Controlling access to multiple memory zones in an isolated execution environment
First Claim
1. An apparatus comprising:
- a configuration storage to store configuration settings to configure an access transaction generated by a processor having a first execution mode and a second execution mode, the configuration storage to store an execution mode identifier that is asserted as an execution mode signal to indicate the processor is operating in the first execution mode, the configuration settings including subsystem memory range settings, a memory base value, and a memory length value, a combination of at least the base and length values to define a protected memory area in a memory external to the processor that is accessible to the processor in the first execution mode, and the configuration settings to define an un-protected memory area that is accessible to the processor in the second execution mode, wherein the processor in the second execution mode cannot access the protected memory area, the access transaction including access information including a physical address;
a protected memory zone in the protected memory area defined by a subsystem memory range setting;
an un-protected memory zone in the un-protected memory area; and
a memory zone access checking circuit coupled to the configuration storage to check the access transaction using at least one of the configuration settings and the access information to determine if the access transaction is valid and generating an access grant signal if the transaction is valid.
0 Assignments
0 Petitions
Accused Products
Abstract
The present invention provides a method, apparatus, and system for controlling memory accesses to multiple memory zones in an isolated execution environment. A processor having a normal execution mode and an isolated execution mode generates an access transaction. The access transaction is configured using a configuration storage that stores configuration settings. The configuration settings include a plurality of subsystem memory range settings defining memory zones. The access transaction also includes access information. A multi-memory zone access checking circuit, coupled to the configuration storage, checks the access transaction using at least one of the configuration settings and the access information. The multi-memory zone access checking circuit generates an access grant signal if the access transaction is valid.
-
Citations
36 Claims
-
1. An apparatus comprising:
-
a configuration storage to store configuration settings to configure an access transaction generated by a processor having a first execution mode and a second execution mode, the configuration storage to store an execution mode identifier that is asserted as an execution mode signal to indicate the processor is operating in the first execution mode, the configuration settings including subsystem memory range settings, a memory base value, and a memory length value, a combination of at least the base and length values to define a protected memory area in a memory external to the processor that is accessible to the processor in the first execution mode, and the configuration settings to define an un-protected memory area that is accessible to the processor in the second execution mode, wherein the processor in the second execution mode cannot access the protected memory area, the access transaction including access information including a physical address;
a protected memory zone in the protected memory area defined by a subsystem memory range setting;
an un-protected memory zone in the un-protected memory area; and
a memory zone access checking circuit coupled to the configuration storage to check the access transaction using at least one of the configuration settings and the access information to determine if the access transaction is valid and generating an access grant signal if the transaction is valid. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9)
-
-
10. A method comprising:
-
configuring an access transaction generated by a processor having a first execution mode and a second execution mode;
generating configuration settings that are stored in a configuration storage including an execution mode identifier that is asserted as an execution mode signal to indicate the processor is operating in the first execution mode, the configuration settings further including subsystem memory range settings, a memory base value, and a memory length value, a combination of at least the base and length values to define a protected memory area in a memory external to the processor that is accessible to the processor in the first execution modes and the configuration settings to define an un-protected memory area that is accessible to the processor in the second execution mode, wherein the processor in the second execution mode cannot access the protected memory area, the access transaction including access information including a physical address;
defining a protected memory zone in the protected memory area defined by a subsystem memory range setting;
defining an un-protected memory zone in the un-protected memory area; and
checking the access transaction using at least one of the configuration settings and the access information to determine if the access transaction is valid. - View Dependent Claims (11, 12, 13, 14, 15, 16, 17, 18)
-
-
19. A machine-readable medium having stored thereon instructions, which when executed by a machine, cause the machine to perform the following operations comprising:
-
configuring an access transaction generated by a processor having a first execution mode and a second execution mode;
generating configuration settings that are stored in a configuration storage including an execution mode identifier that is asserted as an execution mode signal to indicate the processor is operating in the first execution mode, the configuration settings further including subsystem memory range settings, a memory base value, and a memory length value, a combination of at least the base and length values to define a protected memory area in a memory external to the processor that is accessible to the processor in the first execution mode, and the configuration settings to define an un-protected memory area that is accessible to the processor in the second execution mode, wherein the processor in the second execution mode cannot access the protected memory area, the access transaction including access information including a physical address;
defining a protected memory zone in the protected memory area defined by a subsystem memory range setting;
defining an un-protected memory zone in the un-protected memory area; and
checking the access transaction using at least one of the configuration settings and the access information to determine if the access transaction is valid. - View Dependent Claims (20, 21, 22, 23, 24, 25, 26, 27)
-
-
28. A system comprising:
-
a chipset;
a memory coupled to the chipset;
a processor coupled to the chipset and the memory having an access manager, the processor having a first execution mode and a second execution mode, the processor generating an access transaction having access information, the access manager comprising;
a configuration storage to store configuration settings to configure an access transaction generated by a processor having a first execution mode and a second execution mode, the configuration storage to store an execution mode identifier that is asserted as an execution mode signal to indicate the processor is operating in the first execution mode, the configuration settings including subsystem memory range settings, a memory base value, and a memory length value, a combination of at least the base and length values to define a protected memory area in a memory external to the processor that is accessible to the processor in the first execution model, and the configuration settings to define an un-protected memory area that is accessible to the processor in the second execution mode, wherein the processor in the second execution mode cannot access the protected memory area, the access transaction including access information including a physical address;
a protected memory zone in the protected memory area defined by a subsystem memory range setting;
an un-protected memory zone in the un-protected memory area; and
a memory zone access checking circuit coupled to the configuration storage to check the access transaction using at least one of the configuration settings and the access information to determine if the access transaction is valid and generating an access grant signal if the transaction is valid. - View Dependent Claims (29, 30, 31, 32, 33, 34, 35, 36)
-
Specification