Patent ID: 9063891
Filing Date: 2015-06-23
Classification: G06F

Abstract:
1. A computer system, comprising: a peripheral device; a host bridge; a system memory coupled to the host bridge via a first access bus; a security processor coupled to the host bridge via a memory access bus that allows the security processor to access system memory and to access the peripheral device; a first security processor memory management unit coupled between the peripheral device and the host bridge; a processor comprising a processor core and a memory management unit (MMU), wherein the security processor is connected to the processor core via a management bus; and a second security processor memory management unit separate from the first security processor memory management unit, the second security processor memory management unit coupled between the processor and the host bridge via a memory access bus, and connected to the security processor by a control bus, wherein the management bus, the control bus, and the memory access bus are separate buses; wherein the security processor programs the first security processor memory management unit via the memory access bus to specify a first restricted range of physical addresses in the system memory that the peripheral device is not permitted to access, wherein the security processor programs the second security processor memory management unit via the control bus to specify a second restricted range of physical addresses in the system memory that the processor core is not permitted to access, and wherein the first security processor memory management unit processes access requests, from the peripheral device, to access system memory; and denies access requests from the peripheral device that are determined to be within the first restricted range.