Secure access in a microcontroller system
Systems, methods and computer-readable mediums are disclosed for providing secure access in a microcontroller system. In some implementations, a microcontroller system comprises a system bus and a secure central processing unit (CPU) coupled to the system bus. The secure CPU is configured to provide secure access to the system bus. A non-secure CPU is also coupled to the system bus and is configured to provide non-secure access to the system bus. A non-secure memory is coupled to the system bus and is configured to allow the secure CPU and the non-secure CPU to exchange data and communicate with each other. A peripheral access controller (PAC) is coupled to the system bus and configured to enable secure access to a peripheral by the secure CPU while disabling non-secure access to the peripheral based upon a non-secure state of the non-secure CPU.
1. A microcontroller system comprising:
a system bus;
a secure central processing unit (CPU) coupled to the system bus, the secure CPU configured to provide secure access to the system bus;
a non-secure CPU coupled to the system bus, the non-secure CPU configured to provide non-secure access to the system bus;
non-secure memory coupled to the system bus, the non-secure memory configured to allow the secure CPU and the non-secure CPU to exchange data and communicate with each other; and
a peripheral access controller (PAC) coupled to the system bus, the PAC configured to enable secure access to a peripheral by the secure CPU while disabling non-secure access to the peripheral based upon a non-secure state of the non-secure CPU.
2. The microcontroller system of claim 1 , further comprising:
a secure control register included in the PAC, the secure control register programmable by the secure CPU to enable secure access for a secure operation and to disable secure access when the secure operation is complete.
3. The microcontroller system of claim 2 , where the secure control register is configured during a secure write operation by the secure CPU to receive a peripheral identifier for targeting the peripheral for access and a key value, the key value enabling secure access to the peripheral by the secure CPU.
4. The microcontroller system of claim 1 , where the secure CPU is configured to be secure and the non-secure CPU is configured to be non-secure at system reset.
5. The microcontroller system of claim 4 , where configuration of the secure CPU and the non-secure CPU is programmable by pseudo fuses.
6. The microcontroller system of claim 5 , where the pseudo fuses are loaded in non-volatile memory at system reset.
7. The microcontroller system of claim 1 , further comprising a configuration register included in the secure CPU, the configuration register programmable to temporarily provide non-secure bus access to the secure CPU.
8. The microcontroller system of claim 1 , further comprising:
a debug master module coupled to the system bus, the debug master module programmable to be temporarily secure to allow access by the debug master module to secure and non-secure memory, registers or peripherals of the microcontroller system.
9. The microcontroller system of claim 1 , where a portion of memory of the microcontroller system is configured to be secure at system reset.
10. The microcontroller system of claim 1 , where the system bus is a bus matrix configurable to route secure access requests from the secure CPU using one or more bits of an opcode or memory address.
11. A method comprising:
detecting, by a microcontroller system, a system event; and
responsive to the system event:
configuring a first CPU of the microcontroller system to operate in secure mode, where secure mode allows secure access to a system bus of the microcontroller system and execution of secure code on the first CPU;
configuring a second CPU to operate in non-secure mode, where non-secure mode allows non-secure access to the system bus and to execute non-secure code on the second CPU;
configuring the first CPU and the second CPU to exchange data and communicate with each other using non-secure shared memory; and
configuring a peripheral access controller (PAC) coupled to the system bus to allow secure communication between the PAC and a peripheral coupled to the PAC.
12. The method of claim 11 , further comprising:
configuring a debug master module of the microcontroller system to execute secure code and access secure memory, registers or peripherals of the microcontroller system.
13. The method of claim 11 , where configuring the first CPU to operate in secure mode further comprises setting a pseudo fuse.
14. The method of claim 11 , further comprising:
configuring the first CPU to set one or more control bits in a control register that is internal or external to the first CPU to enable secure access to the system bus by the first CPU.
15. The method of claim 11 , further comprising
booting the first CPU during a reset of the microcontroller system using boot code stored in secure non-volatile memory.
16. A non-transitory, computer-readable storage medium having instructions stored thereon, which, when executed by two or more central processing units of a microcontroller system, causes the two or more central processing units of the microcontroller system to perform operations comprising:
detecting a system event; and
responsive to the system event:
configuring a first CPU to operate in secure mode, where secure mode allows secure access to a system bus of the microcontroller system and to execute secure code on the first CPU;
configuring a second CPU to operate in non-secure mode, where non-secure mode allows non-secure access to the system bus and to execute non-secure code on the second CPU;
configuring the first CPU and the second CPU to exchange data and communicate with each other using non-secure shared memory; and
configuring a peripheral access controller (PAC) coupled to the system bus, the PAC allowing secure communication between the PAC and a peripheral coupled to the PAC.
17. The non-transitory, computer-readable storage medium of claim 16 , where the operations further comprise:
configuring a debug master module in the microcontroller system to execute secure code and access secure memory, registers or peripherals of the microcontroller system.
18. The non-transitory, computer-readable storage medium of claim 16 , where configuring the first CPU to operate in secure mode further comprises setting a pseudo fuse.
19. The non-transitory, computer-readable storage medium of claim 16 , where the operations further comprise:
configuring the first CPU to set one or more control bits in a control register that is internal or external to the first CPU to enable secure access to the system bus by the first CPU.
20. The non-transitory, computer-readable storage medium of claim 16 , where the operations further comprise:
booting the first CPU during a reset of the microcontroller system using boot code stored in secure non-volatile memory.