Processor multi-partition security architecture
View Patent ↗A state machine may be coupled to a memory management unit configuration table (MMUCT) stored in a memory to index an entry from the MMUCT. A parameter associated with the entry may be used to control operations associated with a memory management unit (MMU). The MMU may be used to control access to a set of page tables stored in the memory. Other embodiments may be described and claimed.
1. An apparatus, including:
a state machine within a processor, the state machine coupled to a memory management unit configuration table (MMUCT) stored in a memory, the state machine to index an entry from the MMUCT and to load the entry into at least one memory management unit (MMU) control register; and
an MMU configuration table base pointer register (MCTBR) coupled to the state machine to provide a base address to locate the MMUCT within the memory.
2. The apparatus of claim 1 , further including at least one of:
at least one bit associated with the MCTBR to activate at least one security feature associated with the apparatus, or
at least one bit associated with at least one of the MCTBR or a translation table control register (TTCR) to force all page tables to reside in a secure area within the memory and to generate an error upon an attempt by the MMU to access a non-secure area within the memory.
3. A system, including:
a state machine within a processor, the state machine coupled to a memory management unit configuration table (MMUCT) stored in a memory, the state machine to index an entry from the MMUCT and to load the entry into at least one memory management unit (MMU) control register;
an MMU configuration table base pointer register (MCTBR) coupled to the state machine to provide a base address to locate the MMUCT within the memory;
a process identification register (PID) coupled to the state machine to notify the state machine that the PID has been modified and to supply an index value to be used by the state machine to index the entry from the MMUCT; and
a flash memory coupled to the processor.
4. The system of claim 3 , wherein at least one of the MCTBR or the PID is located within the processor.
5. A method, including:
locating a memory management unit configuration table (MMUCT) stored in a memory using a base address contained in an MMU configuration table base pointer register (MCTBR) coupled to a state machine;
indexing an entry from the MMUCT using the state machine; and
controlling access to a set of page tables stored in the memory using a memory management unit (MMU), wherein the MMU operates according to at least one parameter associated with the entry indexed from the MMUCT.
6. The method of claim 5 , further including performing at least one of the following operations based on a setting of at least one control bit in the MCTBR:
preventing a non-secure code module from disabling the MMU;
preventing a non-secure code module from locking entries in a translation look-aside buffer; or
preventing a non-secure code module from modifying the set of page tables.
7. The method of claim 5 , further including performing at least one of the following operations based upon a setting of at least one control bit in at least one of the MCTBR or a translation table control register coupled to the MMU:
forcing the set of page tables to reside in a secure area of the memory; and
generating a memory translation error upon an attempt by the MMU to access a page table in a non-secure area of the memory.
8. An apparatus, including:
a state machine within a processor, the state machine coupled to a memory management unit configuration table (MMUCT) stored in a memory, the state machine to index an entry from the MMUCT and to load the entry into at least one memory management unit (MMU) control register; and
a process identification register (PID) coupled to the state machine to notify the state machine that the PID has been modified and to supply an index value to be used by the state machine to index the entry from the MMUCT.
9. The apparatus of claim 8 , wherein the index value comprises an address space identifier (ASID).