Secure mode for processors supporting MMU and interrupts
A digital system is provided with a secure mode (3 rd level of privilege) built in a non-invasive way on a processor system that includes a processor core, instruction and data caches, a write buffer and a memory management unit. A secure execution mode is thus provided on a platform where the only trusted software is the code stored in ROM. In particular the OS is not trusted, all native applications are not trusted. A secure execution mode is provided that allows virtual addressing when a memory management unit (MMU) is enabled. The secure execution mode allows instruction and data cache to be enabled. A secure execution mode is provided that allows all the system interruptions to be unmasked. The secure mode is entered through a unique entry point. The secure execution mode can be dynamically entered and exited with full hardware assessment of the entry/exit conditions. A specific set of entry conditions is monitored that account for caches, write buffer and MMU being enabled. The structure of the activation sequence code accounts for caches, write buffer and MMU being enabled. The structure of the exit sequences code accounts for caches, write buffer and MMU being enabled. A specific way is provided to manage a safe exit of secure mode under generic interruptions and allows return from interruption through entry point and activation sequence and a proper resuming of the secure execution. A specific way is provided to manage the MMU in secure mode and provide data exchange between secure and non-secure environment.
1. A method of operating a digital system having a mechanism for a CPU having an instruction execution pipeline to enter a secure mode of operation, comprising the steps of:
jumping to an entry address at a particular address in an instruction memory;
executing an activation sequence of a plurality of instructions beginning at the entry address; and
entering the secure mode of operation only if the activation sequence of the plurality of instructions is fully executed by the CPU in a pre-defined order.
2. The method of claim 1 further comprising the step of not entering the secure mode of operation if the instruction jumping to the entry address is executed from an instruction cache.
3. The method of claim 1 , wherein:
the CPU operates in accordance with an instruction execution pipeline; and
the activation sequence of the plurality of instructions is longer than the length of the instruction execution pipeline of the CPU.
4. The method of claim 1 , wherein:
the CPU operates in accordance with an instruction execution pipeline of predetermined length n; and
the CPU has an instruction cache (I-cache) and wherein the activation sequence includes an I-cache flush instruction, such that at least n instructions of the activation sequence are executed before the I-cache flush instruction.
5. The method of claim 1 , wherein:
the CPU operates in accordance with an instruction execution pipeline of predetermined length n; and
the CPU has an instruction cache (I-cache) and wherein the activation sequence includes an I-cache disable instruction, such that at least n instructions of the activation sequence are executed before the I-cache disable instruction.
6. The method of claim 1 , wherein the last instruction of the activation sequence is a branch instruction and other than a cache flush instruction or a cache disable instruction, all other instructions in the activation sequence are NOP instructions.
7. A digital system, comprising:
a CPU with an instruction execution pipeline;
a public read only memory (ROM) connected to an instruction bus of the CPU for holding non-secure instructions, the public ROM being always accessible by the CPU;
a secure ROM connected to the instruction bus of the CPU for holding secure instructions, the secure ROM being accessible only when a security signal is asserted;
a security state machine (SSM) connected to the CPU for monitoring a set of status signals and connected to the instruction address bus for monitoring instruction address signals, the SSM having an output for asserting the security signal when a secure mode of operation is established; and
wherein the SSM is operable to monitor execution of an activation sequence of a plurality of instructions located in public ROM by monitoring said instruction address signals and to enter the secure mode of operation only if the activation sequence of the plurality of instructions is executed by the CPU in a pre-defined order.
8. The digital system of claim 7 further comprising:
an instruction cache;
wherein said secure ROM has an entry address for beginning said secure mode;
wherein said security state machine is further operable to not enter the secure mode of operation if an instruction within said activation sequence stored in said public ROM jumps to said entry address is executed from said instruction cache.
9. The digital system of claim 7 , wherein:
said CPU instruction execution pipeline has a predetermined length; and
the activation sequence of instructions stored in said public ROM is longer than said predetermined length of said CPU instruction execution pipeline.
10. The digital system of claim 7 , further comprising:
an instruction cache coupled to said CPU;
said CPU instruction execution pipeline has a predetermined length n; and
wherein said activation sequence includes an I-cache flush instruction, such that at least n instructions of the activation sequence are executed before said I-cache flush instruction.
11. The digital system of claim 7 , further comprising:
an instruction cache coupled to said CPU;
said CPU instruction execution pipeline has a predetermined length n; and
wherein the activation sequence includes an I-cache disable instruction, such that at least n instructions of the activation sequence are executed before said I-cache disable instruction.
12. The digital system of claim 7 , further comprising:
an instruction cache coupled to said CPU;
wherein a last instruction of the activation sequence is a branch instruction and other than a cache flush instruction or a cache disable instruction, all other instructions in the activation sequence are NOP instructions.