Resource protection
A System on Chip (SoC), including a plurality of processor cores including a secure master, which is configured to run security software, and a non-secure master, which is configured to run non-security software; a resource configured to be shared by the secure master and the non-secure master; and a state machine configured to protect the resource by allowing only the secure master to transition the resource to a particular state of the state machine, and allowing only the non-secure master to transition the resource to another particular state of the state machine.
1. A System on Chip (SoC), comprising:
a plurality of processor cores including a secure master, which is configured to run security software, and a non-secure master, which is configured to run non-security software;
a resource configured to be shared by the secure master and the non-secure master; and
a state machine configured to protect the resource by allowing only the secure master to transition the resource to a particular state of the state machine, and allowing only the non-secure master to transition the resource to another particular state of the state machine.
2. The SoC of claim 1 , wherein the non-secure master is a safe master configured to execute safety software.
3. The SoC of claim 1 , wherein the secure master is configured to identify itself as the secure master to the resource as a part of a bus transaction.
4. The SoC of claim 1 , wherein the secure master or the non-secure master is identifiable by a master identification, which is part of transaction and comparable to a configurable or hard-coded reference master identification stored at the resource.
5. The SoC of claim 4 , wherein the configurable reference master identification is write protected.
6. The SoC of claim 5 , wherein only the secure master or the non-secure master identifiable by the master identification matching the reference master identification is permitted to change the reference master identification to identify another one of the plurality of processor cores as the secure master or the non-secure master, respectively.
7. The SoC of claim 3 , wherein the secure master is configured to transmit its identification as the secure master to a resource protection register via a sideband signal as part of the bus transaction.
8. The SoC of claim 1 , wherein the resource is a register.
9. The SoC of claim 1 , further comprising:
a plurality of resources; and
a plurality of state machines, each of which corresponds with a respective one of the plurality of resources.
10. The SoC of claim 1 , wherein the state machine is configured to allow only the non-secure master to transition the resource from a run state to a configuration state, during which only the non-secure master is allowed to reconfigure the resource.
11. The SoC of claim 10 , wherein the reconfiguration comprises writing new configuration data to shadow registers, to prevent an impermissible configuration from becoming active before being checked by the secure master.
12. The SoC of claim 1 , wherein the state machine is configured to allow only the secure master to transition the resource from a configuration state to a check state, during which a configuration of the resource or of shadow registers of the resource cannot be changed and is checked.
13. The SoC of claim 12 , wherein the state machine is configured to allow only the secure master to transition the resource from the check state to a run state, during which the resource operates normally in a secure manner with the checked configuration.
14. The SoC of claim 1 , wherein the resource is a bus Memory Protection Unit (MPU) which is configured to control access to a memory.