Information processing apparatus and program execution method

Patent metadata

Field	Value
Publication number	US-2016378693-A1
Application number	US-201514929135-A
Country	US
Kind code	A1
Filing date	Oct 30, 2015
Priority date	Jun 24, 2015
Publication date	Dec 29, 2016
Grant date	—

Abstract

According to one embodiment, an information processing apparatus includes a processor and a memory. The processor operates in a first state and a second state. The memory includes a first region and a second region. A first program code is written in the second region. The first program code is executed when a call of the function provided by an operation system is invoked. A second program code is written in the first region. The processor executes the second program code to replace a first instruction included in the first program code with a second instruction. The second instruction is for switching the second state and the first state.

First claim

What is claimed is:

1 . An information processing apparatus comprising:
a processor configured to operate in a first state and a second state, the processor switching the first state and the second state, the second state having a security level lower than that of the first state; and a memory including a first region and a second region, the processor in the first state accessing the first region, the processor in the second state accessing the second region, a first program code being written in the second region, the first program code being executed when a call of a function provided by an operation system is invoked, a second program code being written in the first region, the second program code being for modifying the first program code, wherein the processor executes the second program code to replace a first instruction in the first program code with a second instruction, the second instruction being for switching the second state and the first state.

2 . The information processing apparatus according to claim 1 , wherein
the processor interprets the first instruction in execution of the second program code, and stores data obtained by the interpretation in the first region.

3 . The information processing apparatus according to claim 1 , wherein
the processor switches an operation between a first mode and a second mode, the operation is limited in the second mode in comparison with the first mode, and the processor executes the second instruction included in the first program code when the call is invoked in the second mode.

4 . The information processing apparatus according to claim 1 , wherein
a check code used to check contents of a process requested in the call is written in the first region, and the processor executes the second instruction to switch the second state to the first state and then executes the check code when the call is invoked in the second state.

5 . The information processing apparatus according to claim 4 , wherein
the check code includes a read code used to read data from a memory region that the processor can access in the second state.

6 . The information processing apparatus according to claim 1 , further comprising:
a controller configured to control access to a region in the memory, wherein the processor sets, in the controller, an access limitation used to deny modifying of data in a region in which the first instruction is replaced with the second instruction.

7 . The information processing apparatus according to claim 4 , further comprising:
a controller configured to control access to a region in the memory, wherein the check code includes a setting code used to set an access limitation on a region designated in the memory, and the processor executes the setting code to set, in the controller, an access limitation used to deny modifying of data in a region in which the first instruction is replaced with the second instruction.

8 . The information processing apparatus according to claim 1 , wherein
the processor executes the second program code when the second state is switched to the first state.

9 . The information processing apparatus according to claim 1 , further comprising:
a timer configured to generate a time interruption, wherein the processor switches the second state to the first state and executes the second program code when the processor operates in the second state and the timer generates the timer interruption.

10 . The information processing apparatus according to claim 4 , wherein
the processor checks a parameter obtained by the call in execution of the check code, and rewrites the parameter in accordance with a result from the check.

11 . The information processing apparatus according to claim 1 , wherein
the processor includes an address translation unit, the address translation unit translating a virtual address of the first program code into a physical address in accordance with a rule of translation in the second state, and mapping the physical address on a virtual address space in accordance with a rule of translation in the first state.

12 . The information processing apparatus according to claim 5 , wherein
the processor includes an address translation unit, the address translation unit translating a virtual address in a region storing the data in the memory region into a physical address in accordance with a rule of translation in the second state, and mapping the physical address on a virtual address space in accordance with a rule of translation in the first state, the virtual address being included in a parameter obtained by the call.

13 . A program execution method comprising:
switching a second state to a first state in a processor, the second state having a security level lower than that of the first state; reading a second program code used to modify a first program code from a first region, the first program code being executed when a call of a function provided by an operation system is invoked and being read from a second region, the first region being a memory region that the processor in the first state accesses, the second region being a memory region that the processor in the second state accesses; and executing the second program code to replace a first instruction included in the first program code with a second instruction, the second instruction being for switching the second state and the first state.

14 . The program execution method according to claim 13 , further comprising:
interpreting the first instruction in execution of the second program code; and storing data obtained by the interpretation in the first region.

15 . The program execution method according to claim 13 , further comprising:
executing the second instruction included in the first program code when the call is invoked in the second mode.

16 . The program execution method according to claim 13 , further comprising:
writing a check code in the first region, the check code being used to check contents of a process requested by using the call; and switching the second state to the first state by executing the second instruction to execute the check code when the call is invoked in the second mode.

17 . The program execution method according to claim 16 , wherein
a read code used to read data from a memory region that the processor is capable of accessing in the second state is included in the check code.

18 . The program execution method according to claim 13 , further comprising:
setting an access limitation to deny modifying of data in a region in which the first instruction is replaced with the second instruction.

19 . The program execution method according to claim 16 , further comprising:
executing a setting code to set an access limitation to deny modifying of data in a region in which the first instruction is replaced with the second instruction, the setting code being used to set an access limitation on a region designated in the memory, the check code including the setting code.

20 . The program execution method according to claim 13 , wherein
the second state is switched to the first state in the processor and the second program code is executed in response to an interruption generated when the processor operates in the second state.

Assignees

• Toshiba Kk

Inventors

• Sasaki Shunsuke
• Kizu Toshiki
• Isozaki Hiroshi
• Kanai Jun
• Sano Shintarou
• Nara Ryuta

Classifications

• G06F2212/1052

  Security improvement · CPC title

• G06F12/1491 Primary

  in a hierarchical protection system, e.g. privilege levels, memory rings · CPC title

• G06F21/74

  operating in dual or compartmented mode, i.e. at least one secure mode · CPC title

• G06F9/30054

  Unconditional branch instructions · CPC title