Embedded processor with virtualized security controls using guest identifications, a common kernel address space and operational permissions
View Patent ↗A method includes assigning unique guest identifications to different guests, specifying an address region and permissions for the different guests and controlling a guest jump from one physical memory segment to a second physical memory segment through operational permissions defined in a root memory management unit that supports guest isolation and protection.
1. A non-transitory computer readable storage medium, comprising executable instructions to define a microcontroller with:
a root memory management unit storing guest identifications to de-alias different contexts associated with a common operating system, guest physical addresses in an address space shared by all guests, and operational permissions for guests in the address space shared by all guests, and wherein a guest jump from a first physical memory segment to a second physical memory segment is controlled through the operational permissions.
2. The non-transitory computer readable storage medium of claim 1 wherein the address space shared by all guests is a common kernel address space.
3. The non-transitory computer readable storage medium of claim 1 further comprising a computational kernel to enable guest transitions without a context switch by setting the operational permissions.
4. The non-transitory computer readable storage medium of claim 1 wherein guest physical addresses correspond to root physical addresses.
5. The non-transitory computer readable storage medium of claim 1 wherein the operational permissions for guests include a read inhibit, a write enable and an execute inhibit.
6. The non-transitory computer readable storage medium of claim 1 further comprising a computational kernel to execute a root monitor in root unmapped space.
7. The non-transitory computer readable storage medium of claim 1 wherein the root memory management unit includes a root protection unit.
8. The non-transitory computer readable storage medium of claim 1 wherein the root memory management unit includes a translation look-aside buffer.
9. A method, comprising:
assigning unique guest identifications to different guests;
specifying an address region and permissions for the different guests; and
controlling a guest jump from a first physical memory segment to a second physical memory segment through operational permissions defined in a root memory management unit that supports guest isolation and protection, wherein the root memory management unit is configured to de-alias different contexts associated with a common operating system, wherein the different contexts are defined by different address spaces.
10. The method of claim 9 wherein the physical memory segments are shared by all guests in a common kernel address space.
11. The method of claim 9 wherein the operational permissions include read inhibit, write inhibit and execute inhibit.
12. The method of claim 9 wherein the physical memory segments have root physical addresses that correspond to guest physical addresses obtained from a fixed mapping table of a guest memory management unit.