DVFS power management method and corresponding system

Abstract

Embodiments of the present disclosure relate to a method for DVFS power management and a corresponding system. In one embodiment, a system on chip includes a dynamic voltage and frequency scaling (DVFS) power supply, a secure environment, a non-secure environment, and a power management control module. The secure environment is configured to generate a security instruction that defines an allowed operating point for a voltage and a frequency of the DVFS power supply. The non-secure environment is configured to generate a request to modify the DVFS power supply, wherein the modification request includes a voltage-frequency operating point. The power management control module is configured to: in response to the request to modify the DVFS power supply, scale the DVFS power supply to an allowed operating point.

Description

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] This application claims the benefit of priority from French patent application No. 1859052, filed on October 1, 2018, which is incorporated herein by reference. Technical Field

[0003] Embodiments and examples relate to managing a "DVFS" (Dynamic Voltage and Frequency Scaling) type of power supply for a system-on-chip. Background Art

[0004] System-on-Chip (SOC) requires security devices to protect confidential data and sensitive information from copying proprietary content. Connected objects are particularly sensitive, especially in the automotive field.

[0005] The publication “CLKscrew: Exposing the perils of security-oblivious energy management” (ISBN: 978-1-931971-40-9) by Tang et al., published at the 26th USENIX Security Symposium (August 2017), describes the security vulnerabilities of current on-chip systems.

[0006] The security vulnerability mentioned above involves systems powered by dynamic voltage and frequency scaling (DVFS) technology.

[0007] The system on chip may include a computing unit in which a secure environment is designed to be inaccessible without authentication, and a non-secure environment is accessible from the outside, for example, for running software applications or establishing communications with third-party devices. For example, the secure environment includes hardware protection mechanisms at the input-output interface, such as registers for filtering authenticated or unauthenticated data. In addition, the security of communicating with the secure environment is essentially based on an encryption algorithm (such as Advanced Encryption Standard AES or Encryption Standard RSA).

[0008] The secure environment is often referred to by the term “trusted execution environment,” and the non-secure environment is often referred to by the term “rich execution environment.” The two environments may belong to the same computing unit, such as a microprocessor.

[0009] Figure 1 An example of a system is illustrated, which includes a secure environment TEE and a non-secure environment REE, the secure environment TEE and the non-secure environment REE belong to the same computing unit CPU and share a power domain DAP of a DVFS dynamic voltage and frequency scaling type.

[0010] In a shared power domain DAP, voltage and frequency variation VFS can be controlled by a non-secure environment REE. For example, the non-secure environment is managed by an operating system such as Linux, which provides this type of DVFS power control.

[0011] DVFS power control by the non-secure environment REE is useful for optimizing energy consumption because the performance of the system can be dynamically adapted for each use.

[0012] However, the publication by Tang et al. mentioned above reveals the existence of an attack that consists in modifying the voltage and frequency VFS of the DVFS power supply through non-secure code instructions CNS from the non-secure environment REE. Such sequenced changes VFS make it possible to introduce targeted errors during processing in the secure environment TEE, making it possible to undermine the cryptography on which the security of the secure environment TEE is based by performing precise synchronization on a given operation.

[0013] In other words, the DVFS power is used to push the secure environment TEE to the limit of its operating power through the non-secure environment REE, thereby creating a timing coordination error in the secure environment's logic.

[0014] "Breaking encryption" is understood to mean, for example, the reconstruction of a secret encryption key. Using the encryption key, a "non-secure" third-party software can then access the secure environment TEE and enjoy its privileges.

[0015] It should be noted that this attack is entirely software-based and can be performed remotely via network access, which makes it even more dangerous.

[0016] Moreover, it should be noted that the critical parameters of the attack are firstly the DVFS power control by the non-secure environment REE and secondly the accurate timing used to introduce errors in synchronization with a given operation of the secure environment TEE.

[0017] A solution to prevent such attacks is proposed in the above-mentioned publication by Tang et al.

[0018] It is proposed to introduce operational constraints on the possible variations of the DVFS power supply at the hardware level, so as to make it impossible to generate any voltage-frequency pair that introduces faults.

[0019] However, on the one hand, operating limits may vary within the same production (especially due to variations in the manufacturing process) and are therefore difficult to determine a priori.

[0020] On the other hand, DVFS power supplies are often used by multiple systems with different constraints and requirements, which are not compatible with physically fixed values.

[0021] It is also proposed to use different power domains for secure environment TEE and non-secure environment TEE. When the secure environment TEE is active, a physically separated power supply is used.

[0022] This solution is complex to operate because the secure environment TEE and the non-secure environment REE usually run on the same processor CPU. In addition, the surface area used to produce power dedicated to the secure environment TEE is large, which is problematic.

[0023] It is also proposed to introduce randomized programs into the secure environment TEE, which adds a random number of non-operational instructions to the algorithm. The execution time changes and complicates the synchronization of the attack.

[0024] This solution cannot protect the secure environment TEE from attacks using forms of execution profiling. In addition, this solution introduces latency and performance loss in the secure environment TEE.

[0025] Finally, it is proposed to introduce some redundancies in the execution and monitor these redundancies. If one of the results is different due to an error introduced via the DVFS power supply, the error can be detected.

[0026] This solution introduces latency and performance loss. Executing the algorithm multiple times necessarily increases the execution time and, in addition to this latency, increases the energy allocated to it. Summary of the invention

[0027] Embodiments and examples are intended to address the security issues of the system-on-chip described in the above-mentioned publication by Tang et al. without suffering from the disadvantages of the solutions proposed therein.

[0028] According to one aspect, in this regard, a method for managing a "DVFS" dynamic voltage and frequency scaling type of power supply is provided, the method including generating, by a non-secure environment, a request to modify a DVFS power supply, and the DVFS power supply management control includes: generating, by a secure environment, a secure instruction that defines at least one allowed voltage-frequency operating point for the DVFS power supply; and in response to the request to modify the DVFS power supply, scaling the DVFS power supply to an allowed operating point.

[0029] In other words, regardless of the request generated by the non-secure environment to modify the DVFS power, the DVFS power is always scaled to the "allowed" operating point defined by the secure environment. Therefore, the secure environment is able to define the allowed operating point per hardware implementation so that the DVFS power cannot be configured under conditions that introduce system failures.

[0030] Therefore, the solution provided according to this aspect makes it possible to optimize the DVFS power supply for each system on chip according to its hardware constraints without modifying the DVFS power level. Therefore, the DVFS power level technology can be used with different systems on chip that implement power management according to this aspect and still benefit from its power versatility for different systems.

[0031] In addition, since other algorithms of the security environment are not modified, the solution provided according to this aspect has no impact on system performance.

[0032] According to one embodiment, the allowed operating points of the DVFS power supply are assigned corresponding labels by the security environment, and if a request to modify the DVFS power supply includes the label of the allowed operating point, the DVFS power supply is scaled to the allowed operating point.

[0033] If a request to modify a DVFS power supply does not include a tag of an allowed operating point, the DVFS power supply may not be scaled.

[0034] This implementation is advantageous in terms of compatibility with existing systems because requests from a non-secure environment to modify the DVFS power supply are simply adapted through the use of the tag.

[0035] According to one embodiment, if the request to modify the DVFS power is different from the allowed operating point, the DVFS power is scaled to the closest allowed operating point. For example, the secure environment receives the request, defines the closest allowed operating point, and controls the DVFS power to the closest operating point.

[0036] This embodiment is advantageous in terms of the selection of the operating point.

[0037] According to one embodiment, the secure instruction is generated by the secure environment before the non-secure environment is started.

[0038] In practice, the secure environment is typically started before the non-secure environment, and this implementation ensures the integrity of the security instructions that define the allowed operating points.

[0039] According to one embodiment, the security instruction defines an allowed voltage-frequency operating point dedicated to the security environment, and, if the security processing is performed by the security environment, the scaling of the DVFS power supply includes: scaling the DVFS power supply to the allowed operating point dedicated to the security environment; and in response to the request to modify the DVFS power supply, not modifying the DVFS power supply from the allowed operating point dedicated to the security environment.

[0040] In other words, this implementation allows requests to modify the DVFS power completely free, but does not take it into account if security processing is performed by the secure environment.

[0041] Advantageously, when scaling the DVFS power supply to an allowed operating point dedicated to the security environment, the previous configuration of the DVFS power supply is recorded, and when the security process ends, the last recorded configuration is restored.

[0042] Advantageously, the recording of the previous configuration and the restoration of the last recorded configuration are performed by the secure environment.

[0043] According to another aspect, a system on chip is provided, comprising: a "DVFS" dynamic voltage and frequency scaling type power supply; a secure environment; a non-secure environment capable of generating a request to modify the DVFS power supply; and a DVFS power management control module, wherein: the secure environment is configured to generate a security instruction that defines at least one allowed voltage-frequency operating point for the DVFS power supply; and the power management control module is configured to scale the DVFS power supply to an allowed operating point in response to the non-secure environment's request to modify the DVFS power supply.

[0044] According to one embodiment, the secure environment is configured to generate the secure instruction to assign a corresponding tag to an allowed operating point of the DVFS power supply, and wherein the power management control module is configured to: if a request to modify the DVFS power supply includes the tag of the allowed operating point, scale the DVFS power supply to the allowed operating point.

[0045] Advantageously, the power management control module is configured to not scale the DVFS power if the request to modify the DVFS power does not include a tag of an allowed operating point.

[0046] According to one embodiment, the power management control module is configured to, in response to the request to modify the DVFS power, scale the DVFS power to an allowed operating point that is closest to the operating point of the request to modify the DVFS power.

[0047] According to one embodiment, the secure environment is configured to generate the secure instructions before the non-secure environment is started.

[0048] According to one embodiment, the non-secure environment is configured to send a request to modify the DVFS power to a power management control module, the power management control module being configurable only by said secure instructions from the secure environment.

[0049] According to one embodiment, the power management control module is incorporated in the secure environment, and the non-secure environment is configured to send a request to the secure environment to modify the DVFS power.

[0050] According to one embodiment, the secure environment is configured to generate a security instruction that defines an allowed voltage-frequency operating point for a DVFS power supply that is specific to the secure environment, and, if security processing is performed by the secure environment, the power management control module is configured to: scale the DVFS power supply to the allowed operating point that is specific to the secure environment; and in response to a request to modify the DVFS power supply, not modify the DVFS power supply at the allowed operating point that is specific to the secure environment.

[0051] Advantageously, the secure environment is configured to record a previous configuration of the DVFS power supply when the DVFS power supply is scaled to the dedicated allowed operating point, and to restore the last recorded configuration at the end of the secure processing.

[0052] There is also provided an electronic device, such as a mobile phone or a vehicle onboard computer, comprising a system on chip as defined above and a voltage supply device configured to provide a supply voltage controlled by a power management control module.

[0053] Advantageously, the electronic device further comprises a wireless communication module, which enables a third party device to have access to the non-secure environment of the system-on-chip. BRIEF DESCRIPTION OF THE DRAWINGS

[0054] Other advantages and features of the invention will emerge on reviewing the detailed description of examples and embodiments, which are by no means limiting, and the accompanying drawings, in which:

[0055] Previously described Figure 1 The diagram illustrates the security vulnerabilities of conventional system-on-chip.

[0056] Figure 2 , Figure 3 , Figure 4A , Figure 4B , Figure 4C , Figure 5A , Figure 5B and Figure 6 Various embodiments and examples of the present invention are illustrated. DETAILED DESCRIPTION

[0057] Figure 2 represents an embodiment of a system on chip SOC.

[0058] The system on chip SOC includes a power supply of the dynamic voltage and frequency scaling type known as “DVFS”. The system on chip includes a secure environment TEE of the microprocessor type and a non-secure environment REE, which are software code execution environments.

[0059] In this example, the secure environment TEE and the non-secure environment REE belong to the same computing unit CPU of the microprocessor type. The communication between the secure environment TEE and the outside world (especially the non-secure environment REE) is performed via a hardware interface that is configured to prevent unauthorized access. It is also contemplated that the secure environment TEE and the non-secure environment REE are implemented on two physically separated computing units that share the same power supply.

[0060] In this example, the DVFS power supply includes a frequency regulator FRQREG and a voltage regulator VLTREG.

[0061] The frequency regulator FRQREG is configured to generate a clock signal fCPU having a clock frequency for timing the operation of the computing unit CPU. For example, the frequency regulator comprises a phase-locked loop device for generating a periodic clock signal with a frequency modifiable according to a command.

[0062] In this example, the voltage regulator VLTREG is configured to generate a control signal ComAlm for setting the supply voltage, which control signal ComAlm is intended to be controlled by an external circuit "PMIC" or power management integrated circuit for generating the supply voltage. In practice, the supply voltage generating circuit is usually implemented by an integrated circuit separate from the system on chip SOC and can be used to generate different supply voltages and supply them to different elements of the device including the system on chip SOC. In this example, the supply voltage VAlm supplied to the system on chip originates from such a generator "PMIC". Reference may be made to the description of the embodiment of the invention. Figure 6 It is also contemplated that, for example in the case of a system-on-chip SOC intended for autonomous and independent use, the generation of the power supply voltage VAlm is performed by a DVFS power supply incorporated in the system-on-chip SOC.

[0063] Thus, the DVFS power supply is configured to provide the supply voltage VAlm (via the supply voltage generating circuit "PMIC" where appropriate) and the clock signal fCPU. The expression "supply voltage and clock signal pair" will be abbreviated as "voltage-frequency pair" and additionally referred to by the term "operating point" indicated by "OPP" for "operating performance point".

[0064] The system on chip SOC includes a power management control module PMC configured to scale the DVFS power supply, ie, control a given value of a voltage-frequency pair VAlm-fCPU provided to the secure environment TEE and the non-secure environment REE.

[0065] Physically, the system on chip SOC is configured such that the DVFS power supply can only be controlled by the power management control module PMC, at least in terms of generating the operating point provided to the computing unit CPU.

[0066] The power management control module PMC generates a command for setting a given allowed operating point OPPk for the DVFS power supply. The given allowed operating point OPPk is established according to a request Rk for modifying the DVFS power supply generated by the non-secure environment REE and a security instruction IS generated by the secure environment TEE.

[0067] In practice, the secure environment TEE is configured to generate a security instruction IS defining at least one allowed voltage-frequency operating point OPPi for the DVFS power supply.

[0068] Therefore, the power management control module PMC is configured in-situ by the secure environment TEE to generate commands for setting the allowed operating points OPPk from these allowed operating points OPPi only for the DVFS power supply.

[0069] Therefore, in response to the request Rk (from the non-secure environment REE), the power management control module PCM scales the DVFS power supply to the allowed operating point OPPk.

[0070] In other words, the power management control module PCM manages the DVFS power command attempts so that the DVFS power only provides the allowed operating points OPPi defined by the secure environment TEE.

[0071] Therefore, in the system on chip SOC, a method of intruding the secure environment TEE, which method particularly includes generating an error caused by a power supply having an abnormal voltage-frequency pair for the system on chip, is impossible.

[0072] If the request to modify the DVFS power comes from the secure environment TEE, the power management control module PMC may process the request in the same manner.

[0073] Figure 3 Indicates about Figure 2 A variant embodiment of the system on chip SOC is described. Figure 2 and Figure 3 Common elements between the examples have the same reference numerals and will not be described in detail again.

[0074] In this variant, the power management control module PMC is incorporated in the secure environment TEE. Therefore, the non-secure environment REE is configured to send a request Rk to modify the DVFS power to the secure environment TEE.

[0075] Therefore, non-secure environment REE and secure environment TEE communications are implemented for scaling DVFS power. These communications are implemented via a hardware protected interface for the secure environment TEE and are generally slower than non-secure communications. However, this implementation also allows for favorable power management control over the selection of allowed operating points. Figure 5A and Figure 5B This embodiment is described.

[0076] Here, the security instruction IS corresponds to an internal instruction of the secure environment TEE, for example, a calculation result is transmitted to the interface to generate a control signal for controlling the voltage VLTREG and frequency FRQREG regulators of the DVFS power supply.

[0077] On the other hand, the secure environment TEE and the non-secure environment REE have been represented as two separate computing units of the microprocessor type, for example. Of course, this variation can be expected for the secure environment TEE and the non-secure environment REE implemented in the same computing unit of the microprocessor type.

[0078] Figure 4A , Figure 4B and Figure 4C Implementations and examples of power management control with dynamic voltage frequency scaling are illustrated.

[0079] Figure 4A The diagram illustrates that a secure environment TEE generates a security instruction IS, which defines at least one allowed voltage-frequency operating point OPPi for a DVFS power supply. For example, n operating points are defined, and 1≤i≤n.

[0080] Typically, the secure environment TEE controls the boot routine of the system on chip SOC, and therefore the secure environment TEE is active before the non-secure environment REE. Therefore, the secure instruction IS can be generated by the secure environment TEE before the non-secure environment REE is started. This ensures additional protection against any potential intrusion before the secure instruction IS is generated.

[0081] In this embodiment, the safety instruction IS defines allowed operating points OPPi (1≤i≤n) for the DVFS power supplies and assigns corresponding labels Li (1≤i≤n) to them.

[0082] Figure 4B A diagram GfV representing a voltage V and frequency f pair, on which a curve Lim is plotted showing an upper limit of the possible frequency f depending on the voltage V, above which the logic of the secure environment TEE cannot function properly.

[0083] Therefore, all voltage-frequency pairs above the curve Lim are not operating conditions of the safe environment TEE.

[0084] According to this embodiment and example, the diagram GfV is used to illustrate examples of allowed operating points defined by the secure environment TEE and assigned corresponding labels {OPPi; Li} (1≤i≤n).

[0085] Each allowed operating point OPPi (1≤i≤n) includes voltage Vi (1≤i≤n) and frequency f (1≤i≤n) coordinates, which are defined to be below the curve Lim so as to always provide operating power to the secure environment TEE.

[0086] The label Li (1≤i≤n) respectively assigned to each allowed operating point OPPi (1≤i≤n) is any type of digital word, for example, an arbitrary binary number or a coded digital word.

[0087] Figure 4C It indicates that a request Rk for modifying the DVFS power is generated by the non-secure environment REE, and the request Rk is transmitted to the power management control module PMC.

[0088] Therefore, if the request Rk to modify the DVFS power includes the label Lk (1≤k≤n) of the allowed operating point OPPk, the DVFS power management control includes a command OPPk for scaling the DVFS power to the allowed operating point OPPk (1≤k≤n).

[0089] For example, if the request Rk to modify the DVFS power supply does not include the labels Li (1≤i≤n) of the allowed operating points OPPi, the DVFS power supply is not scaled.

[0090] Therefore, the secure environment TEE must be powered by the operating voltage-frequency pair {Vk; fk}.

[0091] Therefore, the non-secure environment REE is configured to send a request Rk to the power management control module PMC to modify the DVFS power supply. Of course, the non-secure environment REE generating the request Rk must be able to transmit the tag that has been defined by the secure environment TEE.

[0092] Since the power management control module PMC can only be configured by the secure instructions IS from the secure environment TEE, fraudulent requests Rk intended to introduce errors in the secure environment cannot be executed.

[0093] about Figure 4A , Figure 4B and Figure 4C The described embodiments and examples contribute to a method of defending against intrusion into a secure environment TEE, the method comprising, inter alia, generating an error caused by modification of a DVFS power supply from a non-secure environment REE.

[0094] In addition, compared to the existing system, the implementation and example have no impact on performance and only require slight modifications to the non-secure environment REE to generate the request Ri to modify the DVFS power supply.

[0095] Figure 5A and Figure 5B Another implementation and example of power management control with dynamic voltage-frequency scaling is illustrated.

[0096] Figure 5A As mentioned above Figure 4B A diagram GfV of the voltage V and frequency f pairs is depicted, as well as a curve Lim which shows the limits of the possible frequency f depending on the voltage V, beyond which the logic of the secure environment TEE cannot function properly.

[0097] In this embodiment and example, if the request Rk (1≤k≤4) to modify the DVFS power is different from the allowed operating point OPPi, the DVFS power is scaled to the closest allowed operating point OPPk (1≤k≤4). If the request R4 is included in the definition of the allowed operating point OPPi, scaling the DVFS power may correspond to the immediate application of the request.

[0098] like Figure 5B As indicated in , this embodiment and example are well suited for incorporating the power management control module PMC into a configuration in a secure environment TEE. Therefore, the non-secure environment REE is configured to send a request Rk to the secure environment TEE to modify the DVFS power.

[0099] In practice, the computational power of the secure environment TEE can be useful in evaluating the allowed operation point OPPi closest to the request Rk.

[0100] For example, the safety instruction IS may define the allowed voltage-frequency operating points OPPi for the DVFS power supply as any voltage-frequency pair lying below the curve Lim.

[0101] Therefore, the secure environment TEE must be powered by the operating voltage-frequency pair {Vk; fk}.

[0102] The curve Lim may need to be modeled and the shortest distance in the space of the voltage-frequency graph GfV must be calculated. Figure 5A The diagram shows three ways to calculate the shortest distance:

[0103] 1) The shortest distance between the allowed operating point OPP1 and the request R1 is calculated only on the voltage V coordinate. This is applicable to low frequency and voltage operating points.

[0104] 2) Calculate the shortest distance between the allowed operating point OPP2 and the requested R2 using the Euclidean norm or equivalent formula on the voltage V and frequency f coordinates. This is applicable to any non-extreme frequency and voltage operating point.

[0105] 3) The shortest distance between the allowed operating point OPP3 and the request R3 is calculated only on the frequency f coordinate. This applies to high frequency and voltage operating points.

[0106] Of course, any calculation method is contemplated.

[0107] In addition, two points OPPk and OPPi equidistant from Rk may be determined between them, depending on whether it is preferred to ensure performance in terms of speed or to ensure performance in terms of reduced consumption.

[0108] Therefore, here, the security instruction IS defining the allowed voltage-frequency operating point OPPi may correspond to an internal instruction (such as a calculation result) of the secure environment TEE to generate a command OPPk for the DVFS power supply, as described above with respect to Figure 3 as described.

[0109] Of course, it is contemplated that the configuration of the power management control module PMC is not incorporated in the secure environment TEE. The power management control module PMC must then be able to evaluate the allowed operating point closest to the request. However, if necessary, this evaluation may be very simple in terms of the amount of computation required.

[0110] In other words, according to one implementation and example, the non-secure environment REE calls the secure environment TEE service to change the operation point, and the secure environment TEE decides which operation point to control to ensure that the system on chip SOC will be operational.

[0111] The generation and communication methods of the requests Ri by the non-secure environment REE will have to be appropriate.

[0112] The embodiments and examples facilitate a method of defending against intrusion into a secure environment TEE, the method particularly comprising generating an error caused by modification of a DVFS power supply from a non-secure environment REE.

[0113] Now refer to it again Figure 2 .

[0114] As mentioned above about Figure 4A , Figure 4B , Figure 4C as well as Figure 5A , Figure 5BIn an alternative to the described implementations and embodiments, it is contemplated that the secure environment TEE requires an allowed operation point OPPi that is specific to the secure environment TEE and remains constant at all times the secure environment TEE performs processing. The allowed operation point specific to the secure environment TEE may be, for example, Figure 4B One of the permissible operating points {OPPi} (1≤i≤n) represented in , and is selected, for example, based on the performance required to execute the processing.

[0115] In this regard, the power management control module PMC is configured to: scale the DVFS power to the allowed operating point OPPi dedicated to the secure environment TEE; and in response to a request Rk generated by the non-secure environment to modify the DVFS power, not modify the DVFS power of the allowed operating point OPPi dedicated to the secure environment TEE.

[0116] The secure environment TEE is advantageously configured to: record the previous configuration of the DVFS power supply when the DVFS power supply is scaled to the dedicated allowed operating point OPPi; and restore the last recorded configuration when the secure processing ends.

[0117] Therefore, no changes need to be made in the generation of requests made by the non-secure environment REE and no impact will be felt in performance.

[0118] Therefore, the power management module control PMC is configured as a hardware mechanism for dynamically locking and unlocking the access of the non-secure environment REE to the DVFS power according to the security instruction IS.

[0119] Figure 6 represents an example of an electronic device APP, which includes an embodiment of a system on a chip SOC.

[0120] The electronic device APP is, for example, a mobile phone or a vehicle onboard computer and comprises a system on chip SOC according to one of the above embodiments and a voltage supply device PMIC configured to provide a power supply voltage VAlm controlled (ComAlm) by a power management control module PMC.

[0121] Furthermore, the device APP typically comprises in particular a random access memory RAM, a non-volatile memory ROM and modules BL1, BL2 for various functions. The voltage supply device PMIC is also in particular configured to provide supply voltages VRAM, VROM to the RAM and ROM memories.

[0122] The electronic device APP may include a wireless communication module BL1 , which enables a third-party device to have access to a non-secure environment REE of the system-on-chip SOC.

Claims

1. A method for managing a dynamic voltage and frequency scaling power supply, the method comprising: generating, by a security environment, security instructions defining allowable operating points for voltage and frequency of the dynamic voltage and frequency scaling power supply; assigning, by the security environment, a label to the allowed operation point; generating, by a non-secure environment, a request to modify the dynamic voltage and frequency scaling power supply, the request to modify including a voltage-frequency operating point; as well as In response to the request to modify the dynamic voltage and frequency scaling power supply and in response to determining that the request to modify includes the tag of the allowed operating point, the dynamic voltage and frequency scaling power supply is scaled to the allowed operating point.

2. The method according to claim 1, further comprising determining whether the request to modify includes the label of the permitted operating point; and The secure environment is operated at the permitted operating point.

3. The method according to claim 2, further comprising: In response to determining that the request to modify does not include the label of the permitted operating point, the secure environment is operated without scaling to the permitted operating point.

4. The method of claim 1 , wherein the safety instruction further defines additional voltage-frequency allowed operating points for the dynamic voltage and frequency scaling power supply, and wherein the method further comprises: In response to determining that the voltage-frequency operating point in the request to modify is different from the allowed operating points, scaling to a closest one of the allowed operating points. The method of claim 1 , wherein the secure instruction is generated by the secure environment prior to launching of the non-secure environment.

6. The method of claim 1 , wherein the security instruction defines allowed voltage-frequency operating points specific to the security environment, and when security processing is performed by the security environment, scaling of the dynamic voltage and frequency scaling power supply comprises: scaling the dynamic voltage and frequency scaling power supply to the allowed operating point specific to the safety environment; as well as In response to the request to modify the dynamic voltage and frequency scaling power supply, the dynamic voltage and frequency scaling power supply is not modified from the allowed operating points dedicated to the secure environment.

7. The method according to claim 6, further comprising: recording a previous configuration of the dynamic voltage and frequency scaling power supply when the dynamic voltage and frequency scaling power supply is scaled to the allowed operating point dedicated to the secure environment; as well as When the security process is complete, the last recorded configuration is restored.

8. The method of claim 7, wherein the recording of the previous configuration and the restoring of the last recorded configuration are performed by the secure environment.

9. A system on chip, comprising: Dynamic voltage and frequency scaling power supplies; a security environment configured to generate security instructions defining allowed operating points for voltage and frequency of the dynamic voltage and frequency scaling power supply and assigning labels to the allowed operating points; a non-secure environment configured to generate a request to modify the dynamic voltage and frequency scaling power supply, the request to modify including a voltage-frequency operating point; as well as A power management control module is configured to, in response to the request to modify the dynamic voltage and frequency scaling power supply and in response to determining that the request to modify includes the tag of the allowed operating point, scale the dynamic voltage and frequency scaling power supply to the allowed operating point.

10. The system on chip according to claim 9, wherein the power management control module is configured to: A determination is made as to whether the request to modify includes the label of the permitted operating point.

11. The system on chip of claim 10, wherein the power management control module is configured to: in response to determining that the request to modify does not include the tag of the allowed operating point, not scale to the allowed operating point.

12. The system on chip of claim 9, wherein the security instruction further defines additional voltage-frequency allowed operating points for the dynamic voltage and frequency scaling power supply, and wherein the power management control module is configured to: in response to determining that the voltage-frequency operating point in the request for modification is different from the allowed operating point, scale to the closest one of the allowed operating points.

13. The system on chip according to claim 9, wherein the secure environment is configured to generate the secure instruction before the inactive environment is started.

14. The system on chip of claim 9, wherein the non-secure environment is configured to send the request to the power management control module to modify the dynamic voltage and frequency scaling power supply, and the power management control module can only be configured by the secure instructions from the secure environment.

15. The system on chip of claim 9, wherein the power management control module is incorporated in the secure environment, and the non-secure environment is configured to send the request to modify the dynamic voltage and frequency scaling power supply to the secure environment.

16. The system on chip of claim 9, wherein the secure environment is configured to generate the security instructions, the security instructions defining allowed voltage-frequency operating points for the dynamic voltage and frequency scaling power supply that are specific to the secure environment, and when security processing is performed by the secure environment, the power management control module is configured to: scaling the dynamic voltage and frequency scaling power supply to the allowed operating point specific to the safety environment; and In response to the request to modify the dynamic voltage and frequency scaling power supply, the dynamic voltage and frequency scaling power supply is not modified from the allowed operating points dedicated to the secure environment.

17. The system on chip according to claim 16, wherein the secure environment is configured to: recording a previous configuration of the dynamic voltage and frequency scaling power supply when the dynamic voltage and frequency scaling power supply is scaled to a dedicated allowed operating point; and At the end of the security process, the last recorded configuration is restored.

18. An electronic device comprising: System on chip, including: Dynamic voltage and frequency scaling power supplies, a security environment configured to generate security instructions defining allowed operating points for voltage and frequency of the dynamic voltage and frequency scaling power supply and assigning labels to the allowed operating points; a non-secure environment configured to generate a request to modify the dynamic voltage and frequency scaling power supply, the request to modify comprising a voltage-frequency operating point; and a power management control module configured to: in response to the request to modify the dynamic voltage and frequency scaling power supply and in response to determining that the request to modify includes the tag of the allowed operating point, scale the dynamic voltage and frequency scaling power supply to the allowed operating point; and A voltage supply device is configured to provide a power supply voltage controlled by the power management control module.

19. The electronic device of claim 18, further comprising a wireless communication module, the wireless communication module enabling a third party device to have access to the non-secure environment of the system-on-chip.

20. The electronic device of claim 18, wherein the electronic device comprises a mobile phone or a vehicle onboard computer.

Images