Hardware-Based Security Authentication

Abstract

The system includes multiplexers (710, 720), input / output (I / O) pins (719), logic circuits (712, 722), and a control register (330). The multiplexers (710, 720) have a plurality of inputs, an output, and a select input. The logic circuits (712, 722) are coupled between the multiplexers (710, 720) and the I / O pins (719). The logic circuits (712, 722) have a first input. The control register (330) includes first and second bit fields corresponding to the I / O pins. The first bit field is coupled to the select input of the multiplexers (710, 720), and the second bit field is coupled to a first input of the logic circuits (712, 722).

Description

Technical Field

[0001] Many computing systems employ security to protect access to various resources such as memory and other types of peripheral devices within the system. For example, a firewall may be implemented to provide security. However, some types of resources, such as input / output (I / O) pins, are not protected by a firewall.

Summary of the Invention

[0002] In at least one example, the system includes a multiplexer, input / output (I / O) pins, logic circuitry, and control registers. The multiplexer has a plurality of inputs, outputs, and a select input. The logic circuitry is coupled between the multiplexer and the I / O pins. The logic circuitry has a first input. The control registers include first and second bit fields corresponding to the I / O pins. The first bit field is coupled to the select input of the multiplexer, and the second bit field is coupled to the first input of the logic circuitry.

[0003] In another example, the system includes an input / output (I / O) cell circuit and an I / O cell access control circuit coupled to the I / O cell circuit. The system further includes an authenticator coupled to the system bus and a control register coupled between the authenticator and the I / O cell access control circuit. The authenticator is configured to authenticate a first request to map the I / O cell circuit to a device specified in the first request and update the control register to associate the device specified in the first request with the I / O cell circuit when the I / O cell circuit is not currently mapped to another device.

[0004] In yet another example, a method includes receiving a first request to access an input / output (I / O) pin. The I / O pin has a state. The first request identifies a device. The method further includes updating the state of the I / O pin in a control register to indicate that the I / O pin is associated with a device, in response to the state of the I / O pin indicating that the I / O pin is not assigned to any device, and storing the device identifier in the control register. The method also includes receiving a second request to connect the I / O pin to a device, and updating the I / O pin in the control register to identify the state included in the second request, in response to the control register storing the device identifier. [Brief explanation of the drawing]

[0005] For detailed explanations of various examples, please refer to the attached drawings.

[0006] [Figure 1] This describes a computing system that includes an input / output (I / O) multiplexer to provide secure access to one or more I / O pins using a destination firewall.

[0007] [Figure 2] This describes another computing system that includes an I / O multiplexer to provide secure access to one or more I / O pins using an outgoing firewall.

[0008] [Figure 3] Figures 1 and 2 are block diagrams illustrating examples of I / O multiplexers.

[0009] [Figure 4] This shows the contents of the control register associated with each I / O pin.

[0010] [Figure 5]Figure 3 shows an example of an authenticator included within an I / O multiplexer.

[0011] [Figure 6] Figure 5 shows an example of an address authenticator included within the authenticator.

[0012] [Figure 7] Figure 3 shows an example of an I / O cell access control circuit included within an I / O multiplexer.

[0013] [Figure 8] Figure 5 shows an example of a state diagram implemented by the state machine within the authenticator.

[0014] [Figure 9] Figure 3 shows an example of how this can be implemented within the I / O multiplexer.

[0015] [Figure 10A] This example shows how specific peripheral device functions can be connected to specific I / O pins. [Figure 10B] This example shows how specific peripheral device functions can be connected to specific I / O pins. [Figure 10C] This example shows how specific peripheral device functions can be connected to specific I / O pins. [Modes for carrying out the invention]

[0016] In a secure system, authenticated software may be granted access to granular resources such as I / O pins (data or control information) and event / interrupt signals. However, building a traditional firewall system to manage which software can access a particular I / O pin can be memory-intensive and involve considerable latency. This is because the firewall's memory map is packed into contiguous address ranges to control structures that are not associated with which software process can own them. The described embodiment implements a security system for resources such as I / O pins that are not directly protected by a firewall. The described embodiment includes hardware circuitry that provides secure access to I / O pins.

[0017] Figure 1 shows an electronic system 100 including a system direct memory access (DMA) controller 102, a central processing unit (CPU) 104, system memory 110, peripheral devices 112, and I / O cells 118. The internal hardware components for each CPU 104 are divided into secure and unsecured parts, each such part having its own stack pointer and error handling hardware. Runtime code for a given CPU 104 generally does not have access to the secure part of that CPU. The system DMA controller 102 and CPU 104 are coupled to a system bus 106. Each I / O cell 118 is a circuit that provides control of and connection to the corresponding I / O pins 119. The I / O pins 119 are accessible to devices outside the computing system 100, as well as to peripheral devices 112 within the electronic system 100, as described below. Each I / O cell 118 is a configurable circuit. For example, each I / O cell circuit 118 may have a glitch filter that can be enabled or disabled, a programmable slew rate, a programmable drive strength, a selectable pull-up or pull-down resistor, etc. In one implementation, the computing system 100 is a system-on-a-chip (SoC), and the I / O pins 119 are externally accessible pins coupled to pads on the semiconductor die of the SoC.

[0018] Two CPUs 104 are shown in the example of FIG. 1, but any number (one or more) of CPUs may be included. Similarly, two peripheral devices 112 are shown in FIG. 1, but any number of peripheral devices 112 may be included. At least one I / O pin is security-protected as described herein. Each peripheral device 112 provides one or more addressable peripheral device functions. The addressable peripheral device function enables software executed by the CPU 104 to issue bus transactions (reads and writes) targeting that specific function onto the system bus 106. For example, system 100 may include two serial peripheral interface (SPI) controllers each having one or more addressable peripheral device functions. Each SPI controller may provide, for example, an output clock, and each such SPI clock is addressable. Another example of a peripheral device includes a universal asynchronous receiver / transmitter (UART) and an inter-integrated circuit (I2C) bus transceiver. The transmit data output (TXD) or receive data input (RXD) of the UART is addressable in one implementation, similar to the I2C clock of the I2C bus transceiver.

[0019] The term "peripheral device" refers to a device that can receive requests from, for example, the CPU 104 or the system DMA 102 and respond thereto, but can also send data to or receive data from the I / O pin 119 via the I / O multiplexer 120 (described hereinafter). Thus, the peripheral device 112 can be an endpoint for transactions from the CPU 102 or can function as an intermediary between the CPU 104 and an external endpoint (not shown) of the electronic system 100 via the I / O pin 119.

[0020] For security reasons, system memory 110 and each peripheral device 112 have associated firewalls. Firewall 109 protects system memory 110, and firewalls 111 and 113 protect the corresponding peripheral devices 112. Firewalls 109, 111, and 113 are coupled between system bus 106 and the corresponding system memory 110 and peripheral devices 112. Each firewall 109, 111, and 113 is configured using any of a variety of rules for controlling which transactions are provided to the destination device (e.g., system memory 110, peripheral device 112) via the firewall. FIG. 1 is an example of a destination-side firewall in that the firewall directly protects the destination devices (e.g., system memory 110 and peripheral devices 112).

[0021] FIG. 2 shows an electronic system 200 that is similar to the computing device 100 of FIG. 1, but in which the firewalls are implemented in a source-side firewall configuration. The electronic system 200 includes a firewall 209 coupled between system DMA controller 102 and system bus 106, and firewalls 211 and 213 coupled between the corresponding CPU 104 and the system bus. Each firewall 209, 211, and 213 is configured to block those transactions from reaching system bus 106 from their respective source devices (system DMA 102, CPU 104) if any transaction does not comply with the firewall rules implemented within the firewall.

[0022] However, firewalls are typically not implemented to protect access to I / O pins. As described in the example and as illustrated in Figures 1 and 2, the electronic system 100 includes an I / O multiplexer 120 coupled between an I / O cell 118, a peripheral device 112, and a system bus 106. As described below, the I / O multiplexer 120 is hardware circuitry that can be used to implement security regarding I / O cell access. For example, software running on the CPU 104 may issue one or more transactions on the system bus 106, thereby collectively connecting a particular peripheral device function to a particular I / O cell 118 and its I / O pin 119. After the peripheral device function is connected to the I / O pin, the software may instruct the peripheral device function to control the logical state of the I / O pin. The I / O multiplexer 120 controls, on behalf of the software request, whether a given peripheral device function can access a given I / O cell 118. For example, the I / O multiplexer 120 includes multiple control registers, one for each I / O cell 118. Each control register can be programmed to contain an identifier for a given peripheral function. Only the peripheral function identified in the control register can access the I / O cell 118 corresponding to that control register. The I / O multiplexer 120 also implements a security protocol regarding how a given control register may initially be programmed with an identifier for a specific peripheral device.

[0023] The I / O multiplexer 120 sets the state of a given I / O cell 118 and controls access to the I / O cell by peripheral device functions based on the state of the I / O cell. In one example, the states for I / O cell 118 include UNASSIGNED, HANDOVER, CONNECTED(LOCKED), and CONNECTED(UNLOCKED). The UNASSIGNED state means that the I / O cell is not assigned to any peripheral device function. The HANDOVER state means that the I / O cell is assigned to a specific peripheral device function, but that peripheral device function is not connected to the I / O cell. The I / O multiplexer 120 implements two types of CONNECTED states. The CONNECTED(LOCKED) state means that a specific peripheral device function can now directly access its I / O pin, but there are no other peripheral devices that can be connected to that I / O pin. The CONNECTED (UNLOCKED) state means that a particular peripheral device function currently has direct access to its I / O pins, and that other peripheral devices may also be connected to those I / O pins. In another example, an I / O multiplexer implements a single CONNECTED state regardless of any LOCK / UNLOCK control state.

[0024] In one embodiment, for a given peripheral device function to control (write to or read from) a specific I / O pin 119, a multi-step security protocol is implemented by an I / O multiplexer 120. First, the CPU 104 executes one or more machine instructions (software) to issue a transaction on the system bus 106, thereby allowing the peripheral device function to access the specific I / O pin 119. As described above, each I / O pin 119 has a corresponding address. Each I / O pin also has an associated programmable control register. The I / O multiplexer 120 stores a list of addresses of I / O pins that are currently in the UNASSIGNED state (e.g., I / O pins available to be connected to a peripheral device function). In one example, the system bus transaction for the peripheral device function to use a pin in the UNASSIGNED state is a first write transaction, in which the write address is the address of the pin and the write data includes the address of the peripheral device function attempting to gain access to that pin. The I / O multiplexer 120 stores the state of an I / O pin, for example, in a control register associated with the I / O pin. Upon receiving a bus transaction (for example, the first write transaction described above), the I / O multiplexer verifies that the target pin is currently UNASSIGNED, and if so, changes the state of the I / O pin in the associated control register from UNASSIGNED to HANDOVER. The I / O multiplexer stores a state identifier in the register, and thus changes the identifier from one indicating UNASSIGNED to one indicating HANDOVER. The I / O multiplexer also stores the identifier of the specific peripheral device function identified by the bus transaction described above. At this point, the control register for the target I / O pin indicates that the specific peripheral device function is associated with the I / O pin and that the pin is in the HANDOVER state.Upon receiving the first write transaction described above, if the I / O pin is not in the HANDOVER state (i.e., the I / O pin may be in the CONNECTED state for a different peripheral device function), in one example, the I / O multiplexer does not update the pin's control register to store the identifier of the peripheral device function identified by the first write transaction, and therefore prevents the peripheral device function from using the I / O pin.

[0025] The second step of the security protocol is for the CPU 104 to execute one or more machine instructions to issue a second write transaction to the peripheral device function, in which the write data includes a bit that specifies that the I / O pin will transition to the CONNECTED state (CONNECTED LOCKED or CONNECTED UNLOCKED) for the peripheral device function. The I / O multiplexer receives this latter, second write transaction and compares the peripheral function identifier from the I / O pin's control register with the identifier of the peripheral device function targeted by the second write transaction. If the I / O multiplexer determines that the identifiers match, it updates the state stored in the I / O pin's control register from HANDOVER to the CONNECTED state (LOCKED or UNLOCKED). If the I / O multiplexer determines that the identifiers do not match, no update to the control register occurs, and the peripheral device function targeted by the second write transaction is not permitted to connect to the I / O pin.

[0026] The third step of the security protocol is for the software running on CPU 104 to issue a third write targeting a peripheral device function, where the write data is to be transmitted via the connected I / O pin. Bits in the I / O pin's control register, which store the identifier of the peripheral device connected to the I / O pin, are used to select a specific input of the multiplexer corresponding to the peripheral device to which the I / O pin is connected. If the I / O pin is not in the CONNECTED state (for example, if the pin is in the UNASSIGNED or HANDOVER state), none of the multiplexer inputs are selected. The output of the multiplexer passes through a logic circuit that allows the selected input of the multiplexer to pass when the I / O pin is in the CONNECTED state. If the pin is not in the CONNECTED state, signals on the output of the multiplexer are prevented from reaching the I / O pin, even if the input of the multiplexer is selected as its output.

[0027] Figure 3 is a block diagram of the I / O multiplexer 120 and its connections to the system bus 106, peripheral devices 310 (which may be, for example, the system memory 110 and peripheral device 112 in Figures 1 and 2), and I / O cells 118. The I / O multiplexer 120 includes an authenticator 320, control registers 330, and an I / O cell access control circuit 340. Additional or different components may be included, as well as parts of the I / O multiplexer 120. Each peripheral device 310 implements at least one addressable peripheral device function. Figures 5 and 6 provide a detailed illustrative implementation of the authenticator 320, which is described thereafter. Similarly, Figure 7 (described thereafter) provides a detailed illustrative implementation of the I / O cell access control circuit 340.

[0028] Continuing to refer to Figure 3, each I / O pin 119 is connected to the corresponding I / O cell 118. The control register 320 contains a control register for each I / O cell 118 (and thus also means that each I / O pin 119 has a corresponding control register). Generally, the authenticator 320 receives and authenticates transactions on the system bus 106 from the software executed by the CPU 104. Specific transactions to be authenticated by the authenticator 320 include one or more of the write transactions described above in the multi-step security protocol for connecting I / O pins to specific peripheral device functions. The authenticator 320 includes storage for the addresses of I / O pins in the UNASSIGNED state, i.e., I / O pins that are available for connection to peripheral device functions. In the case of a write transaction where the write address is the address of an I / O pin and the write data is the address of a peripheral device function, the authenticator 320 determines whether the write address corresponds to an I / O pin in the UNASSIGNED state. If the write address corresponds to an I / O pin in the UNASSIGNED state, the authenticator 320 updates the I / O pin's register using the peripheral device function identifier; otherwise (if the I / O pin's current state is not UNASSIGNED), the authenticator 320 does not update the register using the peripheral device function identifier.

[0029] In one example implementation, the authenticator 320 translates the address of a peripheral device function into a shorter (i.e., fewer-bit) identifier. For example, a software-implemented address is 27 bits long. To avoid implementing an I / O pin control register large enough to store a 27-bit address, the authenticator 320 translates the 27-bit address into a 6-bit identifier for storage in a control register. Using this 6-bit identifier, 31 different peripheral device functions (identifier 000000 is not a valid peripheral device function identifier) ​​can access a given I / O pin. Fewer or more bits than 6 may be used to implement a peripheral device function. However, in other implementations, the control register 330 is large enough to store the complete address of a peripheral device function.

[0030] The control register for the I / O pin also has one or more bits for storing the state of the I / O pin. In addition to the authenticator 320 storing an identifier for the peripheral device function, the authenticator 320 also modifies the state bits in the control register to identify the HANDOVER state.

[0031] When the I / O pin enters the HANDOVER state, the CPU 104 may issue another write transaction to transition the I / O pin's state from HANDOVER to CONNECTED (CONNECTED LOCK or CONNECTED UNLOCK). In this write transaction, the write address is the address of a peripheral device whose identifier is stored in the control register for the I / O pin. The authenticator 320 receives the write transaction, converts the write address to a corresponding 6-bit identifier, and compares the converted identifier with an identifier already stored in the I / O pin's control register. If the two identifiers do not match, the authenticator does not change the I / O pin's state from HANDOVER to CONNECTED, and the peripheral device function corresponding to the identifier converted from the write address in the write transaction is not allowed to connect to the I / O pin. However, if the authenticator 320 determines that the two identifiers match, the authenticator updates the state stored in the I / O pin's control register from HANDOVER to one of the CONNECTED states. The specific type of CONNECTED state is determined from the data written in the write transaction.

[0032] With the control register for the I / O pin indicating that the I / O pin is in the CONNECTED state, one or more control signals 331 are asserted to the I / O cell access control circuit 340 to configure the I / O cell access control circuit 340 to select signals from addressable peripheral device functions corresponding to peripheral device identifiers stored in the control register of the I / O pin and to allow those signals to be routed through the I / O pin.

[0033] In some implementations, the I / O multiplexer 120 implements multiple channels for each I / O pin 119, through which peripheral devices can be connected to any given I / O pin. For example, the I / O multiplexer 120 may implement two channels, referred to herein as the P channel and the G channel. Multiple peripheral device functions may be connected to the input of the P channel, and multiple peripheral device functions may be connected to the input of the G channel. A given peripheral device function may be connected to one channel but not to the other. Alternatively, the same peripheral device function may be connected to the inputs of both channels.

[0034] Figure 4 shows an exemplary bit assignment for a control register 330 of a given I / O pin. The bit assignments for the control registers of all I / O pins may be as shown in Figure 4. In the example in Figure 4, the control register 330 is a 32-bit register. Bits [5:0] store the identifier of the peripheral device function selected via the P channel. Bits [7:6] store the state of the I / O pin with respect to the P channel, which is called the P state. In one implementation, the P channel state bit assignment is as follows: [Table 1] Similarly, for the G channel, bits [13:8] store the identifier of the peripheral device function selected via the G channel, and bits [15:14] store the state of the I / O pins related to the G channel (G state), as shown in Table 2. [Table 2] Bit 7 is 1 when the P channel is in any of the CONNECTED states. Similarly, bit 15 is 1 when the G channel is in any of the CONNECTED states. Thus, bits 7 and 15 of the I / O pin control register 330 can be used as part of a control signal 331 to the I / O cell access control circuit 340, thereby providing a communication path from the peripheral device function to the I / O cell 118 of the I / O pin. The use of bits 7 and 15 is also illustrated in Figure 7 and described below.

[0035] Bits [31:16] of controller register 330 provide common control bits for I / O pins. Common control controls the configuration of an I / O pin regardless of which channel (P or G) peripheral device function is connected to or using that I / O pin. Table 3 below provides an example bit assignment for the common control bits in the control register. [Table 3]

[0036] Figure 5 shows an illustrative implementation of the authenticator 320 of the I / O multiplexer 120 (Figure 3). As shown, the authenticator 320 includes an address authenticator 510, state machines 530 and 550, a register 520, a read register 548, a multiplexer 534, a read multiplexer selection circuit 536, and an OR gate 540. Some or all of the address portion (address 506) of the system bus 106 is coupled to the address authenticator 510. Some or all of the data portion 507 of the system bus 106 is coupled to the state machine 530. The state machines 530 and 550 may be implemented as digital logic circuits that perform the functions described herein for the multi-process security protocol. Based on the write transaction described herein and the current state of the target I / O pin, the state machine 530 updates the corresponding I / O pin control register 330.

[0037] As described above, for an I / O pin in the UNASSIGNED state, a write transaction with a write address matching the address of the I / O pin causes the state machine 530 to update the corresponding control register 330, storing the identifier of the peripheral device function whose address is in the write data portion of the write transaction. This process is carried out in two steps. In the first step, the write data is loaded into register 520 (also called the update register) under the control of the F_Update_Cycle1 control signal. The F_Update_Cycle1 control signal is generated by the state machine 550. The state machine 550 also generates the F_Update_Cycle2 control signal, its use of which is shown in Figure 6. In the exemplary implementation, to use the same authenticated address decryption logic, the data portion of the transaction is captured in cycle 1 (via the assertion of F_Update_Cycle1) and then processed in cycle 2 (via the assertion of F_Update_Cycle2) via the address decoder. Symmetrically, a transaction directed to read / write a control register may have an address to be decrypted as the address portion of the transaction, and the decryption operation may be carried out in cycle 1. Thus, the contents of update register 520 include an identifier corresponding to the address of the peripheral device function.

[0038] As will be explained later in relation to Figure 6, the address authenticator 510 determines whether a transaction is permitted to modify the control information for the P and G channels. The address authenticator 510 asserts an authentication signal (AUTHP) for the P channel in response to an identifier from the update register 520 matching an identifier currently stored in bit [5:0] of the control register for the I / O pins, and asserts an authentication signal (AUTHG) for the G channel in response to an identifier from the update register 520 matching an identifier currently stored in bit [13:8] of the control register.

[0039] To update the control register 330, the write transaction must be authenticated as described herein. To read the control register 330, if the corresponding I / O pin is UNASSIGNED, no specific authentication is required to allow the read. If the I / O pin is in the HANDOVER or CONNECTED state, only two entities can read the I / O pin. A peripheral device function mapped to an I / O pin in the HANDOVER or CONNECTED state can read the control register 330 of the I / O pin, or a highly secure process can read the I / O pin. The read multiplexer selection circuit 536 generates a selection signal 537 to the multiplexer 534 to select which control register output read data is allowed to be stored in the read register 548. The read register 548 is coupled to the system bus 106, and therefore the contents of the control registers in the read register 548 can be provided from there to the entity that initiated the read transaction.

[0040] The SECURE READ signal 541 is asserted by the CPU 104 (e.g., logic 1) when, for example, a secure process issues a read transaction. Otherwise, SECURE READ is in the opposite logic state (e.g., 0). Similarly, the UNASSIGNED READ signal 543 is asserted by the CPU 104 (e.g., logic 1) when, for example, any process or peripheral device function attempts to read a control register whose I / O pin is in the UNASSIGNED state. Otherwise, UNASSIGNED READ is in the opposite logic state (e.g., 0). The read multiplexer selector circuit 536 has a 0 input and a 1 input. When the output signal 539 of the OR gate 540 is logic 0 (meaning no read from a secure process or read to the UNASSIGNED / O pin has occurred), the 0 input is coupled to the address authenticator 510. In that case, the peripheral device function authenticated by the address authenticator 510 is permitted to read the appropriate control register 330, such that the selection signal 537 from the read multiplexer selection circuit 536 selects the corresponding control register 330 and transfers its contents to the read register 548.

[0041] One input of the read multiplexer selector circuit 536 is coupled to at least a portion of the address portion of the system bus 106. When either the SECURE READ or UNASSIGNED READ signal 541, 543 is asserted to a logic 1 state, the OR gate 540 generates a logic 1 on its output signal 539, thereby causing the read multiplexer selector circuit 536 to select one of its inputs, and thus the address portion of the system bus 106 is used to select a specific control register 330 and transfer its contents to the read register 548. The address portion of the system bus 106 can be mapped to a smaller (i.e., fewer bit) representation and used as a selection signal 537 to the multiplexer 534.

[0042] Figure 6 shows an illustrative implementation of the address authenticator 510. The address authenticator 510 includes an input multiplexer 602, a decoder 606, and a verification circuit 610. The address authenticator 510 includes a separate verification circuit 610 for each I / O pin to be protected, as described herein. A "0" input to the multiplexer 602 receives the address portion 506 from the system bus 106, and a "1" input receives the write data portion 507 from the system bus 106. The state machine 550 asserts F_Update_Cycle1 (for example, to logic 1) and loads the write data 507 into the update register 520. After the write data has been loaded into the update register 520, the state machine 550 then asserts F_Update_Cycle2, thereby selecting the "1" input of the multiplexer 602 as the output to the decoder 606. Otherwise (if F_Update_Cycle2 is asserted to the opposite polarity state (e.g., logical 0)), the address portion 506 of the system bus is selected via the multiplexer 602 as the output to the decoder 606.

[0043] Decoder 606 is shared by all I / O multiplexers 120. Decoder 606 translates addresses provided by multiplexer 602 (whether direct addresses from system bus 106 or addresses retrieved from write data of write transactions via update register 520) into shorter peripheral device function identifiers (e.g., 6 bits in length).

[0044] The verification circuit 610 for each I / O pin includes a P-channel reencoder 612 coupled to a P-channel comparison logic circuit 614 for its P-channel. Similarly, the verification circuit 610 includes a G-channel reencoder 622 coupled to a G-channel comparison logic circuit 624 for its G-channel. Each reencoder 612 and 622 converts a longer address from the system bus 106 into a shorter representation for a peripheral device function identifier. The output 613 of the P-channel reencoder 612 is the peripheral device function identifier (labeled Pin X Next PF [5:0] in Figure 6) decoded from the system bus 106 or the update register 520. Similarly, the output 623 of the G-channel reencoder 622 is the peripheral device function identifier (labeled Pin X Next GF [5:0]) decoded from the system bus 106 or the update register 520.

[0045] Figure 6 shows the input to the P-channel comparison logic 614, which is the P-channel unassigned (PU) bit, and the input to the G-channel comparison logic 624, which is the G-channel unassigned (GU) bit. PU is asserted to a logic state (e.g., logic 1) in response to the I / O pin being in the UNASSIGNED state with respect to the P-channel. Similarly, GU is asserted to a logic state (e.g., logic 1) in response to the I / O pin being in the UNASSIGNED state with respect to the G-channel. When PU is asserted to logic 0, the P-channel comparison logic circuit 614 compares Pin X Next PF[5:0] with the P-channel function identifier currently stored in the control register of that I / O pin. Thus, when the I / O pin is not in the UNASSIGNED state with respect to the P-channel, a comparison is performed by the P-channel comparison logic. When a P-channel is in the UNASSIGNED state, the control register for that channel does not have a valid peripheral device function for comparison. Similarly, if GU is asserted to logic 0, the G-channel comparison logic circuit 624 compares Pin X Next GF[5:0] with the G-channel function identifier currently stored in the control register of its I / O pin. Thus, when the I / O pin for the G-channel is not in the UNASSIGNED state, the comparison is performed by the G-channel comparison logic. The output of the P-channel comparison logic circuit 614 is a bit with one logic state (e.g., 1) if its peripheral device function identifier matches. Otherwise, the output bit is the other logic state (e.g., 0). The output of the G-channel comparison logic circuit 624 is a bit with one logic state (e.g., 1) if its peripheral device function identifier matches. Otherwise, the output bit is the other logic state (e.g., 0).

[0046] The address authenticator 510 also includes multiplexers 640 and 644, AND gates 642 and 646 (the other type of logic gate), and AUTHP HOLD and AUTHG HOLD registers 648 and 649. The AUTHP HOLD and AUTHG HOLD registers 648 and 649 are used to store the corresponding output bits of the P-channel comparator logic circuit 614 and the G-channel comparator logic circuit 624. Asserting F_Update_Cycle1 causes registers 648 and 649 to store the corresponding outputs of the P-channel and G-channel comparator logic circuits 614 and 624. In response to F_Update_Cycle2 being logic 0, the multiplexers 640 and 644 are configured to select their 0 inputs (which are the outputs of the corresponding P-channel and G-channel comparator logic circuits 614 and 624) as their outputs. Otherwise, in response to F_Update_Cycle2 being logical 1, one input of multiplexers 640 and 644 is selected as their output. This functionality ensures that AUTHP[X] and AUTHG[X] for I / O pin X are asserted when correct. Correct means, for example, (a) when it matches the authentication of the address stored in update register 520 (in the case of a write to an I / O pin address where the write data is the address of a peripheral device function) or (b) when it matches the authentication of a direct address from the address portion 506 of the system bus (in the case of a write transaction to the address of a peripheral device function). An asserted AUTHP[X] (e.g., logical "1") means that the transaction on the P channel is authenticated and can proceed (e.g., to update control register 330). An AUTHP[X] of 0 means that the transaction is not authenticated. Similarly, an asserted AUTHP[X] (e.g., logical "1") means that the transaction on the G channel is authenticated and can proceed.

[0047] Figure 7 shows an illustrative implementation of the I / O cell access control circuit 340. A separate I / O access control circuit 340 is provided for each I / O cell and its corresponding I / O pin. Figure 7 shows the I / O access control circuit 340 for I / O pin 719 (which may be one of the I / O pins 119 in Figures 1-3). I / O pin 719 is coupled to the I / O cell circuit 718, which in turn is connected to the I / O cell access control circuit 340.

[0048] The I / O access control circuit 340 includes a P-channel multiplexer 710, a P-channel logic circuit 712, a G-channel multiplexer 720, a G-channel logic circuit 722, a multiplexer 726, and an outbound operation circuit 728. The P-channel multiplexer 710 has multiple inputs, any of which can be connected to peripheral device functions, outputs, and selection inputs. In one implementation, the P-channel multiplexer has 32 inputs and can therefore be coupled to as many as 31 different peripheral device functions. The P-channel peripheral function identifier (bits [5:0]) is a selection signal for the P-channel multiplexer. However, since the identifier value 000000 is not a valid peripheral device function, at most only 31 peripheral device functions can be selected by the peripheral device functions in the control register. Each peripheral device function input to the multiplexer 710 is a single-bit signal (i.e., 0 or 1 from the corresponding peripheral device function). In response to the state machine 530 programming the I / O pin control register with a specific peripheral device identifier for the P channel, the P channel multiplexer selects the input corresponding to the peripheral device identifier stored in the control register, based on the programmed peripheral device identifier (which is coupled to the selection input 709 of the P channel multiplexer 710).

[0049] The P-channel logic circuit 712 prevents the selected input of the P-channel multiplexer 710 from communicating with the I / O cell 718 unless the P-channel is in the CONNECTED state. The P-channel logic circuit 712 has inputs 715 and 717. The output 711 of the P-channel multiplexer 710 is coupled to input 715 of the P-channel logic circuit 712. In the example in Figure 7, the P-channel logic circuit 712 is either an AND gate 713 or includes an AND gate 713, and inputs 715 and 717 are inputs to the AND gate 713. Bit 7 of the P-state field of the control register 330 is coupled to input 717 of the AND gate 713. In one implementation, each control register 330 is a combination of flip-flops, and bit 7 is the output of the flip-flop. As already described, bit 7 is 1 when the P-channel is in any of the CONNECTED states. When bit 7 is 0, any signal from a peripheral device function via multiplexer 710 is gated off by AND gate 713. In response to the P channel being in any CONNECTED state, bit 7 is 1, and therefore the logic state of the signal on the selected peripheral device function via multiplexer 710 flows through AND gate 713 to input 729 of multiplexer 726.

[0050] The G-channel has a structure similar to that of the P-channel. The G-channel multiplexer 720 has multiple inputs (e.g., 32), any of which can be coupled to a peripheral device function. The G-channel peripheral function identifier (bits [13:8]) is a selection signal for the G-channel multiplexer 720. Thus, in response to the state machine 530 programming the I / O pin control register with a specific peripheral device identifier for the G-channel, the G-channel multiplexer 720 selects the input corresponding to the peripheral device identifier stored in the control register by the programmed peripheral device identifier. Each peripheral device function input to the multiplexer 720 is a single-bit signal (i.e., 0 or 1 from the corresponding peripheral device function). The G-channel logic circuit 722 has inputs 719 and 721. The output 727 of the G-channel multiplexer 720 is coupled to input 721 of the G-channel logic circuit 722.

[0051] Similar to the P-channel logic circuit 712, the G-channel logic circuit 722 prevents selected peripheral device functions from communicating with the I / O cell unless the G-channel is in the connected state. In the example in Figure 7, the G-channel logic circuit 722 is either an AND gate 723 or includes an AND gate 723, with inputs 719 and 721 being the inputs to the AND gate 723. Bit 15 of the G-state field of the control register 330 (which may be the output of a flip-flop) is coupled to input 719 of the AND gate 723. As already explained, bit 15 is 1 when the G-channel is in either the CONNECTED state. When bit 15 is 0, any signal from peripheral device functions via the multiplexer 720 is gated off by the AND gate 723. In response to the GP channel being in the CONNECTED state, bit 15 is 1, and therefore, the logic state of the signal on the selected peripheral device function flows through the multiplexer 720 to the input 731 of the multiplexer 726 via the AND gate 723.

[0052] Therefore, in order for a given peripheral device function to assert a signal to a given I / O cell 718, the control register for that I / O cell must be programmed for the identifier of the given peripheral device function, and the channel to which the peripheral device function is coupled must be in one of the CONNECTED states. The peripheral device function identifier bit in the control register is used to control the multiplexers 710, 720 for that channel, and at least one of the state bits for that channel (e.g., bits 7 and 15) is used to gate on / off the communication path between the peripheral device function and the I / O cell based on the state of the channel.

[0053] The multiplexer 726 implements priority selection between the P channel and the G channel when both the P channel and the G channel have active connections between the I / O cell circuit 718 and peripheral device functions. For example, the G channel may be used to drive a bit wake-up protocol sequence to the I / O pin 719 to inform a receiving device that a transmission is about to occur, while the P channel may be used to drive data to the receiving device. The PRIORITY signal 725 is a selection signal for the multiplexer 725 to select either the P channel or the G channel to couple to the I / O cell circuit 718. The PRIORITY signal 725 may be asserted, for example, by the state machine 530.

[0054] The I / O cell circuit 718 receives one or more bits from the common control field in the control register 330. The I / O cell circuit 718 uses these bits to configure itself (e.g., open-drain, pull-up or pull-down resistor, drive strength, etc.).

[0055] Figure 8 is an illustrative state diagram showing the states implemented by the state machine 530 for a given I / O pin X. This state diagram is applicable to either the G channel or the P channel for a given I / O pin. The states in this illustrated example include UNASSIGNED 810, HANDOVER 820, CONNECTED (UNLOCKED) 830, CONNECTED (LOCKED) 840, and LOCKED 850. GU is a hidden register bit for the G channel, indicating the unassigned state of the G channel. GU being 1 means that the G channel is not assigned to I / O pin X, and GU being 0 means that a peripheral device function is assigned to I / O pin X via the G channel. PU is also a hidden register bit for the P channel, meaning the same as the GU bit. GL is a hidden register bit for the G channel, indicating the locked state of the G channel. A GL of 1 means that I / O pin X is locked for a specific peripheral device function, and a GL of 0 means that the I / O pin is not locked. PL is also a hidden register bit for the P channel and has the same meaning as the GL bit. The G state indicates the state of the G channel ("00" means UNASSIGNED, "01" means HANDOVER, "10" means CONNECTED (UNLOCKED), and "11" means CONNECTED (LOCKED)). The state diagram in Figure 8 is applicable to the G channel, but similar state transitions are implemented for the P channel by the state machine 530.

[0056] While in UNASSIGNED state 810, GU is equal to 1 (unassigned), GL is equal to 0 (not locked), and GSTATE and PSTATE are equal to "00" (unassigned). State machine 530 may transition from UNASSIGNED state 810 to HANDOVER state 820. In HANDOVER state, I / O pin X has been handed over to a peripheral device function, and therefore the I / O pin is no longer unassigned. The transition between UNASSIGNED state 810 and HANDOVER state 820 can be brought about by one of two methods. First, if PU is set to equal 1 (meaning the P channel is in the UNASSIGNED state for I / O pin X), the software issues a write transaction whose write address is the address of I / O pin X, and if nextGSTATE is set to "01" (the state bit in control register 330) and nextGF is not equal to 0 (i.e., the write data is the address of a peripheral device function and therefore not 0), the G channel state changes from UNASSIGNED state 810 to HANDOVER state 820. The state machine 530 updates the control register for I / O pin X to store the identifier for the peripheral device function (followed by the mapping of its address to an identifier), and updates the register's state bit to "01" to indicate that the G channel state has become HANDOVER. At this point, the G channel is in the HANDOVER state for a particular peripheral device function, and the P channel is still in the UNASSIGNED state (meaning none of the peripheral device functions coupled to the P channel multiplexer 710 are unassigned for I / O pin X). While the G channel is in HANDOVER state 820, GU=0, GL is 0 or 1, and GSTATE is "01".

[0057] When the HANDOVER state 820 is reached, a transition to one of the following states may occur: CONNECTED (UNLOCKED) state 830, CONNECTED (LOCKED) state 840, or LOCKED state 850. When nextGSTATE = "10", the GL lock bit is set to 0, and AuthG[X] 511 is asserted by the address authenticator 510, a transition to the CONNECTED (UNLOCKED) state 830 occurs. While in the CONNECTED (UNLOCKED) state 830, GU = 0, GL = 0, and GSTATE = "10". The state machine 530 updates the control register 330 for I / O pin X to specify the G channel state as "10". In the CONNECTED (UNLOCKED) state 830, peripheral device functions connected to I / O pin X can send or receive data using the I / O pin.

[0058] A transition from HANDOVER state 820 to CONNECTED (LOCKED) state 840 may occur when AuthG[X]511 is asserted by address authenticator 510, or when nextGSTATE is "11" and the GL lock bit is set to 1. While in CONNECTED (LOCKED) state 840, GU=0, GL=1, and GSTATE="11". The state machine 530 updates the control register 330 for I / O pin X to specify the G channel state as "11". In CONNECTED (LOCKED) state 830, peripheral device functions connected to I / O pin X can send or receive data using the I / O pin.

[0059] The LOCKED state 850 is a state in which the I / O pins are locked but not connected to any peripheral device functions. When AUTHP[x] is asserted by the address authenticator 510 while PU=0, nextGSTATE="00", nextGF=0, and nextGU=1, the state machine 530 transitions to the LOCKED state 850. While in this state, PU=0 (assigned), GU=1 (assigned), GL=1 (locked), and GSTATE="00" (unassigned). When AUTHP[x] is asserted by the address authenticator, nextPU is set to 1, and nextGL is set to 0, the state machine 530 may return from the LOCKED state 850 to the UNASSIGNED state 810.

[0060] Figure 9 is a flowchart illustrating the exemplary method 900. At 902, a request is made to access the target I / O pin. In one example (and as described above), this involves the CPU 104 executing one or more machine instructions to perform a write transaction, in which the write address is the address of the target I / O pin and the write data includes the address of the peripheral device function.

[0061] In step 904, a state machine (for example, a state machine 530 in the authenticator 320 of the I / O multiplexer 120) determines whether the target I / O pin is currently in the UNASSIGNED state. This determination is made by checking a state bit. If the state bit corresponds to the UNASSIGNED state (for example, 00), the target I / O pin is determined to be in the UNASSIGNED state. Otherwise, the target I / O pin is determined not to be in the UNASSIGNED state. If the target I / O pin is in the ASSIGNED state (meaning it is assigned to a different peripheral device function), the request is rejected in step 906. Rejection of the request may mean ignoring the request and taking no further action.

[0062] If the target I / O pin is currently in the UNASSIGNED state, control is passed to operation 908, and the state of the target I / O pin is changed to the HANDOVER state. This operation can be performed by the state machine 530 updating the state field of the control register 330 for the target I / O pin to identify the HANDOVER state. At 910, a request is made to connect the I / O pin to the peripheral device function identified in the control register 330. This request can be performed by the CPU 104 issuing a write transaction, in which the write address is the address of the peripheral device function and the write data includes an indication of the CONNECTED state for the I / O pin (e.g., CONNECTED(LOCKED) or CONNECTED(UNLOCKED)). The verification circuit 610 in the address authenticator 510 determines whether the identifier corresponding to the write address matches the identifier currently stored in the control register of the I / O pin. If the identifiers do not match, the request is denied at 914. However, if the identifiers match, control moves to operation 916, where the state machine 530 changes the state of the I / O pin to one of the CONNECTED states (as specified in the request in operation 910). Then, in operation 918, if the I / O pin is in the CONNECTED state for a given peripheral device function (as ensured by the state machine 530), a common control bit in the control register 330 is configured.

[0063] Figures 10A, 10B, and 10C show examples of specific peripheral device functions being connected to specific I / O pins. Three peripheral devices 1001, 1002, and 1003 are shown as UART0, UART1, and I2C0, respectively. UART0 has a base address of 0×40004800 and two peripheral device functions: transmit (TXD) and receive (RXD). The TXD function has an address offset of 0×8 for the base address, and the RXD offset is 0×4. Similarly, UART1 has a base address of 0×40012800 and has a TXD offset of 0×8 and an RXD offset of 0×4. The I2C has a base address of 0×40073800 and two functions and their offsets are DATA (offset 0×8) and CLK (offset 0×4). I / O pins in the UNASSIGNED state are identified at 1005. The address space for the I / O pins has a base address of 0×4001A000, with I / O pins 1, 2, and 22 having offsets of 0×4, 0×8, and 0×58, respectively.

[0064] In this example, the TXD function of UART 0 initiates the process of connecting to I / O pin 22. In step 1011, a write transaction is performed (e.g., by CPU 102), in which the write address is the address of I / O pin 22 (0x4001A058) and the write data includes the address of the TXD function of UART 0 (0x40004808). The authenticator 320 responds as described above, and the state machine 530 updates the control register 330 for I / O pin 22 to identify that the state of the identifier for the I / O pin and the corresponding peripheral device function is HANDOVER for the P channel (the G channel is still in the UNASSIGNED state), and that the identifier corresponds to UART 0 TXD address 0x40004808.

[0065] In step 1012, a write transaction is performed, in which the write address is the address of UART 0 TXD (address 0×40004808), and the write data includes bits that encode the following as CONNECTED (UNLOCKED) state for I / O pin 22. The firewall ensures the security of transactions targeting UART 0 TXD and therefore authenticates the transaction in step 1012.

[0066] In step 1013, a common control bit for I / O pin 22 is configured via a write transaction, in which the write address is again the address of UART 0 TXD (0x40004808), and the write data includes the common control configuration bit. Similar to step 1012, the firewall ensures the security of transactions targeting UART 0 TXD and therefore authenticates the transaction in step 1013.

[0067] The term “to combine” is used throughout this specification. This term may encompass connections, communications, or signaling paths that enable a functional relationship consistent with the descriptions herein. For example, if device A generates a signal that controls control device B to perform a certain action, in the first example, device A is combined with device B, and in the second example, if the intervening component C does not substantially alter the functional relationship between device A and device B, device A is combined with device B via the intervening component C, so that device B is controlled by device A via the control signal generated by device A.

[0068] Modifications to the described embodiments are permitted within the scope of the claims, and other embodiments are possible.

Claims

1. 1. A system comprising: a multiplexer having a set of inputs, an output and a selection input; Input / output (I / O) pins; a logic circuit coupled between the multiplexer and the I / O pin, the logic circuit having a first input; A control register, a first bit field corresponding to the I / O pin, the first bit field being coupled to a select input of the multiplexer; a second bit field corresponding to the I / O pin, the second bit field being coupled to a first input of the logic circuit; the control register, Including, the system.

2. 2. The system of claim 1, The logic circuit further comprises a second input coupled to the output of the multiplexer.

3. 2. The system of claim 1, a device coupled to one of the inputs of the multiplexer, the device including an identifier; The system, wherein the first bit field is configured to store an identifier of the device.

4. 4. The system of claim 3, the identifier is an m-bit identifier, The system further comprises: The system further comprises a re-encoder configured to convert an n-bit address of the device to the m-bit identifier, where m is less than n.

5. 2. The system of claim 1, The second bit field stores a state of the I / O pin.

6. 2. The system of claim 1, the first bit field is configured to store an identifier of a device, and the second bit field is configured to store a state of the I / O pin; The system further comprises: an authenticator coupled to the control register, in response to generation of a write transaction having a first write address and first write data, the first write address being an address of the I / O pin and the first write data being an address of a device; updating the first bit field to store an identifier of the device; updating the second bit field for the I / O pin as being in HANDOVER for the device whose identifier is in the first bit field; The system further comprises the authenticator configured to:

7. 7. The system of claim 6, the authenticator is further configured to update the second bit field to a new state of the I / O pin in response to occurrence of a second write transaction having a second write address and second write data, the second write address being the address of the device and the second write data including a new state of the I / O pin, to be included in the second write data.

8. 7. The system of claim 6, The system further comprising an update register coupled to the authenticator, the update register configured to store an address of the device.

9. 9. The system of claim 8, The system further includes a re-encoder configured to convert an address of the device from the update register to a shorter identifier of the device.

10. 2. The system of claim 1, The system, wherein the system is a system on a chip (SoC).

11. 1. A system comprising: an input / output (I / O) cell circuit; an I / O cell access control circuit coupled to the I / O cell circuit; an authenticator coupled to a system bus; a control register coupled between the authenticator and the I / O cell access control circuit; Including, The authenticator, validating the first request to map the I / O cell circuitry to a device identified in the first request if the I / O cell circuitry is not currently mapped to another device; updating the control register to associate the device identified in the first request with the I / O cell circuit; The system is configured as follows.

12. 12. The system of claim 11, The system, wherein the first request is a write transaction having a write address and write data, the write address being an address corresponding to the I / O cell circuit, and the write data including an address of the device.

13. 13. The system of claim 12, The system, wherein the authenticator includes a re-encoder configured to convert an address of the device into a shorter identifier for the device.

14. 12. The system of claim 11, The authenticator, authorizing the second request to connect the I / O cell circuitry to the device identified in the second request if the I / O cell circuitry is not currently mapped to the device; updating the control register to change the state of the I / O cell circuit to indicate that the I / O cell circuit is connected to the device; The system further comprises:

15. 12. The system of claim 11, a multiplexer having a set of inputs, an output and a selection input; a logic circuit coupled between the multiplexer and the I / O cell circuit, the logic circuit having a first input; Further comprising: The control register: a first bit field corresponding to the I / O cell circuit, the first bit field being coupled to the select input of the multiplexer; a second bit field corresponding to the I / O cell circuit, the second bit field being coupled to the first input of the logic circuit; Including, the system.

16. 16. The system of claim 15, The system, wherein the first bit field is configured to store an identifier of the device and the second bit field is configured to store a state of the I / O cell circuitry.

17. 1. A method comprising: receiving a first request to access an input / output (I / O) pin, the I / O pin having a state, the first request specifying a device for communicating with the I / O pin; in response to the state of the I / O pin indicating that the I / O pin is not assigned to any device, updating the state of the I / O pin in a control register to indicate that the I / O pin is associated with the device and storing an identifier of the device in the control register; receiving a second request to connect the I / O pin to the device; updating a state of the I / O pin in the control register to identify a state included in the second request in response to the control register storing an identifier of the device; A method comprising:

18. 20. The method of claim 17, The method further includes updating the control register to configure I / O cell circuitry to be coupled to the I / O pin.

19. 20. The method of claim 17, The method of claim 1, wherein the first request is a write transaction having a first write address and first write data, the first write address being an address of the I / O pin and the first write data being an address of the device.

20. 20. The method of claim 17, the second request is a write transaction having a second write address and second write data, the second write address being an address of the device and the second write data indicating a state for the I / O pin.

Images