Device security features supporting a distributed shared memory system
A memory management and protection system that incorporates device security features that support a distributed, shared memory system. The concept of secure regions of memory and secure code execution is supported, and a mechanism is provided to extend a chain of trust from a known, fixed secure boot ROM to the actual secure code execution. Furthermore, the system keeps a secure address threshold that is only programmable by a secure supervisor, and will only allow secure access requests that are above this threshold.
1. A memory management system comprising:
a read only memory containing code to be executed during the initial boot sequence of the system,
a read/write memory organized as a plurality of programmable memory segments,
a plurality of segment registers equal in number to a number of programmable memory segments of said read/write memory, each segment register storing an indication of permissions required for access to a corresponding programmable memory segment of said read/write memory,
a plurality of requestors operable to originate memory access requests of said read/write memory wherein said requestors may have secure supervisor, non-secure supervisor or user privileges, each memory access request including the security level of said requestor and the memory address to be accessed,
an extended memory controller connected to said read/write memory, said segment registers and said plurality of requestors operable to control access to said memory segments, and further operable to
identify a programmable memory segment sought to be accessed from the memory address,
compare the privileges of said requestor with said indication of permissions for access stored in said segment register corresponding to said identified programmable memory segment of said memory access request
grant said memory access request if said privileges exceed said permissions, and
upon receipt of a memory access request to a non-secure memory segment from a secure requestor will demote the requestor to a non-secure status.
2. The extended memory controller of claim 1 , wherein:
the security level of a memory segment may only be changed by a request with secure supervisor privileges.
3. The extended memory controller of claim 2 , wherein:
a memory access request to a secure memory segment from a non-secure requestor will not be allowed and will generate a fault.
4. The extended memory controller of claim 1 , wherein:
said read only memory only accepts requests from requestors with secure privileges, and reports itself as secure.
5. The extended memory controller of claim 1 , wherein:
emulation requests are only allowed for a secure memory segment if the memory segment is marked emulatable.
6. A extended memory controller comprising:
a read only memory containing code to be executed during the initial boot sequence of the system,
a read/write memory organized as a plurality of programmable memory segments,
a plurality of segment registers equal in number to a number of programmable memory segments of said read/write memory, each segment register storing an indication of permissions required for access to a corresponding programmable memory segment of said read/write memory,
a plurality of requestors operable to originate memory access requests of said read/write memory wherein said requestors may have secure supervisor, non-secure supervisor or user privileges, each memory access request including the security level of said requestor and the memory address to be accessed,
an extended memory controller connected to said read/write memory, said segment registers and said plurality of requestors operable to control access to said memory segments, and further operable to
identify a programmable memory segment sought to be accessed from the memory address,
compare the privileges of said requestor with said indication of permissions for access stored in said segment register corresponding to said identified programmable memory segment of said memory access request
grant said memory access request if said privileges exceed said permissions, and
keep a secure address threshold that is only programmable by a secure supervisor, and only secure requests above said threshold are allowed.
7. The extended memory controller of claim 6 , wherein:
said read only memory only accepts requests from requestors with secure privileges, and reports itself as secure.
8. The extended memory controller of claim 7 , wherein:
emulation requests are only allowed for a secure memory segment if the memory segment is marked emulatable.
9. The extended memory controller of claim 6 , wherein:
the security level of a memory segment may only be changed by a request with secure supervisor privileges.
10. The extended memory controller of claim 9 , wherein:
a memory access request to a secure memory segment from a non-secure requestor will not be allowed and will generate a fault.