Hardware-implemented hypervisor for root-of-trust monitoring and control of computer system

1. A hardware hypervisor for modifying a host processor system to provide security against malware, the host processor system having at least a central processing unit (CPU) with a memory management unit (MMU), a high-speed bus for providing data links between the CPU, other bus masters, and peripherals, wherein one of the bus masters is a debug interface unit, the hypervisor comprising:

a monitor co-processor having its hardware processing elements different from, and configured to operate independently from, the host processor system;

a communications interface for providing a hardwired communications link between the monitor co-processor and the debug interface unit;

wherein the communications interface is a hardware modification of the debug interface unit;

a behavioral interface on the high-speed bus, configured to monitor control signals from the CPU and transactions on system interconnects;

wherein the behavioral interface has an MMU tracer configured to monitor changes in a context number stored in the MMU and a lapse of time between each change;

an access controller on the high-speed bus, configured to store access control data, to intercept requests on the high-speed bus that are associated with operation of the host processor system, to evaluate the requests against the access control data, and to grant or deny the requests; and

wherein the behavioral interface and the access controller are accessible to the monitor co-processor via the communications interface and are implemented as slave peripheral hardware devices on the high speed bus.

2. The hypervisor of claim 1 , wherein the hypervisor is operable without changes to the software of the host processor system.

3. The hypervisor of claim 1 , wherein the access control data is a device access control list (DACL) that stores a matrix of master versus slave peripherals with corresponding bits to indicate whether read or write access is to be blocked.

4. The hypervisor of claim 3 , wherein one of the master peripherals is a JTAG TAP, and wherein the bits are set to prevent read or write access of the JTAG TAP.

5. The hypervisor of claim 1 , wherein the access control data is address data representing a region of peripheral addresses whose transactions are to be restricted.

6. The hypervisor of claim 5 , wherein the address data represents a write-protected region such that the system call table cannot be written by any bus transaction issued by the CPU.

7. The hypervisor of claim 1 , wherein the co-processor is configured to periodically read a system call table via the debug interface unit, to generate a digest from the call table, and to report to an administrator if the digest changes.

8. An improved processor system, the host processor system having at least a central processing unit (CPU) with a memory management unit (MMU), a high-speed bus for providing data links between the CPU and peripherals, wherein one of the peripherals is a debug interface unit, the improvements comprising:

a monitor co-processor having its hardware processing elements different from, and configured to operate independently from, the host processor system;

a communications interface for providing a hardwired communications link between the monitor co-processor and the debug UART;

wherein the communications interface is a hardware modification of the debug interface unit;

a behavioral interface on the high-speed bus, configured to monitor control signals from the CPU and transactions on system interconnects;

wherein the behavioral interface has an MMU tracer configured to monitor changes in a context number stored in the MMU and a lapse of time between each change;

an access controller on the high-speed bus, configured to store access control data, to intercept requests on the high-speed bus that are associated with operation of the host processor system, to evaluate the requests against the access control data, and to grant or deny the requests; and

wherein the behavioral interface and the access controller are accessible to the co-processor via the communications interface and are implemented as slave peripheral hardware devices on the high speed bus.

9. A method of modifying a host processor system to provide security against malware, the host processor system having at least a central processing unit (CPU) with a memory management unit (MMU), a high-speed bus for providing data links between the CPU, other bus masters, and peripherals, wherein one of the peripherals is a debug interface unit, the method comprising: providing a co-processor programmed to perform one or more security tasks;

wherein the monitor co-processor has its hardware processing elements different from, and configured to operate independently from, the host processor system;

modifying the debug interface unit to provide a communications interface between the co-processor and the debug interface unit;

wherein the communications interface is a hardware modification of the debug interface unit;

providing a communications link between the communications interface and the co-processor;

providing a behavioral interface on the high-speed bus, configured to monitor control signals from the CPU and transactions on system interconnects;

wherein the behavioral interface has an MMU tracer configured to monitor changes in a context number stored in the MMU and a lapse of time between each change;

providing an access controller on the high-speed bus, configured to store access control data, to intercept requests on the high-speed bus that are associated with operation of the host processor system, to evaluate the requests against the access control data, and to grant or deny the requests; and

wherein the behavioral interface and the access controller are accessible to the co-processor via the communications interface and are implemented as slave peripheral hardware devices on the high speed bus.

10. The method of claim 9 , wherein the hypervisor is operable without changes to the software of the host processor system.

11. The method of claim 9 , wherein the access control data is a device access control list (DACL) that stores a matrix of master versus slave peripherals with corresponding bits to indicate whether read or write access is to be blocked.

12. The method of claim 11 , wherein one of the master peripherals is a JTAG TAP, and wherein the bits are set to prevent read or write access of the JTAG TAP.

13. The method of claim 9 , wherein the access control data is address data representing a region of master and/or slave peripheral addresses whose transactions are to be restricted.

14. The method of claim 13 , wherein the address data represents a write-protected region such that the system call table cannot be written by any bus transaction issued by the CPU.

15. The method of claim 9 , wherein the co-processor is configured to periodically read a system call table via the debug interface unit, to generate a digest from the call table, and to report to an administrator if the digest changes.