Arm Limited

Advanced Risc Machines Limited

Advanced Machines Risc Limited

Simon Charles Watt

Nicolas Chaussade

Lionel Belnet

Luc Orion

Christopher Bentley Dornan

Stephane Eric Sebastien Brochier

David Hennah Mansell

Dominic Hugo Symes

Peter Guy Middleton

Michael Robert Nonweiler

Andrew David Tune

Guy Larri

Jonathan Sean Callan

Peter James Aldworth

Michael Thomas Kilpatrick

Stephane Eric Sebastian Brochier

Stephane Eric Brochier

Lionel Beinet

Data values being stored and transferred within a data processing systemhave a selectable representation, such as true and complement, as indicated by an accompanying representation specifying bit. This assists in obscuring the operation and the power signature of the device in a manner that improves security.

Transferring data values via a data bus or storing data values using a selectable representation

An apparatus for processing data includes a processor operable in a plurality modes including at least one secure mode being a mode in a secure domain and at least one non-secure mode being a mode in a non-secure domain. When the processor is executing a program in a secure mode the program has access to secure data which is not accessible when the processor is operating in a non-secure mode. The processor is responsive to one or more exception conditions for triggering exception processing using an exception handler. The processor is operable to select the exception handler from among a plurality of possible exception handlers in dependence upon whether the processor is operating in the secure domain or the non-secure domain.

Exception types within a secure processing system

There is provided a method of controlling a monitoring function of a processor, the processor being operable in at least two domains, comprising a first domain and a second domain, the first and second domains each comprising at least one mode, the method comprising the steps of: setting at least one control value, the at least one control value relating to a condition and being indicative of whether the monitoring function is allowable in the first domain; and only allowing initiation of the monitoring function in the first domain when the condition is present if its related control value indicates that the monitoring function is allowable. In some embodiments the first domain is a secure domain and the monitoring function is a debug or trace function.

Monitoring control for monitoring at least two domains of multi-domain processors

A data processing system including a processor operable in a plurality of modes and in either a secure domain or a non-secure domain. The system includes at least one secure mode being a mode in the secure domain, at least one non-secure mode being a mode in the non-secure domain, and a monitor mode. When the processor is executing a program in a secure mode the program has access to secure data which is not accessible when the processor is operating in a non-secure mode. Switching between the secure and non-secure modes takes place via the monitor mode and the processor is operable at least partially in the monitor mode to execute a monitor program managing switching between the secure and non-secure modes.

Switching between secure and non-secure processing modes

A processor may utilise two operating systems (Non-Secure, Secure) between which calls may be made. In order that a second operating system can track task switches made by a first operating system, each time a call is made to the second operating system, this call includes an identifier to enable discrimination between the task which was executing on the first operating system when that call was made. The identifier can be a call identifier and/or a target thread identifier and may include further parameters.

Task following between multiple operating systems

The present invention provides a data processing apparatus and method for managing access to a memory within the data processing apparatus. The data processing apparatus comprises a processor operable in a plurality of modes and a plurality of domains, said plurality of domains comprising a secure domain and a non-secure domain, said plurality of modes including at least one non-secure mode being a mode in the non-secure domain and at least one secure mode being a mode in the secure domain, said processor being operable such that when executing a program in a secure mode said program has access to secure data which is not accessible when said processor is operating in a non-secure mode. Further, a memory is provided for storing data required by the processor, and consists of secure memory for storing secure data and non-secure memory for storing non-secure data. The memory further contains a non-secure table and a secure table, the non-secure table being within the non-secure memory and arranged to contain for each of a number of first memory regions an associated descriptor, and the secure table being within the secure memory and arranged to contain for each of a number of second memory regions an associated descriptor. When access to an item of data in the memory is required by the processor, the processor issues a memory access request, and a memory management unit is provided to perform one or more predetermined access control functions to control issuance of the memory access request to the memory. The memory management unit comprises an internal storage unit operable to store descriptors retrieved by the memory management unit from either the non-secure table or the secure table, and in accordance with the present invention the internal storage unit comprises a flag associated with each descriptor stored within the internal storage unit to identify whether that descriptor is from the non-secure table or the secure table. By this approach, when the processor is operating in a non-secure mode, the memory management unit is operable to perform the predetermined access control functions for the memory access request with reference to access control information derived from the descriptors in the internal storage unit retrieved from the non-secure table. In contrast, when the processor is operating in a secure mode, the memory management unit is operable to perform the predetermined access control functions for the memory access request with reference to access control information derived from the descriptors in the internal storage unit retrieved from the secure table. This approach enables different descriptors to be used for the control of accesses to memory in either the secure domain or the non-secure domain, whilst enabling such different descriptors to co-exist within the memory management unit's internal storage unit, thereby avoiding the requirement to flush the contents of such an internal storage unit when the operation of the processor changes from the secure domain to the non-secure domain, or vice versa.

Apparatus and method for managing access to a memory

In a data processing system using multiple operating systems, an interrupt which itself may be interrupted by a subsequent interrupt which will be serviced in a different operating system, guards itself against being overlooked when that subsequent interrupt has been handled by starting a stub interrupt handling routine in that other operating system before executing the main handling routine in the originating operating system. Thus, the stub interrupt handling routine will be recognised in the other operating system irrespective of other interrupt events which may occur and accordingly the interrupted interrupt handling may be restarted.

Handling multiple interrupts in a data processing system utilising multiple operating systems

A data processing system includes a processor that can operate in a plurality of modes and in either a secure domain or a non-secure domain. At least one secure mode is a mode in the secure domain, and at least one non-secure mode is a mode in the non-secure domain. When the processor is executing a program in a secure mode and that program has access to secure data which is not accessible when the processor is operating in a non-secure mode, the processor is responsive to exception conditions for triggering exception processing. Specifically, the processor is responsive to a parameter specifying which of the exceptions should be handled by a secure mode exception handler executing in a secure mode and which should be handled by an exception handler executing in a mode within a current one of the secure domain and the non-secure domain when that exception occurs.

Exception handling control in a secure processing system

The present invention provides a data processing apparatus and method for controlling access to a memory unit. The data processing apparatus comprises a processor operable in a plurality of modes and a plurality of domains, said plurality of domains comprising a secure domain and a non-secure domain, said plurality of modes including at least one non-secure mode being a mode in the non-secure domain and at least one secure mode being a mode in the secure domain. The processor is operable such that when executing a program in a secure mode the program has access to secure data which is not accessible when the processor is operating in a non-secure mode. A memory unit is also provided that comprises a plurality of entries and is operable to store data required by the processor. Each entry is operable to store one or more data items consisting of either secure data or non-secure data, and a flag is associated with each entry in the memory unit to store a value indicating whether the one or more data items stored in the associated entry are secure data or non-secure data. When the processor is operating in the at least one non-secure mode, the memory unit is operable, upon receipt of a memory access request issued by the processor when access to an item of data is required, to prevent access to any data item within an entry of the memory unit that the associated flag indicates has secure data stored therein.

Apparatus and method for controlling access to a memory unit

In a system supporting more than one operating system, a data processing thread executing on a first operating system may be subject to an interrupt which triggers interrupt handling on a second operating system. When that interrupt handling is completed on the second operating system, the first operating system is resumed using a return interrupt. The return interrupt specifies the data processing thread which is active on the second operating system such that an appropriate task switch or resumption may be made on the first operating system. The technique is particularly well suited to systems utilising a secure operating system and a non-secure operating system executing on the same hardware.

Delivering data processing requests to a suspended operating system

The present invention provides a data processing apparatus and method for controlling access to a memory. The data processing apparatus has a secure domain and a non-secure domain, in the secure domain the data processing apparatus having access to secure data which is not accessible in the non-secure domain. The data processing apparatus comprises a device coupled to a memory via a device bus, and operable, when an item of data in the memory is required by the device, to issue onto the device bus a memory access request pertaining to either the secure domain or the non-secure domain. The memory is operable to store data required by the device, and contains secure memory for storing secure data and non-secure memory for storing non-secure data. In accordance with the present invention, the data processing apparatus further comprises partition checking logic coupled to the device bus and operable whenever the memory access request as issued by the device pertains to the non-secure domain, to detect if the memory access request is seeking to access the secure memory and upon such detection to prevent the access specified by that memory request. This approach significantly improves the security of data contained within a secure portion of memory.

Control of access to a memory by a device

There is a provided a data processing system comprising:

Security mode switching via an exception vector

A processor operable to perform a plurality of functions, the processor comprising: an input port; a storage element operable to receive and to store an input signal input via the input port, the input signal comprising at least one control value; control logic operable to control at least one of the functions of the processor in dependence on the at least one control value; and access logic operable to receive an access control signal and to disable access via the input port to the at least one control value stored in the storage element in dependence upon the access control signal.

Growing community of inventors

Cambridge, United Kingdom

Simon Charles Watt