Secure mode indicator for smart phone or PDA
A digital system is provided with a secure mode (3 rd level of privilege) built in a non-invasive way on a processor system that includes a processor core, instruction and data caches, a write buffer and a memory management unit. A secure execution mode is thus provided on a platform where the only trusted software is the code stored in ROM. In particular the OS is not trusted, all native applications are not trusted. The secure mode is entered through a unique entry point. The secure execution mode can be dynamically entered and exited with full hardware assessment of the entry/exit conditions. A secure mode indicator is provided to tell a user of the digital system that the device is in secure mode. This indicator may be a small LED, for example. The user should not enter any secret information (password) or should not sign anything displayed on the screen if the secure mode indicator is not active.
1. A method of operating a digital system including a graphics display and secure computing resources, comprising the steps of:
in a non-secure mode, preventing access to the secure computing resources;
executing an application program;
displaying results of the executing step on the graphics display;
entering into a secure mode of operation for executing a secure portion of the application program by:
jumping to an entry address at a particular address in an instruction memory;
executing an activation sequence of instructions beginning at the entry address; and
monitoring the activation sequence of instructions independently of the executing and entering the secure mode of operation only if the activation sequence of instructions is fully executed by the CPU in a pre-defined order;
then unlocking access to the secure computing resources; and
executing the secure portion of the application program using the secure computing resources, including activating a secure mode indicator that is independent from the graphics display;
wherein the secure mode indicator can only be activated by the trusted program code while in the secure mode of operation.
2. The method of claim 1 , wherein the last instruction of the activation sequence is a branch instruction to a secure entry address at a particular address in a secure instruction memory and other than a cache flush instruction or a cache disable instruction, all other instructions in the activation sequence of instructions are NOP instructions.
3. The method of claim 2 , wherein:
said step of entering the secure mode further comprises:
executing a secure mode environment setting sequence of instructions located in the secure memory beginning at the secure entry address to take over execution flow and ensure that execution flow cannot be preempted by nonsecure code to set the environment for secure code execution.
4. The method of claim 3 , wherein:
a combined length of the activation sequence of instructions and the secure mode environment setting sequence of instructions is less than a smallest memory section of a memory management unit translation table.
5. The method of claim 3 , wherein:
said step of entering the secure mode further comprises:
making a memory page of a memory management unit translation table including the activation sequence of instructions and the secure mode environment setting sequence of instructions non-cacheable.
6. The method of claim 3 , wherein:
said step of entering the secure mode further comprises:
disabling instruction caching during execution of the activation sequence of instructions and the secure mode environment setting sequence of instructions.
7. A digital system, comprising:
a central processing unit (CPU) for executing instructions;
a graphics display for displaying results of the executed instructions;
a public memory connected to an instruction bus of the CPU for holding nonsecure instructions, the nonsecure instructions including an activation sequence of instructions starting at an entry point address, the public memory being always accessible by the CPU;
a secure memory connected to the instruction bus of the CPU for holding secure instructions, the secure memory being accessible only when a security signal is asserted;
security circuitry having an output for asserting the security signal when a secure mode of operation is established, comprising a security state machine (SSM) connected to the CPU for monitoring a set of status signals and connected to the instruction address bus for monitoring instruction address signals, the SSM having an output for asserting the security signal when a secure mode of operation is established; and
a secure mode indicator, independent from the graphics display and responsive to the security signal, the secure mode indicator being observable by a user of the digital system,
wherein the secure mode indicator can only be placed in an active mode by executing an instruction while the security signal is asserted;
and wherein the SSM has the entry point address hard coded and is operable to monitor execution of an activation sequence of instructions located in the public memory and to enter the secure mode of operation only if the activation sequence of instruction is executed by the CPU in a pre-defined order hard coded in the SSM.
8. The digital system of claim 7 ; wherein:
a last instruction of the activation sequence of instructions is a branch instruction to a secure entry address at a particular address in the secure memory; and
other instructions of the activation sequence of instructions consist of a cache flush instruction, a cache disable instruction and NOP instructions.
9. The digital system of claim 8 , wherein:
the secure memory includes a secure mode environment setting sequence of instructions located at the secure entry address, the secure mode environment setting sequence of instructions to take over execution flow and ensure that execution flow cannot be preempted by nonsecure code to set the environment for secure code execution.
10. The digital system of claim 9 , further comprising:
a memory management unit including a translation table for mapping a physical address into a virtual address;
wherein a combined length of the activation sequence of instructions and the secure mode environment setting sequence of instructions is less than a smallest memory section of a memory management unit translation table.
11. The digital system of claim 10 , further comprising:
an instruction cache connected to the central processing unit, the private memory and the secure memory, the instruction cache temporarily storing recently used instructions from the private memory and the secure memory for possible reuse by the central processing unit; and
wherein a memory page of the memory management unit translation table including the activation sequence of instructions and the secure mode environment setting sequence of instructions is non-cacheable.
12. The digital system of claim 7 , further comprising:
an instruction cache connected to the central processing unit, the private memory and the secure memory, the instruction cache temporarily storing recently used instructions from the private memory and the secure memory for possible reuse by the central processing unit, and the instruction cache disabled instruction caching during execution of the activation sequence of instructions and the secure mode environment setting sequence of instructions.