Arm Limited

Lionel Belnet

Simon Charles Watt

Nicolas Chaussade

Luc Orion

Christopher Bentley Dornan

Stephane Eric Sebastien Brochier

David Hennah Mansell

Dominic Hugo Symes

Peter Guy Middleton

Michael Robert Nonweiler

Andrew David Tune

Simon Andrew Ford

Jonathan Sean Callan

Peter James Aldworth

Stephane Eric Sebastian Brochier

Stephane Eric Brochier

An apparatus for processing data includes a processor operable in a plurality modes including at least one secure mode being a mode in a secure domain and at least one non-secure mode being a mode in a non-secure domain. When the processor is executing a program in a secure mode the program has access to secure data which is not accessible when the processor is operating in a non-secure mode. The processor is responsive to one or more exception conditions for triggering exception processing using an exception handler. The processor is operable to select the exception handler from among a plurality of possible exception handlers in dependence upon whether the processor is operating in the secure domain or the non-secure domain.

Exception types within a secure processing system

A data processing system including a processor operable in a plurality of modes and in either a secure domain or a non-secure domain. The system includes at least one secure mode being a mode in the secure domain, at least one non-secure mode being a mode in the non-secure domain, and a monitor mode. When the processor is executing a program in a secure mode the program has access to secure data which is not accessible when the processor is operating in a non-secure mode. Switching between the secure and non-secure modes takes place via the monitor mode and the processor is operable at least partially in the monitor mode to execute a monitor program managing switching between the secure and non-secure modes.

Switching between secure and non-secure processing modes

Data processing apparatus and methods are provided. One data processing apparatus comprises: a plurality of pipelined stages, each of the plurality pipelined stages being operable in each processing cycle to receive a group of data elements from an earlier pipelined stage; permute logic operable to buffer 'n' of the groups of data elements over a corresponding 'n' processing cycles thereby creating a bubble within pipelined stages, and forwarding logic operable, once the &#x2018;n&#x2019; of the groups of data elements have been buffered by the permute logic, to forward permuted groups of data elements comprising the data elements reordered by the permute logic to fill the bubble within the pipelined stages. By forwarding the data elements to fill the bubble an improved throughput can be achieved and since a constant stream of data can be transformed without the need to increase the number of input or output registers required to support the permute logic, the need to duplicate the permute logic or the need to introduce any additional storage elements.

Data processing apparatus

A processor may utilise two operating systems (Non-Secure, Secure) between which calls may be made. In order that a second operating system can track task switches made by a first operating system, each time a call is made to the second operating system, this call includes an identifier to enable discrimination between the task which was executing on the first operating system when that call was made. The identifier can be a call identifier and/or a target thread identifier and may include further parameters.

Task following between multiple operating systems

The present invention provides a data processing apparatus and method for managing access to a memory within the data processing apparatus. The data processing apparatus comprises a processor operable in a plurality of modes and a plurality of domains, said plurality of domains comprising a secure domain and a non-secure domain, said plurality of modes including at least one non-secure mode being a mode in the non-secure domain and at least one secure mode being a mode in the secure domain, said processor being operable such that when executing a program in a secure mode said program has access to secure data which is not accessible when said processor is operating in a non-secure mode. Further, a memory is provided for storing data required by the processor, and consists of secure memory for storing secure data and non-secure memory for storing non-secure data. The memory further contains a non-secure table and a secure table, the non-secure table being within the non-secure memory and arranged to contain for each of a number of first memory regions an associated descriptor, and the secure table being within the secure memory and arranged to contain for each of a number of second memory regions an associated descriptor. When access to an item of data in the memory is required by the processor, the processor issues a memory access request, and a memory management unit is provided to perform one or more predetermined access control functions to control issuance of the memory access request to the memory. The memory management unit comprises an internal storage unit operable to store descriptors retrieved by the memory management unit from either the non-secure table or the secure table, and in accordance with the present invention the internal storage unit comprises a flag associated with each descriptor stored within the internal storage unit to identify whether that descriptor is from the non-secure table or the secure table. By this approach, when the processor is operating in a non-secure mode, the memory management unit is operable to perform the predetermined access control functions for the memory access request with reference to access control information derived from the descriptors in the internal storage unit retrieved from the non-secure table. In contrast, when the processor is operating in a secure mode, the memory management unit is operable to perform the predetermined access control functions for the memory access request with reference to access control information derived from the descriptors in the internal storage unit retrieved from the secure table. This approach enables different descriptors to be used for the control of accesses to memory in either the secure domain or the non-secure domain, whilst enabling such different descriptors to co-exist within the memory management unit's internal storage unit, thereby avoiding the requirement to flush the contents of such an internal storage unit when the operation of the processor changes from the secure domain to the non-secure domain, or vice versa.

Apparatus and method for managing access to a memory

In a data processing system using multiple operating systems, an interrupt which itself may be interrupted by a subsequent interrupt which will be serviced in a different operating system, guards itself against being overlooked when that subsequent interrupt has been handled by starting a stub interrupt handling routine in that other operating system before executing the main handling routine in the originating operating system. Thus, the stub interrupt handling routine will be recognised in the other operating system irrespective of other interrupt events which may occur and accordingly the interrupted interrupt handling may be restarted.

Handling multiple interrupts in a data processing system utilising multiple operating systems

A data processing system includes a processor that can operate in a plurality of modes and in either a secure domain or a non-secure domain. At least one secure mode is a mode in the secure domain, and at least one non-secure mode is a mode in the non-secure domain. When the processor is executing a program in a secure mode and that program has access to secure data which is not accessible when the processor is operating in a non-secure mode, the processor is responsive to exception conditions for triggering exception processing. Specifically, the processor is responsive to a parameter specifying which of the exceptions should be handled by a secure mode exception handler executing in a secure mode and which should be handled by an exception handler executing in a mode within a current one of the secure domain and the non-secure domain when that exception occurs.

Exception handling control in a secure processing system

In a system supporting more than one operating system, a data processing thread executing on a first operating system may be subject to an interrupt which triggers interrupt handling on a second operating system. When that interrupt handling is completed on the second operating system, the first operating system is resumed using a return interrupt. The return interrupt specifies the data processing thread which is active on the second operating system such that an appropriate task switch or resumption may be made on the first operating system. The technique is particularly well suited to systems utilising a secure operating system and a non-secure operating system executing on the same hardware.

Delivering data processing requests to a suspended operating system

The present invention provides a data processing apparatus and method for controlling access to a memory. The data processing apparatus has a secure domain and a non-secure domain, in the secure domain the data processing apparatus having access to secure data which is not accessible in the non-secure domain. The data processing apparatus comprises a device coupled to a memory via a device bus, and operable, when an item of data in the memory is required by the device, to issue onto the device bus a memory access request pertaining to either the secure domain or the non-secure domain. The memory is operable to store data required by the device, and contains secure memory for storing secure data and non-secure memory for storing non-secure data. In accordance with the present invention, the data processing apparatus further comprises partition checking logic coupled to the device bus and operable whenever the memory access request as issued by the device pertains to the non-secure domain, to detect if the memory access request is seeking to access the secure memory and upon such detection to prevent the access specified by that memory request. This approach significantly improves the security of data contained within a secure portion of memory.

Control of access to a memory by a device

There is a provided a data processing system comprising:

Security mode switching via an exception vector

A data processing apparatus and method are provided for controlling access to a slave device, the slave device having an address range associated therewith. The apparatus comprises control storage programmable to define a partition identifying a secure region and a non-secure region in the address range, with the data processing apparatus supporting a plurality of modes of operation including a secure mode, and the control storage being programmable only by software executing in the secure mode. A master device is arranged to issue an access request onto a bus, the access request identifying a sequence of addresses within the address range and including a control signal indicating whether the access request is a secure access request or a non-secure access request. The secure region is only accessible by a secure access request. Further, access control logic is provided which is associated with the slave device, the access control logic being operable to receive the access request from the bus and an indication of the partition from the control storage and, if the access request is a non-secure access request, to prevent access to the secure region.

Access control in a data processing apparatus

An apparatus for processing data, the apparatus comprising: a processor operable in a plurality of modes and either a secure domain or a non-secure domain including at least one secure mode being a mode in the secure domain; and at least one non-secure mode being a mode in the non-secure domain. When the processor is executing a program in a secure mode, the program has access to secure data which is not accessible when the processor is operating in a non-secure mode. The processor further includes a non-secure translation table base address register and a secure translation table base address register operable in the non-secure and secure domain, respectively, to indicate a region of memory storing either non-secure or secure domain memory mapping data defining how virtual addresses are translated to physical addresses within either the non-secure or secure domain.

Virtual to physical memory address mapping within a system having a secure domain and a non-secure domain

A data processing apparatus is operable in a plurality of modes and in either a secure domain or a non-secure domain. When operating in a secure mode within the secure domain a program has access to secure data which is not accessible when the processor is operating in a non-secure mode. A vectored interrupt controller is provided to generate an exception handler address in response to an occurrence of an except condition. The vectored interrupt controller is programmable with parameters specifying for each exception condition whether an exception handler in the secure or the non-secure domain should be triggered and an exception handler address for use if the exception occurs when in the appropriate domain. The vectored interrupt controller also includes a parameter specifying a domain switching exception handler address for use if the exception condition occurs when the processor is not in the appropriate domain.

Growing community of inventors

Villeneuve-Loubet, France

Lionel Belnet