Dynamic management of a memory firewall
In embodiments, a system includes a first and a second processing unit, a memory, and a firewall device. The first processing unit operates in a secure mode and generates memory access requests having a secure level. The second processing unit operates in a non-secure mode and generates memory access requests having a non-secure level. The memory includes a first memory area that can be shared between the first and second processing units. The firewall device includes a first firewall circuit with a first configuration authorizing access to the first memory area in the presence of a secure or non-secure level access request. The firewall circuit includes a second configuration prohibiting access to the first memory area in the presence of a secure level access request and authorizing access to the first memory area only in the presence of a non-secure level access request.
1 . A system, comprising:
a memory storage having a first memory area;
a first processing unit configured to generate memory access requests having a secure level;
a second processing unit configured to generate memory access requests having a non-secure level; and
a firewall device coupled between the memory storage and the first and second processing units, the firewall device comprising a first firewall circuit associated with the first memory area, the first firewall circuit comprising:
a set of registers containing access rights information for the first memory area,
a verification circuit configured to compare security level indications of access requests with the access rights information, and
a configuration interface accessible by the second processing unit,
wherein the first firewall circuit is configurable, via the configuration interface, to operate in:
a first mode authorizing secure and non-secure access requests to the first memory area, and
a second mode authorizing non-secure access requests and prohibiting secure access requests to the first memory area.
2 . The system of claim 1 , wherein the memory storage comprises a memory region allocated to the second processing unit and containing the first memory area.
3 . The system of claim 2 , wherein the memory storage comprises:
a second memory area allocated to the first processing unit; and
a third memory area within the memory region, the third memory area being reserved for the second processing unit.
4 . The system of claim 3 , wherein the firewall device further comprises:
a second firewall circuit associated with the second memory area; and
a third firewall circuit associated with the third memory area,
wherein the second firewall circuit and third firewall circuit each comprise respective registers containing information data representative of secure access rights, non-secure access rights, or a combination thereof, and
wherein the verification circuit is configured to compare security indications with the information data contained in the respective registers.
5 . The system of claim 1 , wherein the configuration interface is coupled to a bus for receiving configuration commands from the second processing unit to modify contents of the set of registers.
6 . The system of claim 1 , wherein each memory access request comprises:
an addressing field for addressing the first memory area; and
a security indication for indicating the secure level or the non-secure level.
7 . The system of claim 1 , wherein the verification circuit comprises logic circuits configured to authorize or prohibit access to the first memory area according to the comparison result.
8 . A method of managing memory access, comprising:
receiving, at a firewall device, an access request for a memory area, the access request having a security level indication;
comparing, by a verification circuit of the firewall device, the security level indication with access rights information stored in a set of registers associated with the memory area;
selectively authorizing or prohibiting the access request based on the comparison and a current configuration mode of the firewall device;
receiving, from a non-secure processing unit, a configuration command at a configuration interface of the firewall device; and
switching the configuration mode of the firewall device between:
a first mode authorizing secure and non-secure access requests to the memory area, and
a second mode authorizing non-secure access requests and prohibiting secure access requests to the memory area.
9 . The method of claim 8 , wherein:
the memory area is within a memory region allocated to the non-secure processing unit; and
the access rights information is stored in the set of registers by the non-secure processing unit.
10 . The method of claim 8 , wherein comparing the security level indication comprises:
comparing, by logic circuits, the security level indication with the access rights information; and
authorizing or prohibiting access according to the comparison result.
11 . The method of claim 8 , further comprising:
receiving a secure level access request at a second firewall circuit associated with a secure memory area;
comparing a security indication of the secure level access request with second access rights information; and
authorizing access to the secure memory area only for secure level access requests.
12 . The method of claim 8 , wherein receiving the configuration command comprises:
receiving the command via a bus interface; and
updating contents of the set of registers based on the command.
13 . The method of claim 8 , wherein the access request comprises:
an addressing field identifying the memory area; and
the security level indication.
14 . The method of claim 8 , wherein switching the configuration mode comprises modifying, via the configuration interface, information data contained in the set of registers.
15 . A firewall device, comprising:
a plurality of firewall circuits, each associated with a respective memory area and comprising:
a set of registers containing access rights information for the associated memory area;
a verification circuit configured to compare security level indications of access requests with the access rights information; and
a configuration interface,
wherein at least a first firewall circuit of the plurality is configurable, via its configuration interface, by a non-secure processing unit to operate in:
a first mode authorizing secure and non-secure access requests to its associated memory area, and
a second mode authorizing non-secure access requests and prohibiting secure access requests to its associated memory area.
16 . The firewall device of claim 15 , wherein the verification circuit comprises logic circuits configured to authorize or prohibit access according to the comparison result, and wherein the configuration interface is coupled to a bus for receiving configuration commands.
17 . The firewall device of claim 15 , wherein the first firewall circuit is associated with a memory area within a memory region allocated to the non-secure processing unit.
18 . The firewall device of claim 15 , wherein the access rights information for each firewall circuit is modifiable via its respective configuration interface.
19 . The firewall device of claim 15 , wherein the verification circuit is configured to:
compare an indication of a request for access with the acess rights information contained in a corresponding set of registers; and
authorize or prohibit access according to the comparison result.
20 . The firewall device of claim 15 , wherein:
a second firewall circuit of the plurality is configured to authorize access only in response to secure level access requests; and
a third firewall circuit of the plurality is configured to authorize access only in response to non-secure level access requests.