Patent Publication Number: US-11397809-B2

Title: Protection scheme for sensor segmentation in virtualization application

Description:
TECHNICAL FIELD 
     This disclosure is related to the field of data interfaces, and in particular, to the protection of sensor data from unauthorized access by virtual machines running on a system on a chip external to the sensors, and the protection of sensor data streams in a peripheral within the system on a chip from unauthorized access by queues in the peripheral. 
     BACKGROUND 
     Embedded applications, such as automotive systems, may include a system on a chip (SoC) that uses internal converters to receive input from external sensors and convert the sensor inputs to a digital data to be used for further processing by a CPU or multiple CPUs within the SoC. As the processing power available to such SoCs has grown, it has become common to execute multiple virtual machines on such SoCs, with each virtual machine executing different functions. This helps to provide for protection against errors, since an error or crash with one virtual machine will be isolated from other virtual machines. 
     Due to this virtualization, a need arises for an interface between the virtual machines executing on the CPU within the SoC and the various peripherals within the SoC. Current systems assign identification numbers to each virtual machine, and pair these virtual machine identification numbers to peripherals on an on-chip network level so as to permit or deny access to each peripheral on a per-virtual machine basis. 
     This, however, does not permit multiple virtual machines to access the same peripheral, which can lead to replication of peripherals leading to more area and power consumption. Therefore, further development is needed. 
     SUMMARY 
     One aspect claimed herein is directed to a system including a system on a chip (SoC) having one or more central processing units (CPU) configured to execute a plurality of virtual machines. The SoC also includes a peripheral. The peripheral includes a crossbar circuit configured to receive a plurality of digital sensor signals and to selectively output the plurality of digital sensor signals to different outputs. The peripheral also includes a plurality of queue circuits, each of the plurality of queue circuits receiving a different one of the plurality of digital sensor signals from the crossbar circuit. The peripheral further includes a plurality of queue protection circuits associated with the plurality of queue circuits, each of the plurality of queue protection circuits configured to selectively permit access to one of the plurality of queue circuits by the plurality of virtual machines. The CPU is also configured to execute a hypervisor for the plurality of virtual machines, the hypervisor controlling the plurality of queue protection circuits to set which of the plurality of virtual machines may access each of the plurality of queue circuits. 
     Each of the plurality of queue protection circuits may selectively permit access to its associated one of the plurality of queue circuits by permitting reading from that queue circuit and by permitting issuing commands to that queue circuit. 
     A sensor protection circuit may be associated with the crossbar circuit, the sensor protection circuit configured to selectively permit reading of the plurality of digital sensor signals from the crossbar circuit by the plurality of queue circuits. The hypervisor may also be configured to control the sensor protection circuit to set which of the plurality of queue circuits may access each of the plurality of digital sensor signals from the crossbar circuit. 
     The sensor protection circuit may include status registers and control registers. The hypervisor may program into the control registers the queue ID numbers of which of the plurality of queue circuits are permitted to access which of the plurality of digital sensor signals. The sensor protection unit may include control circuitry. The control circuitry may be configured to, for each queue circuit requesting access to at least one of the plurality of digital sensor signals: compare the queue ID number of that queue circuit to the queue ID numbers stored in the control registers; permit access by that queue circuit to those of the plurality of digital sensor signals for which the queue ID number of that queue circuit is stored in the control registers as being permitted to access; and program the status registers with the queue ID number of each queue circuit requesting access to one of the plurality of digital sensor signals for which the queue ID number of that queue circuit is not stored in the control registers as being permitted to access. 
     The hypervisor may control the plurality of queue protection circuits such that one of the plurality of queue circuits is inaccessible by the plurality of virtual machines and is instead only accessible by the hypervisor. 
     The hypervisor may control the queue protection circuits such that one of the plurality of queue circuits is inaccessible by the plurality of virtual machines and is instead only accessible by the hypervisor, while each of the others of the plurality of queue circuits is only accessible by a single different one of the virtual machines. 
     Each queue circuit may be allocated to a certain application type or use case. 
     Each queue protection circuit may include status registers, and may also include control registers into which the hypervisor programs virtual machine ID numbers of which of the plurality of virtual machines are permitted to access the queue circuit associated with that queue protection circuit. Each queue protection circuit may also include control circuitry configured to, for each virtual machine requesting access to the queue circuit associated with that queue protection circuit: compare the virtual machine ID number of each virtual machine requesting access to the virtual machine ID numbers stored in the control registers; permit access to each virtual machine requesting access having a virtual machine ID number matching one of the virtual machine ID numbers stored in the control registers; and program the status registers with the virtual machine ID number of each virtual machine requesting access that does not match one of the virtual machine ID numbers stored in the control registers. 
     An analog to digital converter may be configured to digitize a plurality of analog sensor signals to produce the plurality of digital sensor signals. 
     The analog to digital converter may include a successive approximation based analog to digital converter. 
     Each queue circuit may be configured to selectively send control commands to the crossbar circuit indicating at least one of an identification number of that queue circuit, which of the plurality of digital sensor signals that queue circuit desires to receive, and an analog to digital conversion type desired for those of the plurality of digital sensor signals that queue circuit desires to receive. 
     Each of the plurality of queue circuits may include a FIFO buffer. 
     Another aspect claimed herein is directed to a system including a system on a chip (SoC) with a central processing unit (CPU) configured to execute a plurality of virtual machines. The SoC includes a peripheral. The peripheral includes a crossbar circuit configured to receive a plurality of digital sensor signals and to selectively output the plurality of digital sensor signals to different outputs. The peripheral also includes a plurality of queue circuits, each of the plurality of queue circuits receiving a different one of the plurality of digital sensor signals from the crossbar circuit. A sensor protection circuit is associated with the crossbar circuit, the sensor protection circuit configured to selectively permit reading of the plurality of digital sensor signals from the crossbar circuit by the plurality of queue circuits. The CPU is configured to execute a hypervisor controlling the sensor protection circuit to set which of the plurality of queue circuits may access each of the plurality of digital sensor signals from the crossbar circuit. 
     The sensor protection circuit may include status registers, and may also include control registers into which the hypervisor programs queue ID numbers of which of the plurality of queue circuits is permitted to access which of the plurality of digital sensor signals. The sensor protection circuit may also include control circuitry configured to, for each queue circuit requesting access to at least one of the plurality of digital sensor signals: compare the queue ID number of that queue circuit to the queue ID numbers stored in the control registers; permit access by that queue circuit to those of the plurality of digital sensor signals for which the queue ID number of that queue circuit is stored in the control registers as being permitted to access; and program the status registers with the queue ID number of each queue circuit requesting access to one of the plurality of digital sensor signals for which the queue ID number of that queue circuit is not stored in the control registers as being permitted to access. 
     Each of the plurality of queue circuits may be a FIFO buffer. 
     The crossbar circuit may be configured to digitize a plurality of analog sensor signals to produce the plurality of digital sensor signals. 
     Each queue circuit may be configured to selectively send control commands to the crossbar circuit indicating at least one of an identification number of that queue circuit, which of the plurality of digital sensor signals that queue circuit desires to receive, and an analog to digital conversion type desired for those of the plurality of digital sensor signals that queue circuit desires to receive. 
    
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         FIG. 1  is a block diagram of an embedded system in accordance with this disclosure. 
         FIG. 2  is a block diagram of a hypervisor and virtual machines executing on the system on a chip of the embedded system of  FIG. 1 . 
         FIG. 3  is a block diagram of a first embodiment of circuitry on a peripheral of  FIG. 1  for managing interface between the peripheral and the virtual machines of  FIG. 2 . 
         FIG. 4  is a block diagram of a sample queue protection unit such as may be used with the queues of  FIGS. 3, 5, and 6 . 
         FIG. 5  is a block diagram of a second embodiment of circuitry on a peripheral of  FIG. 1  for managing interface between the peripheral and the virtual machines of  FIG. 2 . 
         FIG. 6  is a block diagram of a sample sensor protection unit such as may be used with the crossbar circuitry of  FIGS. 5 and 7 . 
         FIG. 7  is a block diagram of a third embodiment of circuitry on a peripheral of  FIG. 1  for managing interface between the peripheral and the virtual machines of  FIG. 2 . 
     
    
    
     DETAILED DESCRIPTION 
     The following disclosure enables a person skilled in the art to make and use the subject matter disclosed herein. The general principles described herein may be applied to embodiments and applications other than those detailed above without departing from the spirit and scope of this disclosure. This disclosure is not intended to be limited to the embodiments shown, but is to be accorded the widest scope consistent with the principles and features disclosed or suggested herein. 
     An embedded system  10 , such as that used in a motor vehicle, is shown in  FIG. 1 . The embedded system  10  includes a system on a chip (SoC)  11  including peripherals  12   a - 12   c  interfaced with multiple sensors  9   a - 9   c , with it being understood that there may be any number of such sensors and peripherals. The sensors  9   a - 9   c  may be any type of modules, such as voltage sensors, temperature sensors, pressure sensors, fluid level sensors, image sensors, time of flight ranging sensors, etc. These sensors  9   a - 9   c  are connected to analog-to-digital converter modules inside the peripherals  12   a - 12   c  of the SoC  11  which control the configuration of external sensors as well as convert the sensor&#39;s analog data to a digital value to be processed. 
     As shown in  FIG. 2 , the SoC  11  executes a hypervisor  16 , which can also be referred to as a virtual machine monitor. The hypervisor  16  creates and manages multiple virtual machines  15   a  . . .  15   n  (n being any integer), with each virtual machine executing its own operating system. The hypervisor  16  creates virtual resources from physical resources such as memory and controls access by the virtual machines  15   a  . . .  15   n  to these virtual resources, thereby enabling the same physical resources to be used by multiple virtual machines. The hypervisor  16  arranges the virtual resources to be walled off from each other, such that each virtual machine sees and can access only its own virtual resources. 
     Now described with reference to  FIG. 3  is a design for a peripheral  12  usable with the embedded system  10  of  FIG. 1 . The peripheral  12  includes an analog multiplexing circuit  20  receiving m analog sensor inputs, labeled as  19   a  . . .  19   m , from a given sensor  9   a - 9   c . An analog to digital converter (ADC)  21  such as successive approximation converter cooperates with the analog multiplexing circuit  20  to digitize the sensor inputs  19   a  . . .  19   m  (m being any integer), and to provide the digitized sensor inputs to a crossbar circuit  22 . The crossbar circuit  22  selectively provides ones of the digitized sensor inputs to queues  24   a  . . .  24   p  (p being any integer). Each queue  24   a  . . .  24   p  is a first in first out (FIFO) buffer. 
     Each queue  24   a  . . .  24   p  may send control commands and data to the crossbar circuit  22 , such as the identification number of that queue, one or more channel numbers of the ADC  21  that the queue requests to receive (e.g., which of the sensor inputs  19   a  . . .  19   m  that the queue requests to receive in digitized form), and whether the analog to digital conversion of the selected sensor inputs  19   a  . . .  19   m  is to be performed continuously or on a different basis (periodic, single, etc). The crossbar circuit  22  may respond to commands and data received from the queues  24   a  . . .  24   p  with response signals, such as indicating that an analog to digital conversion of one or more given sensor inputs  19   a  . . .  19   m  is complete, or such as the digitized versions of the sensor inputs  19   a  . . .  19   m.    
     Each virtual machine  15   a  . . .  15   n  has a virtual machine identification number (VMID) associated with it. Each queue  24   a  . . .  24   p  has a queue protection unit  25   a  . . .  25   p  associated therewith. The structure of the queue protection units  25   a  . . .  25   p  is shown in  FIG. 4 , where it can be seen that each queue protection unit  25   a  . . .  25   p  includes control circuitry  30  interfaced with the SOC for potential communication with the hypervisor  16  and virtual machines  15   a  . . .  15   n , control registers  31  for storing the VMID of virtual machines  15   a  . . .  15   n  which are permitted to access the queue  24   a  . . .  24   p  associated with that queue protection unit, status registers  31  for storing the VMID of virtual machines  15   a  . . .  15   n  which request access but which are not permitted access, and configuration registers  33  controlling the functionality of the queue protection unit. 
     The hypervisor  16  programs the control registers  31  of the queue protection units  25   a  . . .  25   p  with the VMID numbers of the virtual machines  15   a  . . .  15   n  allowed to access the queues  24   a  . . .  24   p  associated with those queue protection units. When a given queue from among the queues  24   a  . . .  24   p  receives an access request (such as a read request or a command, either of which can be in the form of programming bits into the configuration registers  33 ) from a virtual machine  15   a  . . .  15   n , the control circuitry  30  of the queue protection unit from among the queue protection units  25   a  . . .  25   p  associated with the given queue checks whether the VMID of the requesting queue is stored in the status registers  31  of the given queue protection unit. If the VMID of the requesting queue is stored in the status registers  31  of the given queue protection unit, then access to the given queue is granted to the requesting virtual machine  15   a  . . .  15   n  by the control circuitry  30  of the given queue protection unit. If, however, the VMID of the requesting queue is not stored in the status registers  31  of the given queue protection unit, then access to the given queue is not granted to the requesting virtual machine  15   a  . . .  15   n  by the control circuitry  30  of the given queue protection unit, and instead the VMID of the requesting queue is stored in the status registers  32  as an unauthorized access attempt. By an access request, both read access and command access (e.g., ability to send commands to, ability to program the configuration registers  33 ) is meant, with it being understood that in some cases read access but not command access may be granted to a given virtual machine. 
     Another embodiment of a peripheral  12 ′ is shown in  FIG. 5 . Here, notice that the queues  24   a  . . .  24   p  lack associated queue protection units, and that the ADC  21 ′ directly receives the analog sensor inputs  19   a  . . .  19   m.    
     Notice that the crossbar circuit  22 ′ contains a sensor protection unit  23 . Each queue  24   a  . . .  24   p  has a queue identification number (QID) associated with it. As shown in  FIG. 6 , the sensor protection unit  23  includes control circuitry  40  interfaced with the queues  24   a  . . .  24   p  for facilitating potential data passage from the ADC  21 ′ to the queues  24   a  . . .  24   p , control registers  41  for storing QIDs of the queues  24   a  . . .  24   p  and which ADC channels (i.e. which sensor inputs  19   a  . . .  19   m ) those queues  24   a  . . .  24   p  are permitted to access, status registers  42  for storing the QIDs of queues  24   a  . . .  24   p  which request access to ADC channels to which they are not permitted access, and configuration registers  43  controlling the functionality of the sensor protection unit  23 . 
     The hypervisor  16  programs the control registers  41  of the sensor protection unit  23  with the QID numbers of the queues  24   a  . . .  24   p  together with which ADC channels those queues are allowed to access. When the crossbar circuit  22 ′ receives an access request (such as a command to convert a given analog sensor input  19   a  . . .  19   m  into a digital sensor input, which can be in the form of programming bits into the configuration registers  43 ) from a queue  24   a  . . .  24   p , the control circuitry  40  checks whether the bits stored in the control registers  41  indicate that the QID of that queue is permitted to access the requested ADC channel. If the QID is permitted to access the requested ADC channel, then access is granted to the requesting queue  24   a  . . .  24   p  by the control circuitry  40 . If the QID is not permitted to access the requested ADC channel, then access is not granted to the requesting queue  24   a  . . .  24   p  by the control circuitry  40 , and instead the QID and the requested ADC channel are stored in the status registers  42  as an unauthorized access attempt. 
     By an access request, both read access and command access (e.g., ability to receive data from a given ADC channel, as well as ability to send commands to and program the configuration registers  43 ) is meant, with it being understood that in some cases read access may be granted but not command access. 
     Another embodiment of a peripheral  12 ″ is shown in  FIG. 7 . This peripheral  12 ″ has identical functionality to the peripheral  12 ′ of  FIG. 5 , except it also includes the queue protection units  25   a  . . .  25   p  as described with reference to the peripheral  12  shown in  FIG. 3 . 
     While the disclosure has been described with respect to a limited number of embodiments, those skilled in the art, having benefit of this disclosure, will appreciate that other embodiments can be envisioned that do not depart from the scope of the disclosure as disclosed herein. Accordingly, the scope of the disclosure shall be limited only by the attached claims.