Granted Patent B2

US 9,092,647 · App. 13/789,387 · Granted Jul 28, 2015

Abstract

Claims (54)

1. A method, at an integrated circuit, comprising:

providing, from a first data processor core to an interconnect, first configuration information to be stored at a first DMA channel register of a direct memory access (DMA) controller, the first configuration information including security information that corresponds to a first security mode of the first data processor core, wherein memory accesses of the first data processor core are qualified based upon the security information of the first configuration information;

providing a first access request from the first DMA channel register to the interconnect that includes an address and the security information of the provided first configuration information;

qualifying the first access request based upon the security information, corresponding to the first security mode, of the first access request provided by the first DMA channel register, wherein the qualifying comprises determining whether the first access request is allowed to continue or is prevented from proceeding;

when the first access request is allowed to continue, performing a DMA transfer based on the first access request, wherein a first channel of the DMA controller masquerades as the first data processor core operating in a specified security mode; and

when the first access request is prevented from proceeding, preventing the first access request from storing or returning requested information.

2. The method of claim 1 , further comprising qualifying the first access request using a same criteria as is used to qualify access requests of the first data processor core that have a same security information as the first access request.

3. The method of claim 1 further comprising:

providing, a second access request, from the first data processor core to the interconnect, second configuration information to be stored at the first channel to change the security information of the first DMA channel register.

4. The method of claim 1 further comprising:

storing the security information of the first configuration information at the first DMA channel register in response to being qualified;

receiving a second access request to access information of the first DMA channel register; and

qualifying the second access request based upon the security information stored at the first DMA channel register that corresponds to the first security mode.

5. The method of claim 1 further comprising:

providing a second access request, from the first data processor core to the interconnect, second configuration information to be stored at a second DMA channel register of the direct memory access (DMA) controller, the second configuration information including second security information that corresponds to a second security mode of the first data processor;

providing a third access request from the second DMA channel register to the interconnect that includes a second address and the second security information of the provided second configuration information; and

qualifying the third access request based upon the second security information, corresponding to the second security mode, of the third access request provided by the second DMA channel register.

6. The method of claim 1 further comprising:

subsequent to providing the first access request, providing, from the first data processor core to the interconnect, second configuration information to be stored at the first DMA channel register, the second configuration information including second security information that corresponds to a second security mode of the first data processor core;

providing a second access request from the first DMA channel register to the interconnect that includes a second address and the second security information of the provided second configuration information; and

qualifying the second access request based upon the second security information, corresponding to the security mode, of the second access request.

7. The method of claim 6 , wherein qualifying the first access request includes determining whether a slave device is to be accessed by the first access request based upon the security information corresponding to the first security mode, and qualifying the second access request includes determining whether the slave device is to be accessed by the second access request based upon the security information corresponding to the second security mode.

8. The method of claim 1 further comprising:

subsequent to providing the first configuration information, providing from the first data processor core a second access request to store second configuration information at the first DMA channel register, the second configuration information including security information that corresponds to a second security mode; and

qualifying the second access request to the first DMA channel register based upon the security information corresponding to the first security mode.

9. The method of claim 1 further comprising:

subsequent to providing the first configuration information, providing from the first data processing core a second access request to store second configuration information at the first DMA channel register, the second configuration information including security information that corresponds to a second security mode; and

qualifying the second access request to the first DMA channel register based upon whether a security mode of the second access request is greater than the second security mode identified by the security information of the second configuration information.

10. A device comprising an integrated circuit, the device generating access requests having a security indicator, the device comprising:

an interconnect to communicate access requests between devices;

a user programmable first storage location;

a data processor adapted to operate in one of a plurality of security modes including a first security mode and a second security mode, and to provide access requests to the interconnect that include a security indicator having a first state that corresponds to a particular security mode of the plurality of security modes at which the data processor is operating when the access request is generated, wherein the security indicator has the first state in response to the particular security mode being the first security mode, and the security indicator has a second state in response to the particular security mode being the second security mode; and

a programmable master device adapted to provide access requests to the interconnect, a security indicator of access requests provided by the programmable master has the first state in response to the first storage location storing a first indicator, and has the second state in response to the first storage location storing a second indicator wherein the programmable master device masquerades as the data processor operating in a specified security mode according to a value of the first storage location.

11. The device of claim 10 , wherein the first storage location is coupled to the interconnect and is programmable by the data processor.

12. The device of claim 10 further comprising an access protection unit coupled to the first storage location to compare the state of a security indicator of an access request to the first storage location to a minimum required state stored at a programmable second storage location, and preventing the access requests to the first storage location in response to the state of the security indicator of the access requests being below the minimum required state, and allowing access requests to the first storage location in response to the security indicator of the access requests being equal to or greater than the minimum required state.

13. The device of claim 12 , further comprising an input output memory management unit that can masquerade as the data processor in response to being configured by the data processor.

14. A method, at an integrated circuit, of generating access requests having a security indicator, the method comprising:

providing a first access request targeting a slave device from a first data processor while the first data processor is operating in a particular security mode of a plurality of security modes, wherein

a state of a security indicator of the first access request is a first state in response to the particular security mode being a first security mode, and

the state of the security indicator of the first access request is a second state in response to the particular security mode being a second security mode, wherein the first security mode is a more trusted security mode than the second security mode;

providing a second access request targeting the slave device from a first device operating as a master, wherein a channel of the DMA controller masquerades as the first data processor operating in a specified security mode based on a value of a user programmable first storage location, wherein

in response to the user programmable first storage location storing a first indicator, a second security indicator of the second access request has the first state; and

in response to the user programmable first storage location storing a second indicator, the second security indicator of the second access request has the second state.

15. The method of claim 14 , wherein the first access request and the second access request are transmitted to the slave device over a common interconnect.

16. The method of claim 14 further comprising:

prior to providing the second access request, receiving a third access request, targeting the first device operating as a slave, to store one of a plurality of indicators at the first storage location, wherein the plurality of indicators correspond to the plurality of security modes of the data processor and include the first and second indicators.

17. The method of claim 14 , further comprising:

determining whether each of the provided first and second access requests are to be allowed to access the slave device based upon a state of their respective security indicators.

18. The method of claim 14 further comprising:

prior to providing the second access request, providing a third access request from first data processor to store the first indicator at the first storage location.

19. The method of claim 18 further comprising:

determining by an access protection unit of the first device, whether the third access request is to be allowed to store the first indicator based upon a third security indicator of the third access request.

20. The method of claim 18 further comprising:

preventing the third access request from storing the first indicator in response to a third security indicator of the third access request corresponding to a lesser security mode that is less than a greater security mode that corresponds to the first indicator being stored by the third access request.

Assignments (21)