permission rules may be software incorporated into a program executed by the second main device, or they may be hard-coded.

[0033] The system also includes at least one inspection circuit (acting as a firewall) configured to check whether a transaction is indeed authorized to access the first memory region by using access permissions associated with the memory region and applicable when a transaction is expected to be received for the at least one first memory region. Access permissions referred to as applicable access permissions include initial access permissions, specific access permissions, or other access permissions.

[0034] Indeed, as will be seen in more detail below, the second master unit can assign specific access permissions to the entire first memory region.

[0035] However, according to one possible embodiment, at least one first memory region may be divided into several memory sub-regions, and a second master device that has been granted authorization for the first memory region is configured to assign corresponding access permissions to these memory sub-regions.

[0036] Therefore, these memory sub-regions can be non-intersecting, adjacent, or not adjacent, or even overlapping.

[0037] Access permissions to a memory subregion can be specific access permissions, while a memory subregion located between two memory subregions that have been assigned specific access permissions can, for example, retain its initial access permissions already defined by the first master equipment.

[0038] Similarly, since the delegation can be temporary, as will be seen below, the first master equipment can revoke the delegation and regain control over the management of access to the first memory region. In this case, the first master equipment can retain the initial access permissions or restrict other access permissions that are different from the initial and specific access permissions.

[0039] Similarly, the firewall can be activated or deactivated, for example, temporarily.

[0040] Therefore, if the firewall is not activated, there is no filter for access permissions, and any transaction originating from any master device can then, for example, access the first memory area.

[0041] Delegating firewall management, and therefore access control, to a second primary device specifically allows for easy modification of access permissions to memory regions within the context of task scheduling, easy sharing of buffer memory with another execution memory region, or even compatibility with low-power operating modes, in which the first primary device will be in standby mode, and in which it will still be necessary to manage memory access locally. Therefore, subject to, for example, compliance with rules, certain parameters of the firewall, already programmed by the first primary device during initialization, can be overwritten without going through the first primary device. In other words, unlike prior art on-chip systems, local firewall control of the memory or memory region can be authorized by the "owner" of the memory itself (i.e., the owner who will specifically use the memory, in this case, the second primary device).

[0042] The memory device may include a plurality of first memory regions, and the first master equipment may be configured to limit initial access permissions for each first memory region and to delegate the management of access to the first memory regions, at least temporarily, to a plurality of different or identical second master equipment.

[0043] As previously noted, the first master equipment can also be configured to: after delegating the management of access to the first memory region to the corresponding second master equipment, withdraw the delegation and restart the management of access to the first memory region, or possibly re-delegate it to another second master equipment. The first master equipment can also be configured to: after withdrawing the delegation, not authorize a new delegation of management of access to the first memory region in question.

[0044] According to one embodiment, the memory device may include at least one second memory region, and the first master device may also be configured to: define initial access permissions for the second memory region and not be authorized to delegate management of access to the second memory region or these second memory regions. Different memory regions may be regions defined by a start memory address and an end memory address, and different memory regions may also be memory pages.

[0045] According to another aspect, a method for managing access to at least one memory device of a system-on-a-chip (SoC) is proposed. The SoC includes a plurality of master devices, a plurality of slave resources, and interconnect circuitry coupled between the master devices and slave resources and capable of routing transactions between the master devices and slave resources. At least one slave resource includes the at least one memory device, and the at least one memory device includes at least one first memory region. The method includes: defining initial access permissions for the first memory region by a first master device; delegating management of access to the at least one first memory region, at least temporarily, by the first master device; defining specific access permissions for the at least one first memory region by the second master device based on access permission rules and the initial access permissions associated with the first memory region; and checking whether a transaction is indeed authorized to access the first memory region by using access permissions associated with the memory region and applicable when a transaction is expected to be received for the at least one first memory region, the applicable access permissions including initial access permissions, specific access permissions, or other access permissions.

[0046] According to one embodiment in which the memory device includes a plurality of first memory regions, a method includes: a first master device defining initial access permissions for each first memory region, and the first master device delegating the management of access to the first memory regions to a plurality of second master devices at least temporarily.

[0047] According to one embodiment where the corresponding first memory region includes a plurality of first memory sub-regions, the method further includes each second master device managing access to these first memory sub-regions.

[0048] According to one embodiment, the method further includes: after a first master device has delegated the management of access to the first memory region to a corresponding second master device, the first master device withdraws the delegation and resumes the management of access to the first memory region.

[0049] According to one embodiment in which the memory device includes at least one second memory region, the method further includes: a first master device defining initial access permissions for the second memory region, and not authorizing the first master device to delegate the management of access to the second memory region or the second memory regions.

[0050] A system-on-a-chip can be formed into a microcontroller or a microprocessor.

[0051] The embodiments of the present invention can be applied to any type of system-on-a-chip, which includes a plurality of master devices, a plurality of slave resources, and interconnect circuitry coupled between the master devices and slave resources and capable of routing transactions between the master devices and slave resources.

[0052] Embodiments of the present invention are particularly applied to systems on a chip such as those described in the aforementioned French patent application number 3103586, which include certain general characteristics, particularly relating to configuration diagrams, identification of master and slave resources, and transaction structures, which will be covered below.

[0053] However, those skilled in the art may refer to the French patent application for all practical purposes, the contents of which are incorporated herein by reference.

[0054] exist Figure 1 In this document, the MCU designation specifies the on-chip system that forms the microcontroller, but this example is not limiting.

[0055] The system-on-a-chip (MCU) in this document includes several main components, of which only three labeled CPU1, CPU2, and CPU3 are represented in this document for the purpose of simplification.

[0056] In this example, the main devices CPU1, CPU2, and CPU3 are microprocessors, and other main devices can be, for example, direct memory access (DMA) type or other types of main devices, such as a USB controller or even a PCI express type main device; this list of examples is not exhaustive. In some embodiments, components on the system-on-a-chip can be implemented on a single integrated circuit, such as a single monolithic integrated circuit. This integrated circuit can be implemented on a semiconductor substrate, such as a silicon substrate.

[0057] The system-on-chip MCU also includes several slave resources, of which only four labeled IMM1, PH3, PH4, and PH5 are represented herein for the purpose of simplification.

[0058] Generally, a resource belongs to the group consisting of at least the following: peripheral devices, features of peripheral devices, memory circuitry within the system-on-chip (MCU), and memory interfaces within the MCU and intended to be coupled to at least one memory circuitry outside the MCU. Therefore, in the illustrated example, the resource IMM1 is a memory device, and more specifically, memory within the MCU.

[0059] Resources PH3, PH4, and PH5 are peripheral devices, such as UART type peripheral devices, I... 2 C controller, SPI controller.

[0060] The structure of the master equipment and slave resources can be conventional and known in itself.

[0061] The system-on-a-chip (MCU) also includes an interconnect circuit (INTC) that routes transactions between master devices and slave resources.

[0062] The structure of such interconnect circuits, typically multilayer interconnect circuits, and the protocols that allow the exchange and routing of transactions within the interconnect circuits, are well known to those skilled in the art. This can be specifically referenced, for example, to the article entitled “A Frame work on AMBA bus based Communication Architecture to improve the Real Time Computing Performance in MPSoC” by Venkateswara Rao et al. (International Journal of Computer Applications (0975-8887), Vol. 91-No. 5, April 2014); or to the general description of these interconnect circuits completed by A. Gerstlauer in 2015 and available at http: / / users.ece.utexas.edu / ~gerstl / ee382v_f14 / lectures / lecture_12.pdf.

[0063] Furthermore, interconnect circuitry sold by ARM under the label NIC-400 (version R0p3) may be used, for example, by way of instruction rather than restriction.

[0064] The system-on-a-chip also includes a set of configuration registers associated with each master device and each slave resource. This set of configuration registers includes several configuration registers that are intended to store configuration information, the meaning of which will be described in more detail below.

[0065] The RGCM1 flag specifies the configuration register set associated with the master CPU1; the RGCM2 flag specifies the configuration register set associated with the master CPU2; the RGCM3 flag specifies the configuration register set assigned to the master CPU3; the RGCS1 flag specifies the configuration register set assigned to the slave resource IMM1; the RGCS3 flag specifies the configuration register set associated with the peripheral device PH3; the RGCS4 flag specifies the configuration register set assigned to the peripheral device PH4; and the RGCS5 flag specifies the configuration register set assigned to the peripheral device PH5.

[0066] Furthermore, in this example, a register RDS, referred to as the designation register, is provided. The characteristics of the register RDS will be described in more detail, but it may have been indicated as a designation master device as the first master device, which has the qualities of a manager master device.

[0067] Different sets of configuration registers are represented in this document within the controller RIFC; however, they can be set outside the controller.

[0068] The system-on-chip (MCU) also includes basic management units RIMU1, RIMU2, and RIMU3 associated with each main equipment.

[0069] The structure and characteristics of these basic management units will be described in more detail, but they can already be considered as part of additional circuitry and systems that are intended to add identification information (CID) and, possibly, security and / or privilege information, to any transactions sent by the main equipment.

[0070] The system-on-chip also includes basic inspection modules RISU1, RISU3, RISU4, and RISU5 associated with each resource. The structure and characteristics of these basic inspection modules will be described in more detail below.

[0071] These basic checking modules can be considered as part of the checking circuitry that is expected to check whether a transaction for a resource is indeed authorized to access that resource.

[0072] Different basic management units (RIMUs) and different basic inspection modules (RISUs) are connected to their respective configuration register sets via specific links, such as metal rails.

[0073] Although the basic verification module RISUi is in Figure 1 The corresponding peripheral device has been indicated outside of the peripheral device, but it is likely that one or more peripheral devices with their corresponding basic inspection modules integrated into the peripheral device itself are provided.

[0074] As will be seen in more detail below, module RISU1 and associated register RGCS1 serve as a firewall for memory IMM1, the management of which is initially assigned to the first master or administrator equipment, and the management of which may, under certain conditions, be delegated at least temporarily to a second master equipment for certain memory regions of memory IMM1.

[0075] Before going into detail, however, some features and characteristics of the system-on-a-chip will be briefly recalled herein. Those skilled in the art may refer to the aforementioned French patent application for further details. For the sake of simplicity, other features and characteristics of the system-on-a-chip that are not essential for implementing the present invention, such as the possibility of modifying the manager's equipment as described in the aforementioned French patent application, though such modifications may be implemented in this system-on-a-chip, will not be described here.

[0076] The system-on-a-chip (MCU) includes a processor, which is specifically distributed in a referenced... Figure 1Within the different components described, and configured to allow users of the on-chip system to implement a configuration diagram defined by a configuration information set within the on-chip system during the configuration phase, the configuration information set being stored in different configuration register sets.

[0077] Before discussing the composition of this configuration information in more detail, it can be noted that users have the option to implement static or dynamic configuration. This paper assumes, through examples, that the configuration diagram corresponds to the initial diagram (static configuration) that remains valid during the use or operation phase of the on-chip system.

[0078] More specifically, by way of example, the first manager master equipment is configured to perform a startup phase in response to the first boot or cold boot of the on-chip system, and at the end of the startup phase, the first manager master equipment is configured to at least allow the implementation of the initial configuration diagram.

[0079] The designation of the first manager master device can be set during the production of the system-on-chip (MCU), for example, by hard-coding. Alternatively, the user can use the programmable designation register RDS, which allows the designation of the first manager master device.

[0080] By way of example, the boot memory (“boot ROM”) is configured to store a boot program that can only be executed by the first manager master device (e.g., microprocessor CPU1) during the first boot or cold boot of the on-chip system.

[0081] Input section INP( Figure 1 The input unit (INP) can be configured to receive user programs. These user programs can be stored, for example, on an SD card that cooperates with the input unit (INP). The user program is received from the input unit (INP) and stored in program memory. The user program contains at least instructions representing an initial configuration diagram.

[0082] In this example, the first manager master equipment (e.g., microprocessor CPU1) is configured to execute a user program at the end of its startup phase in order to implement the initial configuration diagram.

[0083] Although the microprocessor has been described herein as the first manager main equipment (e.g., microprocessor CPU1), alternatively, it is entirely possible that the first manager main equipment includes hardware logic circuitry.

[0084] Now, more specific references Figure 2 To illustrate an example of a configuration information set that defines a configuration diagram SCH, the configuration diagram SCH can be an initial diagram or a modified initial configuration diagram.

[0085] For the sake of simplicity, this article only mentions a few configuration details from those mentioned in the aforementioned French patent application.

[0086] The configuration information set can therefore include a unique identifier (CID) for each master piece of equipment. This identifier allows the master piece of equipment to be identified from the list of master pieces of equipment. The CID can be, for example, a numeric word.

[0087] The configuration information set for the primary equipment may also include security information (SEC), such as bits, which, based on their logical values, indicate whether the primary equipment is configured in a secure or insecure mode. The configuration information set for the primary equipment may also include privilege information (PRV), such as bits, which, based on their logical values, indicate whether the primary equipment is configured in a privileged or non-privileged mode. If several privileged mode levels are provided, the privilege information may include several bits.

[0088] The configuration information associated with the main equipment is stored (step 120) in the corresponding configuration register set RGCMi.

[0089] Regarding slave resources, the associated configuration information set may include, for example, filtering information IFLT for inaccessible slave resources, such as bits that are intended to indicate whether the slave resource can be accessed by any master equipment or by only one or more master equipments, based solely on the master equipment's identification information CID.

[0090] Therefore, for example, if the filter information has a logical value of "0", it means that there is no filter applied to the identification information and therefore the resource can be accessed by any master equipment.

[0091] It should be noted that several main equipment units can have the same identification information (CID). This is, for example, when the main equipment unit includes a microprocessor and one or more other main equipment units that can be controlled by the microprocessor. In this case, a compartment is then formed, specified by the identification information (CID). All the main equipment units in this compartment can then, for example, have access to the same memory resources.

[0092] It is also possible that the master device controlled by the microprocessor does not have the same identification information as the microprocessor for security reasons. This is the case, for example, for PCI-E type devices. In this case, it allows for restricting access to certain memory resources of the PCI-E type master device.

[0093] The configuration information set of the limited configuration diagram may also include first access information IAC1 for inaccessible slave resources. If the filtering information IFLT (in the example, IFLT = 1) indicates that the considered slave resource can be accessed by only one or more master equipment, the first access information IAC1 is expected to indicate that the slave resource can be accessed by one or more master equipment with the same identification information CID. In this case, the configuration information set naturally includes the corresponding identification information CID.

[0094] As noted above, the identification information CID can be associated with a single main equipment or several main equipment in the same compartment.

[0095] The configuration information set of the limited configuration diagram SCH may also include second access information IAC2 for the inaccessible slave resource. If the filter information IFLT (IFLT=1) indicates that the slave resource can be accessed by only one or more master devices, the second access information IAC2 is expected to indicate that the slave resource can be accessed by master devices with different identification information CIDs. Furthermore, in this case, the configuration information set of the slave resource includes a list CID1…CID4, which, for example, represents the identification information of the corresponding master device. Such a slave resource, which can be accessed sequentially or simultaneously by several master devices, may be, for example, one or more memory circuits of a memory.

[0096] The configuration information set for the limited configuration diagram SCH of the slave resource may also include security information ISEC, such as bits that are intended to indicate whether the slave resource can be accessed by a secure master device or a non-secure master device.

[0097] Similarly, the configuration information set may include privilege information for the slave resource, such as the bit IPRV, which is intended to indicate whether the slave resource can be accessed by the master equipment in privileged or non-privileged mode.

[0098] All configuration information assigned to the resource is stored (step 121) in the corresponding configuration register set RGCSi.

[0099] It should be noted in this document that the first administrator master equipment (e.g., microprocessor CPU1) is configured to be in safe mode and privileged mode at the end of its startup phase.

[0100] Now, for more specific reference Figure 3 The following sections describe in more detail the features and characteristics related to the management of access permissions for the memory IMM1, as well as the features and management of its firewall RISU1. Figure 3 As shown, memory IMM1 is divided into three memory regions: two first memory regions ZM1A and ZM1B, and a second memory region ZM2. Each of these memory regions can be defined by a start address and an end address. Alternatively, particularly when memory IMM1 is internal memory, these memory regions can be defined by one or more memory pages.

[0101] In the configuration diagram, the first main equipment CPU1 grants initial access permissions (step 40) DAI to each of the memory regions ZM1A, ZM1B and ZM2.

[0102] exist Figure 5 The diagram illustrates an example of initial access permissions. More specifically, for the second memory region ZM2, the initial access permissions DCAI2 state that the memory region can be accessed by the first master machine CPU1 configured in non-secure mode (NS) and privileged mode (P), and that this access can be a read / write access (R / W). The initial access permissions DCAI2 also provide that the second memory region ZM2 can be addressed by the master machine CPU2 configured in non-secure mode and non-privileged mode via read / write access (R / W).

[0103] Regarding the first memory region ZM1A, initial access permissions DCAI1A provide that this first memory region can be accessed by the main equipment CPU1 configured in both insecure and privileged modes via read / write access (R / W). Regarding the other first memory region ZM1B, initial access permissions DCAI1B provide that this other first memory region can be accessed by the main equipment CPU1 configured in both secure and privileged modes via read / write access (R / W).

[0104] These access permissions are written to the register set RGCS1 assigned to resource IMM1 via the corresponding configuration information.

[0105] Now, if we return in a more specific way... Figure 4 As can be seen, in this embodiment, registers (referred to herein as delegate registers) are provided, for example, associated with each of the memory regions ZM1A, ZM1B and ZM2.

[0106] Furthermore, these delegate registers RGDC2, RGDC1A, and RGDC1B, located in the configuration controller RIFC, are expected to contain the bit DCEN. The logical value of the bit DCEN will determine whether the management of access permissions for the corresponding memory region can or cannot be delegated to another master device.

[0107] For illustrative purposes, if the value of this bit is equal to 0, then access control cannot be delegated, while if the value of this bit is equal to 1, it can be delegated.

[0108] exist Figure 4In the example, register RGDC2 contains the bit DCEN with a logic value of 0, while registers RGDC1A and RGDC1B contain the bit DCEN with a logic value of 1. This means that, regarding the second memory region ZM2, the management of its access rights, initially assigned to, for example, the first master unit CPU1, cannot be delegated to another master unit in this configuration example (step 41). However, regarding the first memory region ZM1A, the management of its access rights can be delegated to another master unit (step 42), for example, to the microprocessor CPU1 configured in non-secure mode.

[0109] Similarly, regarding the first memory region ZM1B, access control management can be delegated (step 43) to the main equipment CPU2 configured in secure mode. Therefore, the main equipment CPU1 configured in non-secure mode (NS) can restrict specific access permissions DACP1A to the first memory region ZM1A, while the main equipment CPU2 configured in secure mode (S) can restrict access permissions DACP1B to the memory region ZM1B.

[0110] For example, such as Figure 6 As shown, based on the initial access permission DAI1A and access permission rule RGL, the execution of the description 50 of the specific access permission DACP1A by the main equipment CPU1 configured in non-secure mode is performed.

[0111] By way of example, specific access permissions DACP1A can therefore be provided: memory region ZM1A can be accessed by the first master equipment CPU1 configured in non-secure mode (NS) or non-privileged mode (NP) via read / write access (R / W), or by the master equipment CPU3 configured in non-secure mode (NS) or non-privileged mode (NP) via read-only access (RO).

[0112] like Figure 7 As shown, by way of example, based on the initial access permission DAI1B and rule RGL, the execution of the specific access permission DACP1B associated with memory region ZM1B by the main equipment CPU2 configured in safe mode (S) is described 60. The specific access permission DACP1B can therefore provide: access by the main equipment CPU1 configured in safe mode (S) and unprivileged mode (NP) via read / write access (R / W), or even access by the main equipment CPU2 configured in safe mode and unprivileged mode (NP) via read / write access (R / W).

[0113] These different access permissions are specified by corresponding bits, and the identification information of the corresponding master equipment is stored in the register set RGCS1 associated with the memory IMM1. Furthermore, the configuration controller RIFC, for example, responds to a command from the master equipment that has received a request to modify these access permissions, and replaces the initial access permissions with specific access permissions.

[0114] Figure 8 The diagram illustrates an example of a rule RGL represented in tabular form in this document. The left column shows the different security (S), privileged (P), insecure (NS), and non-privileged (NP) configurations that can be provided in the initial access permission DAI. The remainder of the table indicates whether the S, P, S, NP, NS, P, or NS, NP configuration is authorized for a specific access permission DAI. If authorized, it is specified by the abbreviation OK, and if not authorized, it is specified by the abbreviation NOK.

[0115] In other words, if the initial access permissions DAI for a memory region grant access in both secure (S) and non-privileged (NP) modes, then a master rig that has already received a modified access permission delegation will not be able to allocate access, for example, in both secure (S) and privileged (P) modes. However, it can grant access in both secure (S) and non-privileged (NP) modes or in both insecure (NS) and non-privileged (NP) modes. Of course, these rules RGL are merely non-restrictive examples, and other examples of the rules are possible.

[0116] like Figure 9 As illustrated in the schematic diagram, it is highly likely that the delegation of access control management from, for example, the first main equipment CPU1 to, for example, the main equipment CPU2 is only temporary. More specifically, the delegation 70 can intervene, for example, in the presence of a specific condition CND0, such as receiving a specific instruction from the user program or receiving a control signal; these examples are not limiting. For example, the delegation can terminate when condition CND1 is met, such as the termination of subroutine execution or the receipt of another control signal; these examples are also not limiting.

[0117] In this case, the termination of delegation 71 could lead to, for example, the resumption of firewall management of memory IMM1 by the first main equipment CPU1, which had initiated the initial access permissions.

[0118] Now, for more specific reference Figure 10 An example to describe the contents of a transaction TR.

[0119] Generally, in this document, each transaction TR transmitted by the master equipment includes an addressing field ADR, the contents of which are intended to address the recipient of that transaction from the resource. More specifically, as Figure 10 As shown, each transaction TR includes the identification information CID of the master equipment transmitting the transaction, the security information SEC, the indication EXE indicating whether the transaction contains an execution instruction, the privilege information PRV, the information RW indicating whether it is a read transaction or a write transaction, the addressing field ADR, and the data field DATA.

[0120] Additional circuitry and systems (for each master equipment EMi, including the associated basic management unit RIMUi linked to the corresponding configuration register set RGCMi) are configured to add at least the master equipment's identification information CID to each transaction transmitted by the master equipment. The additional circuitry and systems are also configured to add security information SEC and / or privilege information to each transaction transmitted by the master equipment (if these two information items are not already present in the transaction transmitted by the master equipment).

[0121] The transaction TR is then delivered on the bus linked to the interconnect circuit INTC.

[0122] In essence, the basic management unit RIMUi may include logic circuits.

[0123] like Figure 11 As illustrated in the schematic diagram, the basic inspection module RISU1 is configured to access a configuration information set assigned to resource IMM1, stored in the corresponding configuration register set RGCS1, and with initial access permission DAI and specific access permission DACP defined for different memory regions of memory IMM1. Updates to register RGCS1 using the initial access permission DAI and possibly the specific access permission DACP are performed by the configuration controller via bus BS1 and the AHBI bus interface, where bus BS1 is, for example, an AHB (“Advanced High Performance Bus”) type bus.

[0124] Transaction TRs sent by different master units CPU1, CPU2, etc., are transmitted on bus BS2 and then arrive at the basic check module RISU1. The latter then relies on the contents of register RGCS1 to check whether the transaction can access the considered memory area of ​​memory IMM1.

[0125] This invention is not limited to the embodiments and examples already described, but covers all its variations.

[0126] Therefore, as Figure 12As shown, the second main equipment, which has already received the mandate (in this document, equipment CPU1 in non-secure mode), can further divide the first memory region ZM1A into several (in this document, three) memory sub-regions ZM1A1, ZM1A2, and ZM1A3, which are non-intersecting and adjacent in this document. Nevertheless, these memory sub-regions may be non-adjacent or even overlap.

[0127] Access permissions to its memory subregions ZM1A1 and ZM1A3 can be, for example, specific access permissions, while the memory subregion ZM1A2 located between these two memory subregions ZM1A1 and ZM1A3, which are assigned specific access permissions, can, for example, retain its initial access permissions already defined by the first main equipment.

Claims

1. A system-on-a-chip, comprising: Multiple main equipment; Multiple slave resources, wherein at least one of the multiple slave resources includes a memory device, the memory device including a first memory region; Interconnect circuitry coupled between the plurality of master devices and the plurality of slave resources, the interconnect circuitry being configured to route transactions between the plurality of master devices and the plurality of slave resources, wherein: The first master device among the plurality of master devices is configured to: restrict initial access permissions to the first memory region, and delegate access management of the first memory region to the second master device among the plurality of master devices. The second master device is configured to: limit specific access permissions to the first memory region according to access permission rules and the initial access permissions associated with the first memory region, wherein the access permission rules prohibit the second master device from raising one or more security levels and one or more privilege levels to levels beyond those set in the initial access permissions, while allowing the second master device to maintain or lower the one or more security levels and the one or more privilege levels; as well as The checking circuit is configured to check whether a transaction intended for the first memory region is indeed authorized to access the first memory region using applicable access permissions associated with the first memory region, wherein the applicable access permissions include the initial access permissions, the specific access permissions, or other access permissions, and the applicable access permissions apply when the transaction is received.

2. The system according to claim 1, wherein: The first main equipment includes a first processor; and The second main equipment includes a second processor.

3. The system according to claim 1, wherein: The memory device includes a plurality of first memory regions; The second main equipment includes multiple second main equipment; and The first master equipment is configured to: define initial access permissions for each of the plurality of first memory regions, and delegate access management of the plurality of first memory regions to the plurality of second master equipment respectively.

4. The system according to claim 1, wherein: The first memory region is divided into multiple memory sub-regions; and The second master device is configured to: when the second master device receives a delegation for the first memory region from the first master device, allocate corresponding access permissions for the memory sub-region.

5. The system of claim 1, wherein the first master device is further configured to: after delegating the access management of the first memory region to the second master device, withdraw the delegation of access management and restart the management of access to the first memory region.

6. The system according to claim 1, wherein: The memory device further includes a second memory region; and The first master equipment is also configured to limit initial access permissions to the second memory region.

7. The system of claim 6, wherein the first master device is not authorized to delegate access management to the second memory region.

8. The system of claim 1, wherein the plurality of master devices, the plurality of slave resources, the interconnect circuitry, and the inspection circuitry are included within a microcontroller or microprocessor.

9. The system of claim 8, wherein the microcontroller or the microprocessor is disposed on a single semiconductor substrate.

10. A method for managing memory access to an on-chip system, the on-chip system including a plurality of master devices, a plurality of slave resources, and interconnect circuitry coupled between the plurality of master devices and the plurality of slave resources, the interconnect circuitry being configured to route transactions between the plurality of master devices and the plurality of slave resources, wherein at least one of the plurality of slave resources includes a memory device, the memory device including a first memory region, the method comprising: The first master device among the plurality of master devices defines initial access permissions for the first memory region; The first master equipment delegates the access management of the first memory region to the second master equipment among the plurality of master equipment; The second master device limits specific access permissions to the first memory region according to access permission rules and the initial access permissions associated with the first memory region, wherein the access permission rules prohibit the second master device from raising one or more security levels and one or more privilege levels to levels beyond those set in the initial access permissions, while allowing the second master device to maintain or lower the one or more security levels and the one or more privilege levels; as well as Use the applicable access permissions associated with the first memory region to check whether the transaction intended for the first memory region is indeed authorized to access the first memory region, wherein the applicable access permissions include the initial access permissions, the specific access permissions, or other access permissions, and the applicable access permissions apply when the transaction is received.

11. The method of claim 10, wherein: The memory device includes a plurality of first memory regions; The second main equipment includes multiple second main equipment; and The method further includes: The first master equipment defines initial access permissions for each of the plurality of first memory regions, and The first main equipment delegates the access management of the plurality of first memory regions to the plurality of second main equipment respectively.

12. The method of claim 10, further comprising: After the first master equipment delegates the access management of the first memory region to the second master equipment, the first master equipment withdraws the access management of the first memory region from the second master equipment.

13. The method of claim 10, wherein: The memory device further includes a second memory region; and The method further includes the first master equipment granting initial access permissions to the second memory region.

14. The method of claim 13, wherein the first master device is not authorized to delegate access management to the second memory region.

15. The method of claim 10, wherein the system-on-chip forms a microcontroller or microprocessor.

16. A method of operating a firewall, the method comprising: Receive initial access permissions for a first memory region of a slave device from a first master device among a plurality of master devices; Receives an order from the first master equipment to delegate access management of the first memory region to the second master equipment among the plurality of master equipment; The second master equipment receives a command for limiting specific access permissions to the first memory region according to access permission rules and the initial access permissions associated with the first memory region, wherein the access permission rules prohibit the second master equipment from raising one or more security levels and one or more privilege levels to levels beyond those set in the initial access permissions, while allowing the second master equipment to maintain or lower the one or more security levels and the one or more privilege levels. as well as Use the applicable access permissions associated with the first memory region to check whether the transaction intended for the first memory region is indeed authorized to access the first memory region, wherein the applicable access permissions include the initial access permissions, the specific access permissions, or other access permissions, and the applicable access permissions apply when the transaction is received.

17. The method of claim 16, further comprising: Upon receiving the initial access permission from the first main equipment, the first register set is updated using the initial access permission; Upon receiving the command for delegated access management from the first master equipment, update the delegated register; as well as When the command for limiting specific access permissions is received from the second master equipment, the first register set is updated using the specific access permissions.

18. The method of claim 17, wherein the access permission rule defines whether the first memory region is secure, insecure, privileged, or non-privileged for a particular master device among the plurality of master devices.

19. The method of claim 16, further comprising: Receive initial access permissions from the first master equipment for the second memory region of the slave device; Receive a command from the first master equipment to delegate access management of the second memory region to the second master equipment; Receive from the second master equipment a command for limiting specific access permissions to the second memory region according to access permission rules and the initial access permissions associated with the second memory region; as well as Use the applicable access permissions associated with the second memory region to check whether the transaction intended for the second memory region is indeed authorized to access the second memory region, wherein the applicable access permissions include the initial access permissions, the specific access permissions, or other access permissions, and the applicable access permissions apply when the transaction intended for the second memory region is received.

20. The method of claim 16, wherein the plurality of master devices and the slave devices are disposed on a single chip.

Images