Boot RAM for safety critical domain
A processing system stores a boot image for a critical domain of a system-on-a-chip (SOC) at a bank of a static random-access memory (SRAM) that is shared by the critical domain and a non-critical domain and that is powered independently from the non-critical domain. The SOC includes a secure processor that loads the boot image to the bank of the SRAM and then blocks subsequent write access to the bank. Because the critical domain is powered independently from the non-critical domain, the bank of the SRAM retains the boot image without regard to the power state of the non-critical domain. In addition, the critical domain implements a boot process that is decoupled from a CPU at the non-critical domain, ensuring that the critical domain can initiate a re-boot sequence even if the non-critical domain is not powered.
1 . A method comprising:
storing a boot image for a critical domain of a system on a chip (SOC) comprising the critical domain and a non-critical domain at a bank of a static random access memory (SRAM), wherein the SRAM is shared by the critical domain and the non-critical domain; and
blocking write access to the bank subsequent to the storing.
2 . The method of claim 1 , wherein blocking write access comprises setting a read-only or a write-once bit for the bank.
3 . The method of claim 1 , further comprising:
scrubbing the bank to detect and correct errors in the boot image.
4 . The method of claim 1 , further comprising:
retaining the boot image at the bank of the SRAM when the non-critical domain is powered off.
5 . The method of claim 1 , further comprising:
periodically performing a cold reboot of the critical domain.
6 . The method of claim 5 , wherein periodically performing comprises performing the cold reboot when a predetermined amount of time has elapsed since a previous cold reboot and when the SOC is idle.
7 . The method of claim 1 , further comprising:
validating the boot image prior to storing the boot image at the bank.
8 . A device comprising:
a system on a chip (SOC) comprising a critical domain and a non-critical domain, comprising:
a static random access memory (SRAM) comprising a plurality of banks; and
a secure processor configured to:
store a boot image for the critical domain at a bank of the plurality of banks; and
block write access to the bank subsequent to the storing.
9 . The device of claim 8 , wherein the secure processor is configured to block write access by setting a read-only or a write-once bit for the bank.
10 . The device of claim 8 , further comprising:
a microcontroller configured to scrub the bank to detect and correct errors in the boot image.
11 . The device of claim 10 , wherein the microcontroller is further configured to:
scrub the bank by performing error correction code checking of the bank.
12 . The device of claim 10 , wherein the microcontroller is further configured to:
periodically perform a cold reboot of the critical domain.
13 . The device of claim 12 , wherein the microcontroller is further configured to:
perform the cold reboot when a predetermined amount of time has elapsed since a previous cold reboot and when the SOC is idle.
14 . The device of claim 8 , wherein the secure processor is further configured to: validate the boot image prior to storing the boot image at the bank.
15 . A system comprising:
a static random access memory (SRAM);
a non-critical domain comprising a central processing unit;
a critical domain powered independently from the non-critical domain; and
a secure processor configured to:
store a boot image for the critical domain at a bank of the SRAM; and
block write access to the bank subsequent to the storing.
16 . The system of claim 15 , wherein the secure processor is further configured to validate the boot image prior to storing the boot image at the bank.
17 . The system of claim 15 , wherein the secure processor is further configured to block write access by setting a read-only or a write-once bit for the bank.
18 . The system of claim 15 , further comprising:
hardware circuitry configured to scrub the bank to detect and correct errors in the boot image.
19 . The system of claim 18 , wherein the hardware circuitry is further configured to: periodically perform a cold reboot of the critical domain.
20 . The system of claim 19 , wherein the hardware circuitry is further configured to: perform the cold reboot when a predetermined amount of time has elapsed since a previous cold reboot and when the system is idle.