Device having memory access protection
A device has a protection unit for controlling access to a memory. Indirect memory access requests have control data indicative of a memory access control register to be written to provide indirect access to a target memory and requested address data indicative of at least one memory address of the target memory to be accessed. The protection unit contains protection data defining access rights of source units to access specified address ranges of the target memory, and a system bus interface interfacing to a source unit and a memory bus interface interfacing to the target memory via a controller. The protection unit has a control monitor for detecting an indirect memory access request, and an indirect address monitor for comparing requested address data to specified address ranges and subsequently grant the indirect memory access in accordance with access rights of the respective source unit.
1. A system, comprising:
a system bus connectable to a target memory and to a source of indirect memory access requests, the indirect memory access requests comprising control data indicative of a memory access control register to be written to provide access to the target memory and requested address data indicative of at least one memory address of the target memory to be accessed, and
a protection unit for controlling access to the target memory, comprising:
a data storage for containing protection data defining access rights of source units to access specified address ranges of the target memory,
a system bus interface arranged to interface to at least one source unit via the system bus and a memory bus interface arranged to interface to the target memory via a memory bus,
a control monitor to monitor the system bus for detecting a respective indirect memory access request issued by a respective source unit, and
an indirect address monitor arranged to, upon said detecting, compare requested address data of the respective indirect memory access request to respective specified address ranges and subsequently grant the indirect memory access as requested by the respective indirect memory access request in accordance with respective access rights of the respective source unit.
2. System as claimed in claim 1 , wherein the access rights comprise, for a specific specified address range, a list of source units that are allowed to access the specific specified address range, and the indirect address monitor is arranged to only grant access when the comparison shows that the requested address is in the specific specified address range and the respective source unit is in the list of source units.
3. System as claimed in claim 1 , wherein the indirect address monitor is arranged to provide a violation signal upon said comparing and subsequently not granting the indirect memory access as requested by the respective indirect memory access request.
4. System as claimed in claim 1 , wherein the control monitor is arranged to provide a match signal upon said detecting, and the indirect address monitor is arranged to receive the match signal to enable said comparing of the requested address data of the respective indirect memory access request to respective specified address ranges.
5. System as claimed in claim 1 , wherein the control monitor is arranged to configure said detecting based on monitor configuration data.
6. System as claimed in claim 5 , wherein the control monitor is arranged to receive the monitor configuration data via the system bus.
7. System as claimed in claim 1 , wherein the protection unit comprises a memory for storing the protection data.
8. System as claimed in claim 1 , wherein the respective indirect memory access request comprises a source indication of the respective source unit, and the protection unit is arranged to retrieve the source indication.
9. System as claimed in claim 8 , wherein the control monitor is arranged to adapt said detecting based on the source indication.
10. System as claimed in claim 9 , wherein the indirect address monitor is arranged to adapt said comparing based on the source indication.
11. System as claimed in claim 1 , wherein the protection data comprises a privilege level required for accessing a respective specified address range, and the indirect address monitor is arranged to grant the indirect memory access to the respective specified address range only if a source privilege level of the respective source unit is at least as high as the privilege level.
12. System as claimed in claim 1 , wherein the indirect address monitor comprises a lookup table for storing the specified address ranges and corresponding access rights of source units.
13. System as claimed in claim 1 , wherein the protection data comprises a specified access type for accessing a specified address range, and the indirect address monitor is arranged only to grant the indirect memory access to the respective specified address range if the indirect memory access request has an access type allowed by the specified access type.
14. System as claimed in claim 13 , wherein the specified access type comprises one of read access, write access, and full access including read and write access.
15. System as claimed in claim 1 , comprising the at least one target memory coupled to the memory bus.
16. System as claimed in claim 1 , comprising the at least one source unit coupled to the system bus.
17. Integrated circuit comprising at least one device according to claim 1 .
18. Processing system for processing data comprising at least one device according to claim 1 , and the at least one source unit coupled to the system bus and the at least one target memory coupled to the memory bus.
19. Method of controlling access to a memory in a protection unit,
indirect memory access requests as transferred via a system bus providing indirect memory access to a target memory, the indirect memory access requests comprising control data indicative of a memory access control register to be written to provide access to the target memory and requested address data indicative of at least one memory address of the target memory to be accessed,
the protection unit being arranged to contain protection data defining access rights of source units to access specified address ranges of the target memory,
the method comprising
monitoring the system bus for detecting a respective indirect memory access request issued by a respective source unit, and
comparing, upon said detecting, requested address data of the respective indirect memory access request to respective specified address ranges and subsequently granting the indirect memory access as requested by the respective indirect memory access request in accordance with respective access rights of the respective source unit.
20. Method as claimed in claim 19 , said granting comprising blocking the indirect memory access when the requested address is within the specified address range and the access rights of the respective source issuing the request are insufficient, and enabling the indirect memory access when the requested address is within the specified address range and the access rights of the respective source issuing the request are sufficient, or when the requested address is outside any protected specified address range.