Dynamic configuration and peripheral access in a processor
In various implementations, a system includes a memory, a processor, and an execution-aware memory protection unit (EA-MPU). The EA-MPU is configured to regulate memory access by the processor based at least on the identity of a subject executable that requests access, and on the address to which access is requested, and on permissions information that identifies which subject executables are to be granted access to each of several memory regions. In various implementations, the permissions information itself is stored among the several memory regions. Various configurations of the permissions information can be used to provide shared memory regions for communication among two or more stand-alone trusted software modules, to protect access to devices accessible through memory-mapped I/O (MMIO), to implement a flexible watchdog timer, to provide security for software updates, to provide dynamic root of trust measurement services, and/or to support an operating system.
1. A system for managing processes in a computing device, the system comprising:
a memory comprising a first set of memory locations;
a processor configured to execute a plurality of executable programs; and
a protection circuit, coupled to the processor and to the memory, wherein the protection circuit comprises a second set of memory locations, the protection circuit is configured to:
store permission data in the second set of memory locations, the permission data comprising:
information regarding:
the first and second sets of memory locations;
a set of the executable programs;
relationships between the set of the executable programs, and the first and second sets of memory locations; and
a write-access grant to a first executable code to allow write-access to a first target region in the memory, wherein the first executable code comprises a software update service, wherein the first target region stores permissions for accessing a second executable code, and wherein the first executable code is configured to revise the second executable code; and
regulate access by the processor to the first and second sets of memory locations based at least on the permission data in the second set of memory locations.
2. The system of claim 1 , wherein the first executable code is configured to:
temporarily revise the permissions for accessing the second executable code, prior to revising the second accessible code.
3. The system of claim 1 , wherein the first executable code is configured to revise the second executable code based on an update for the second executable code.
4. The system of claim 3 , wherein:
the first executable code is configured to authenticate the update for the second executable code.
5. The system of claim 4 , wherein:
the first executable code is configured to calculate a signature of a least a portion of the update for the second executable code; and
the first executable code is configured to authenticate the update for the second executable code based at least upon the signature.
6. The system of claim 4 , wherein:
the first executable code is configured to disable the update for the second executable code in response to a failed authentication of the second executable code.
7. The system of claim 1 , wherein the first target region stores permissions for accessing a second target region, and wherein the second target region stores the second executable code, and a third target region in the memory, wherein the third target region stores permissions for accessing a fourth target region, and wherein the fourth target region stores data used by execution of the second executable code; and
wherein the first executable code is configured to calculate a measurement of the second executable code.
8. The system of claim 7 , wherein:
the measurement is based at least on a cryptographic checksum of attributes of the second executable code.
9. The system of claim 8 , wherein the attributes comprise one or more of:
configuration parameters of the second executable code;
startup parameters of the second executable code; or
at least a portion of the second executable code.
10. The system of claim 7 , wherein:
the first executable code is configured to store the measurement of the second executable code in a secure location for subsequent use in validation of the second executable code.
11. The system of claim 1 , wherein:
the first executable code is configured to install an operating system into the first target region;
the permission data comprises a write-access grant to the operating system to allow write-access to a second memory region in the memory; and
the operating system is configured to install an OS-managed executable code into the second memory region.
12. A method for managing processes in a computing device, the method comprising:
storing, by a protection circuit of a device that includes a memory comprising a first set of memory locations and a processor configures to execute a plurality of executable programs, permission data in a second set of memory locations, the permission data comprising:
information regarding:
the first and second sets of memory locations;
a set of the executable programs; and
relationships between the set of the executable programs, and the first and second sets of memory locations; and
a write-access grant to a first executable code to allow write-access to a first target region in the memory, wherein the first executable code comprises a software update service, wherein the first target region stores permissions for accessing a second executable code, and wherein the first executable code is configured to revise the second executable code; and
regulating, by the processor, access to the first and second sets of memory locations based at least on the permission data in the second set of memory locations.
13. The method of claim 12 , wherein the first executable code is configured to:
temporarily revise the permissions for accessing the second executable code, prior to revising the second accessible code.
14. The method of claim 12 , wherein the first executable code is configured to revise the second executable code based on an update for the second executable code.
15. The method of claim 14 , wherein:
the first executable code is configured to authenticate the update for the second executable code.
16. The method of claim 15 , wherein:
the first executable code is configured to calculate a signature of a least a portion of the update for the second executable code; and
the first executable code is configured to authenticate the update for the second executable code based at least upon the signature.
17. At least one non-transitory machine readable medium including instructions for managing processes in a computing device, the instructions, when executed by a device, cause the device to perform operations comprising:
storing, by a protection circuit of the device that includes a memory comprising a first set of memory locations and a processor configures to execute a plurality of executable programs, permission data in a second set of memory locations, the permission data comprising:
information regarding:
the first and second sets of memory locations;
a set of the executable programs; and
relationships between the set of the executable programs, and the first and second sets of memory locations; and
a write-access grant to a first executable code to allow write-access to a first target region in the memory, wherein the first executable code comprises a software update service, wherein the first target region stores permissions for accessing a second executable code, and wherein the first executable code is configured to revise the second executable code; and
regulating, by the processor, access to the first and second sets of memory locations based at least on the permission data in the second set of memory locations.
18. The at least one non-transitory machine readable medium of claim 17 , wherein the first executable code is configured to:
temporarily revise the permissions for accessing the second executable code, prior to revising the second accessible code.
19. The at least one non-transitory machine readable medium of claim 17 , wherein the first executable code is configured to revise the second executable code based on an update for the second executable code.
20. The at least one non-transitory machine readable medium of claim 19 , wherein:
the first executable code is configured to authenticate the update for the second executable code.
21. The at least one non-transitory machine readable medium of claim 20 , wherein:
the first executable code is configured to calculate a signature of a least a portion of the update for the second executable code; and
the first executable code is configured to authenticate the update for the second executable code based at least upon the signature.
22. The at least one non-transitory machine readable medium of claim 20 , wherein:
the first executable code is configured to disable the update for the second executable code in response to a failed authentication of the second executable code.
23. The at least one non-transitory machine readable medium of claim 17 , wherein the first target region stores permissions for accessing a second target region, and wherein the second target region stores a second executable code, and a third target region in the memory, wherein the third target region stores permissions for accessing a fourth target region, and wherein the fourth target region stores data used by execution of the second executable code; and
wherein the first executable code is configured to calculate a measurement of the second executable code.
24. The at least one non-transitory machine readable medium of claim 23 , wherein:
the measurement is based at least on a cryptographic checksum of attributes of the second executable code.
25. The at least one non-transitory machine readable medium of claim 24 , wherein the attributes comprise one or more of:
configuration parameters of the second executable code;
startup parameters of the second executable code; or
at least a portion of the second executable code.
26. The at least one non-transitory machine readable medium of claim 23 , wherein:
the first executable code is configured to store the measurement of the second executable code in a secure location for subsequent use in validation of the second executable code.
27. The at least one non-transitory machine readable medium of claim 17 , wherein:
the first executable code is configured to install an operating system into the first target region;
the permission data comprises a write-access grant to the operating system to allow write-access to a second memory region in the memory; and
the operating system is configured to install an OS-managed executable code into the second memory region.