Systems and methods for controlling access to secure debugging and profiling features of a computer system

Abstract

The present disclosure describes systems and methods for controlling access to secure debugging and profiling features of a computer system. Some illustrative embodiments include a system that includes a processor, and a memory coupled to the processor (the memory used to store information and an attribute associated with the stored information). At least one bit of the attribute determines a security level, selected from a plurality of security levels, of the stored information associated with the attribute. Asserting at least one other bit of the attribute enables exportation of the stored information from the computer system if the security level of the stored information is higher than at least one other security level of the plurality of security levels.

1 . A computer system, comprising: 
 a processor; and    a memory coupled to the processor, the memory used to store information and an attribute associated with the stored information;    wherein at least one bit of the attribute determines a security level, selected from a plurality of security levels, of the stored information associated with the attribute; and    wherein asserting at least one other bit of the attribute enables exportation of the stored information from the computer system if the security level of the stored information is higher than at least one other security level of the plurality of security levels.    
     
     
         2 . The computer system of  claim 1 , wherein the security level of the stored information is a secure level, and the at least one other security level is a non-secure level.  
     
     
         3 . The computer system of  claim 1 , further comprising a test interface configured to couple to a test workstation, wherein the test interface is capable of transmitting the exported stored information to the test workstation.  
     
     
         4 . The computer system of  claim 1 , wherein the stored information is an instruction that can be executed by the processor.  
     
     
         5 . The computer system of  claim 1 , wherein the stored information is data that can be read and processed by the processor.  
     
     
         6 . The computer system of  claim 1 , wherein the processor comprises a processing stage, and wherein a security level of the processing stage is the security level of the stored information if the stored information is an instruction loaded into the processing stage.  
     
     
         7 . The computer system of  claim 6 , wherein exportation from the computer system of the instruction loaded into the processing stage and state information of the processing stage is enabled if the at least one other bit of the attribute is asserted, and if the security level of the processing stage is higher than the at least one other security level.  
     
     
         8 . The computer system of  claim 7 , further comprising a test interface configured to couple to a test workstation, wherein the test interface is capable of transmitting the exported instruction and state information to the test workstation.  
     
     
         9 . The computer system of  claim 1 , wherein the processor comprises a register, and wherein a security level of the register is the security level of the stored information if the stored information is data loaded into the register.  
     
     
         10 . The computer system of  claim 9 , wherein exportation from the computer system of the data loaded into the register is enabled if the at least one other bit of the attribute is asserted, and if the security level of the register is higher than the at least one other security level.  
     
     
         11 . The computer system of  claim 10 , further comprising a test interface configured to couple to a test workstation, wherein the test interface is capable of transmitting the exported data to the test workstation.  
     
     
         12 . The computer system of  claim 1 , wherein a single semiconductor die comprises the computer system.  
     
     
         13 . A method, comprising: 
 receiving a request from a requestor to enable secure testing of a target application executing on a target system;    sending an authorization request to the target application; and    enabling secure testing of the target application and notifying the requestor that secure testing is allowed, if the target application allows the request.    
     
     
         14 . The method of  claim 13 , further comprising notifying the requestor that test access is denied if the target application rejects the request.  
     
     
         15 . The method of  claim 13 , further comprising: 
 storing the target application in a secure region of a memory within the target system;    storing a secure emulation bit in the memory; and    associating the secure emulation enable bit with the secure region of memory;    wherein enabling secure testing of the target application comprises asserting the secure emulation bit.    
     
     
         16 . The method of  claim 13 , wherein the target application is one of a plurality of applications executing on the target system, and wherein enabling secure testing of the target application does not comprise enabling secure testing of other applications of the plurality of applications.  
     
     
         17 . The method of  claim 13 , further comprising executing a kernel module of an operating system on the target system, wherein the kernel modules receives the request.  
     
     
         18 . An Information carrier medium comprising software that can be executed on a processor to cause the processor to: 
 receive a request from a requester to enable secure testing of a target application executing on a target system;    send an authorization request to the target application; and    enable secure testing of the target application and notify the requestor that secure testing is allowed, if the target application allows the request.    
     
     
         19 . The information carrier medium of  claim 18 , wherein the software further causes the processor to notify the requester that test access is denied if the target application rejects the request.  
     
     
         20 . The information carrier medium of  claim 18 , wherein the software further causes the processor to: 
 store the target application in a secure region of a memory within the target system;    store a secure emulation bit in the memory; and    associate the secure emulation enable bit with the secure region of memory;    wherein causing the processor to enable secure testing of the target application comprises asserting the secure emulation bit.    
     
     
         21 . The information carrier medium of  claim 18 , wherein the target application is one of a plurality of applications executing on the target system, and wherein causing the processor to enable secure testing of the target application does not comprise causing the processor to enable secure testing of other applications of the plurality of applications.  
     
     
         22 . The information carrier medium of  claim 18 , wherein the software further causes the processor to execute a kernel module of an operating system on the target system, wherein the kernel modules receives the request.  
     
     
         23 . A method, comprising: 
 receiving a request for secure test access to a target application executing within a target system, the request received by the target application;    attempting to validate the authentication credentials within the request using validation data stored within the target application; and    sending a response to the request indicating that secure test access is allowed if the authentication credentials are validated.    
     
     
         24 . The method of  claim 23 , further comprising sending a response to the request indicating that secure test access is denied if the authentication credentials are not validated.  
     
     
         25 . The method of  claim 23 , wherein the validation data comprises one or more public encryption keys and the authentication credentials comprise a digital signature generated using a private encryption key, and wherein attempting to validate the authentication credentials comprises using the one or more public decryption keys to validate the digital signature.  
     
     
         26 . The method of  claim 23 , further comprising configuring the target application to receive the request from a kernel module of an operating system executing on the target system.  
     
     
         27 . An Information carrier medium comprising software that can be executed on a processor to cause the processor to: 
 receive a request for secure test access to a target application executing within a target system, the request received by the target application;    attempt to validate the authentication credentials within the request using validation data stored within the target application; and    send a response to the request indicating that secure test access is allowed if the authentication credentials are validated.    
     
     
         28 . The information carrier medium of  claim 27 , wherein the software further causes the processor to send a response to the request indicating that secure test access is denied if the authentication credentials are not validated.  
     
     
         29 . The information carrier medium of  claim 27 , wherein the validation data comprises one or more public encryption keys and the authentication credentials comprise a digital signature generated using a private encryption key, and wherein causing the processor to attempt to validate the authentication credentials comprises using the one or more public decryption keys to validate the digital signature.  
     
     
         30 . The information carrier medium of  claim 27 , wherein the software further causes the processor to configure the target application to receive the request from a kernel module of an operating system executing on the target system.  
     
     
         31 . A method, comprising: 
 receiving a request from a user to securely test a target application;    sending a request to a target system to securely test the target application, the request comprising authentication credentials; and    receiving test data from the target application if a response is received to the request sent to the target system indicating that test access to the target application is allowed.    
     
     
         32 . The method of  claim 31 , wherein no test data is received from the target application if a response to the request sent to the target system is received indicating that test access to the target application is denied.  
     
     
         33 . The method of  claim 31 , further comprising generating the authentication credentials by creating a digital signature based upon a private encryption key.  
     
     
         34 . An Information carrier medium comprising software that can be executed on a processor to cause the processor to: 
 receive a request from a user to securely test a target application;    send a request to a target system to securely test the target application, the request comprising authentication credentials; and    receive test data from the target application if a response is received to the request sent to the target system indicating that test access to the target application is allowed.    
     
     
         35 . The information carrier medium of  claim 34 , wherein no test data is received from the target application if a response to the request sent to the target system is received indicating that test access to the target application is denied.  
     
     
         36 . The information carrier medium of  claim 34 , wherein the software further causes the processor to generate the authentication credentials by creating a digital signature based upon a private encryption key.  
     
     
         37 . A system for debugging and profiling a computer system, comprising: 
 a target computer system comprising a processor, wherein an operating system executes on the processor and a target application and a kernel execute within the operating system on the processor, and further comprising a memory coupled to the processor, wherein the target application and a page attribute table are stored in the memory; and    a test workstation coupled to the target system, wherein a debug and profiling application executes on the test workstation;    wherein the kernel asserts a bit within an entry in the page attribute table, the entry associated with the location in memory where the target application is stored, and the assertion enables the target application to provide test information to the debug and profiling application; and    wherein the target application is stored in a secure region of memory and executes one the processor in a secure mode.    
     
     
         38 . The system of  claim 37 , wherein the target application authorizes the kernel to assert the bit within the page attribute table entry.  
     
     
         39 . The system of  claim 37 , wherein the debug and profiling application initiates the request to enable the target application to provide test information to the debug and profiling application.