Dynamic Configuration and Peripheral Access in a Processor

Patent metadata

Field	Value
Publication number	US-2016283402-A1
Application number	US-201514666087-A
Country	US
Kind code	A1
Filing date	Mar 23, 2015
Priority date	Mar 23, 2015
Publication date	Sep 29, 2016
Grant date	—

Abstract

In various implementations, a system includes a memory, a processor, and an execution-aware memory protection unit (EA-MPU). The EA-MPU is configured to regulate memory access by the processor based at least on the identity of a subject executable that requests access, and on the address to which access is requested, and on permissions information that identifies which subject executables are to be granted access to each of several memory regions. In various implementations, the permissions information itself is stored among the several memory regions. Various configurations of the permissions information can be used to provide shared memory regions for communication among two or more stand-alone trusted software modules, to protect access to devices accessible through memory-mapped I/O (MMIO), to implement a flexible watchdog timer, to provide security for software updates, to provide dynamic root of trust measurement services, and/or to support an operating system.

First claim

What is claimed is:

1 . A system for managing processes in a computing device, the system comprising:
a memory comprising a plurality of data regions; a processor configured to execute a plurality of executable programs; and a protection circuit, coupled to the processor and to the memory and configured to regulate memory access by the processor based at least on permission data, wherein
the permission data comprises information regarding a set of the data regions in the memory, regarding a set of the executable programs, and regarding relationships between the set of data regions and the set of executable programs,
the permission data comprises an access grant to a first memory region by a first executable program,
the permission data comprises an access grant to a second memory region by a second executable program, and
the permission data comprises an access grant to the second memory region by the first executable program.

2 . The system of claim 1 , wherein the protection circuit comprises an execution-aware memory protection unit.

3 . The system of claim 2 , wherein the permission data is stored in registers in the execution-aware memory protection unit.

4 . The system of claim 1 , wherein:
the processor is configured to execute an operating system; and the first and second executable programs are configured to be executed without reliance on the operating system.

5 . The system of claim 1 , wherein:
the permission data deny access to the first memory region by executables other than the first executable program; the permission data comprises an access grant to a third memory region by the second executable program; and the permission data deny access to the third memory region by executables other than the second executable program.

6 . A system for managing processes in a computing device, the system comprising:
a memory comprising a plurality of data regions; a hardware device, wherein the hardware device is accessible through memory-mapped I/O communication; a processor configured to execute a plurality of executable programs; and a protection circuit, coupled to the processor and to the memory and to the hardware device, wherein
the protection circuit is configured to regulate access by the processor to the hardware device access and to the memory,
regulation by the protection circuit is based at least on permission data,
the permission data comprises information regarding a set of the data regions in the memory, regarding a set of the executable programs, and regarding relationships between the set of data regions and the set of executable programs,
the permission data comprises information regarding one or more memory-mapped addresses assigned to the hardware device, and regarding relationships between the memory-mapped addresses and the set of executable programs,
the permission data comprises an exclusive access grant to the memory-mapped addresses assigned to the hardware device by a first executable program among the set of the executable programs, and
the permission data comprises access denials to the hardware device by executable programs other than the first executable program.

7 . The system of claim 6 , wherein:
the hardware device comprises a timer circuit; the first executable program is configured to reset the timer circuit; and the first executable program is configured to provide a watchdog timer service to the executable programs other than the first executable program.

8 . The system of claim 7 , wherein:
the timer circuit is fabricated on a semiconductor substrate along with the processor; and the first executable program is configured to configure an interrupt event to be initiated in response to a timeout condition of the timer circuit.

9 . A system for managing processes in a computing device, the system comprising:
a memory comprising a first set of memory locations; a processor configured to execute a plurality of executable programs; and a protection circuit, coupled to the processor and to the memory, wherein
the protection circuit comprises a second set of memory locations,
the protection circuit is configured to store permission data in the second set of memory locations,
the permission data comprises information regarding the first and second sets of memory locations, regarding a set of the executable programs, and regarding relationships between
the set of the executable programs, and
the first and second sets of memory locations, and

the protection circuit is configured to regulate access by the processor to the first and second sets of memory locations based at least on the permission data in the second set of memory locations.

10 . The system of claim 9 , wherein:
the permission data comprises a write-access grant by a first executable code to a first target region in the memory; the first executable code comprises a software update service; the first target region stores permissions for accessing a second executable code; and the first executable code is configured to revise the second executable code.

11 . The system of claim 10 , wherein the first executable code is configured to:
temporarily revise the permissions for accessing the second executable code, prior to revising the second accessible code.

12 . The system of claim 10 , wherein the first executable code is configured to revise the second executable code based on an update for the second executable code.

13 . The system of claim 12 , wherein:
the first executable code is configured to authenticate the update for the second executable code.

14 . The system of claim 13 , wherein:
the first executable code is configured to calculate a signature of a least a portion of the update for the second executable code; and the first executable code is configured to authenticate the update for the second executable code based at least upon the signature.

15 . The system of claim 13 , wherein:
the first executable code is configured to disable the update for the second executable code in response to a failed authentication of the second executable code.

16 . The system of claim 9 , wherein:
the permission data comprises a write-access grant by a first executable code to
a first target region in the memory, wherein the first target region stores permissions for accessing a second target region, and wherein the second target region stores a second executable code, and
a third target region in the memory, wherein the third target region stores permissions for accessing a fourth target region, and wherein the fourth target region stores data used by execution of the second executable code; and
the first executable code is configured to calculate a measurement of the second executable code.

17 . The system of claim 16 , wherein:
the measurement is based at least on a cryptographic checksum of attributes of the second executable code.

18 . The system of claim 17 , wherein the attributes comprise one or more of:
configuration parameters of the second executable code; startup parameters of the second executable code; or at least a portion of the second executable code.

19 . The system of claim 16 , wherein:
the first executable code is configured to store the measurement of the second executable code in a secure location for subsequent use in validation of the second executable code.

20 . The system of claim 9 , wherein:
the permission data comprises a write-access grant by a first executable

Assignees

• Intel Corp

Inventors

• Schulz Steffen
• Koeberl Patrick

Classifications

• G06F2212/1052

  Security improvement · CPC title

• G06F11/073 Primary

  in a memory management context, e.g. virtual memory or cache management (memory management G06F12/00; testing of static memory units G11C29/00) · CPC title

• G06F12/1483

  using an access-table, e.g. matrix or list · CPC title

• G06F11/3037

  where the computing system component is a memory, e.g. virtual memory, cache (accessing, addressing or allocating within memory systems or architectures G06F12/00; checking stores for correct operation G11C29/00) · CPC title

• G06F11/3034

  where the computing system component is a storage system, e.g. DASD based or network based (digital input from or digital output to record carriers G06F3/06; digital recording or reproducing G11B20/18; for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS], H04L67/1097) · CPC title