Security policy management in a seamlessly integrated microcontroller chip
Techniques in electronic systems, such as in systems comprising a CPU die and one or more external mixed-mode (analog) chips, may provide improvements advantages in one or more of system design, performance, cost, efficiency and programmability. In one embodiment, the CPU die comprises at least one microcontroller CPU and circuitry enabling the at least one CPU to have a full and transparent connectivity to an analog chip as if they are designed as a single chip microcontroller, while the interface design between the two is extremely efficient and with limited in number of wires, yet may provide improved performance without impact to functionality or the software model.
1. A system, comprising:
a first die comprising:
a central processing unit (CPU); and
a first bridge; and
a second die, electrically coupled to the first die by die-to-die interconnects, comprising a second bridge, wherein the first bridge, the second bridge and the die-to-die interconnects are configured to perform security policy management of the first die and the second die as if the security policy management is for a single die,
wherein the security policy management manages resources associated with the CPU and the second die excludes a second CPU;
wherein the security policy management comprises providing automatic arbitration of remote slaves between multiple bus masters, the multiple bus masters comprise the CPU and direct memory access (DMA), and the slaves comprise the second die; and
wherein a security manager on the second die is configured to disallow access to resources having an ambiguous or undefined security policy until a security manager on the first die transfers and establishes a security policy to the second die.
2. The system of claim 1 , wherein a security manager on the second die is configured to act independently of a security manager on the first die.
3. The system of claim 1 , wherein security policies on the second die are derived from security policies on the first die.
4. The system of claim 1 , wherein the second die comprises debug communication ports.
5. The system of claim 1 , wherein a security manager is located on the first die and debug ports are located on the second die.
6. The system of claim 1 , wherein a security manager on the second die is configured to control access to the first die via debug ports on the second die.
7. The system of claim 1 , wherein a security manager on the second die is configured to control access to the second die via debug ports on the second die.
8. The system of claim 1 , wherein a security manager on the second die is configured to control whether power state transitions are initiated by a debugger coupled to the second die via debug ports on the second die.
9. The system of claim 1 , wherein a security manager on the second die is configured to control authorization credentials to authorize a type of access.
10. The system of claim 9 , wherein the authorization credentials comprise a challenge/response sequence.
11. The system of claim 1 , wherein, during an initial power up sequence, the system is configured to transfer a security policy from a security manager on the first die to a security manager on the second die using transactions between the first die and the second die initiated by the security manager on the first die.
12. The system of claim 1 , wherein the second die comprises debug ports and the second die is configured to block the debug ports until a security policy is provided.
13. The system of claim 1 , wherein a security manager on the second die is configured to maintain an active policy through a given sleep cycle of the first die and, during the given sleep cycle, is configured to respond to debugger requests on debug ports on the second die.
14. The system of claim 1 , wherein, within limitations of an active security policy, the second die is configured to initiate state changes on the first die via corresponding event messages from the second die to the first die; and
wherein the state changes comprise: forcing power states, halting CPU operation, or unhalting CPU operation.
15. The system of claim 1 , wherein, during a manufacturing process, a product development process, or both, debug ports on the second die are configured to allow a debugger to access the second die without limitation, and without a presence of the first die, without a presence of a security manager on the first die, or without the security policy.
16. The system of claim 1 , wherein, when a security policy fails due to misbehavior of the first die, a security manager on the second die is configured to implement a default security policy.
17. The system of claim 1 , wherein, when the second die initiates an event requesting a lifestyle change, the first die is configured to verify credentials of a requester, to authorize a different lifecycle stage, and to deploy a security policy associated with the different lifestyle stage.
18. A method for performing security policy management, comprising:
selectively communicating die-to-die interconnect signals from a second bridge in a second die to a first bridge in a first die via die-to-die interconnect signals in a die-to-die interconnect between the first die and the second die, wherein the first die comprises: a central processing unit (CPU), and the first bridge; and wherein the second die comprises the second bridge;
performing the security policy management of the first die and the second die as if the security policy management is for a single die, wherein the security policy management manages resources associated with the CPU and the second die excludes a second CPU, wherein the security policy management comprises providing automatic arbitration of remote slaves between multiple bus masters, the multiple bus masters comprise the CPU and direct memory access (DMA), and the slaves comprise the second die; and
disallowing accessing, using a security manager on the second die, to resources having an ambiguous or undefined security policy until a security manager on the first die transfers and establishes a security policy to the second die.
19. An electronic device, comprising:
a first die comprising:
a central processing unit (CPU);
a first bridge; and
a second die, electrically coupled to the first die by die-to-die interconnects, comprising a second bridge, wherein the first bridge, the second bridge and the die-to-die interconnects are configured to perform security policy management of the first die and the second die as if the security policy management is for a single die,
wherein the security policy management manages resources associated with the CPU and the second die excludes a second CPU, wherein the security policy management comprises providing automatic arbitration of remote slaves between multiple bus masters, the multiple bus masters comprise the CPU and direct memory access (DMA), and the slaves comprise the second die; and
wherein a security manager on the second die is configured to disallow access to resources having an ambiguous or undefined security policy until a security manager on the first die transfers and establishes a security policy to the second die.
20. The electronic device of claim 19 , wherein a security manager on the second die is configured to act independently of a security manager on the first die.