Apparatus and method for providing one time programmable memory features in a hypervisor of a computing device

Patent metadata

Field	Value
Publication number	US-11775201-B2
Application number	US-201817266901-A
Country	US
Kind code	B2
Filing date	Aug 8, 2018
Priority date	Aug 8, 2018
Publication date	Oct 3, 2023
Grant date	Oct 3, 2023

Abstract

An apparatus that includes a processor and a memory. The processor and the memory are configured to provide a first software process configured to execute at a first privilege level; and a second software process configured to execute at a second privilege level, wherein the first privilege level is more restrictive than the second privilege level. The processor is configured to, initialize, at the first privilege level, a memory pool within the memory, allocate, at the first privilege level, a block of memory, send a request to write protect the block of memory to the second software process, and to write protect, at the second privilege level, the allocated block of memory.

First claim

What is claimed is:

1. An electronic device, comprising:
a non-transitory memory comprising instructions; and
a processor coupled to the non-transitory memory, the instructions being executed by the processor to cause the electronic device to:
provide a first software process configured to execute at a first privilege level;
provide a second software process configured to execute at a second privilege level, wherein the first privilege level is more restrictive than the second privilege level;
initialize, at the first privilege level, a memory pool within the memory;
allocate, at the first privilege level, a block of memory from the memory pool;
write, at the first privilege level, data to the allocated block of memory;
send a request to write protect the allocated block of memory to the second software process; and
write protect, at the second privilege level, the allocated block of memory to configure the allocated block of memory as a one-time programmable (OTP) memory that is read-only for any process at the first privilege level until the electronic device is rebooted.

2. The electronic device of claim 1 , the instructions further cause the electronic device to:
receive within the first software process a memory allocation request, wherein the memory allocation request is sent by a software application, and wherein the software application is executing at the first privilege level or at a privilege level that is more restrictive than the first privilege level.

3. The electronic device of claim 1 , the instructions further cause the electronic device to:
receive within the first software process a request to write the data to the allocated block of memory.

4. The electronic device of claim 1 , wherein the first software process comprises a kernel, the second software process comprises a hypervisor, and the instructions further cause the electronic device to:
execute the kernel at the first privilege level and execute the hypervisor at the second privilege level.

5. The electronic device of claim 1 , wherein the first software process comprises a kernel, the second software process comprises a secure execution environment, and the instructions further cause the electronic device to:
execute the kernel at the first privilege level and execute the secure execution environment at the second privilege level.

6. The electronic device of claim 1 , wherein the electronic device comprises a mobile communication device.

7. A method comprising:
executing a first software process at a first privilege level and a second software process at a second privilege level;
initializing, at the first privilege level, a memory pool;
allocating, at the first privilege level, a block of memory from the memory pool;
write, at the first privilege level, data to the allocated block of memory; and
write protecting, at the second privilege level, the allocated block of memory to configure the allocated block of memory as a one-time programmable (OTP) memory that is read-only for any process at the first privilege level until the electronic device is rebooted,
wherein the first privilege level is more restrictive than the second privilege level.

8. The method of claim 7 , wherein the method further comprises:
receiving within the first software process a memory allocation request from a third software process, wherein the third software process is executing at the first privilege level or at a privilege level that is more restrictive than the first privilege level.

9. The method of claim 7 , wherein the method further comprises:
receiving within the first software process a request to write the data to the allocated block of memory.

10. The method of claim 7 , wherein the first process comprises a kernel, and the second process comprises a hypervisor.

11. The method of claim 7 , wherein the first software process comprises a kernel, and the second software process comprises a secure execution environment.

12. The method of claim 7 , wherein the method is performed within a mobile communication device.

13. A computer program product, the computer program product being embodied in a non-transitory computer readable medium and comprising computer instructions for:
executing a first software process at a first privilege level and a second software process at a second privilege level;
initializing, at the first privilege level, a memory pool;
allocating, at the first privilege level, a block of memory from the memory pool;
writing, at the first privilege level, data to the allocated block of memory; and
write protecting, at the second privilege level, the allocated block of memory to configure the allocated block of memory as a one-time programmable (OTP) memory that is read-only for any process at the first privilege level until the electronic device is rebooted,
wherein the first privilege level is more restrictive than the second privilege level.

14. The computer program product of claim 13 , the computer program product further comprises computer instructions for:
receiving within the first software process a memory allocation request from a third software process, wherein the third software process is executing at the first privilege level or at a privilege level that is more restrictive than the first privilege level.

15. The computer program product of claim 13 , the computer program product further comprises computer instructions for:
receiving within the first software process a request to write the data to the allocated block of memory.

16. The computer program product of claim 13 , wherein the first process comprises a kernel, and the second process comprises a hypervisor.

17. The computer program product of claim 13 , wherein the first software process comprises a kernel, and the second software process comprises a secure execution environment.

18. The computer program product of claim 14 , wherein the first process comprises a kernel, and the second process comprises a hypervisor.

Assignees

• Huawei Tech Co Ltd

Inventors

• Wu Liming
• Wang Kui
• Denis-Courmont Rémi Robert Michel
• Stoppa Igor

Classifications

• G06F3/0655 Primary

  Vertical data movement, i.e. input-output transfer; data movement between one or more hosts and one or more storage devices · CPC title

• G06F3/0604

  Improving or facilitating administration, e.g. storage management · CPC title

• G06F3/064

  Management of blocks · CPC title

• G06F3/0673

  Single storage device · CPC title

• G06F9/45558

  Hypervisor-specific management and integration aspects · CPC title