Data processing system with secure memory sharing

In a data processing system comprising a trusted execution environment (TEE), a normal execution environment (NEE), and a shared memory external to the TEE, wherein the TEE includes a memory encryption circuit corresponding to only one of the TEE and the NEE, a method comprising:

• receiving, by an access controller within the TEE configured to control access to the shared memory, a write access request generated by a requestor located within the TEE or the NEE;
• and
• in response to the access controller allowing the requested write access to the shared memory, providing corresponding write data to the shared memory,
• wherein:
• if the requestor is located in the only one of the TEE and the NEE, encrypting the write data by the memory encryption circuit prior to providing the write data to the shared memory,
• otherwise, providing the write data as unencrypted plain data to the shared memory.

A data processing system comprising:

• a shared memory;
• a trusted execution environment (TEE) including a first requestor, a first local interconnect, an access controller, and a set of memory encryption circuits, the first requestor and the access controller coupled to the first local interconnect, and the access controller configured to allow or deny access requests to the shared memory, wherein the shared memory is external to the TEE;
• and
• a set of normal execution environments (NEEs), each configured to communicate with the TEE via a corresponding set of address lines and a corresponding set of data lines,
• wherein a corresponding memory encryption circuit of the set of memory encryption circuits is configured to encrypt write data corresponding to allowed access requests to the shared memory generated by any requestor in the set of NEEs prior to the TEE providing the write data for storage into the shared memory, wherein any write data corresponding to allowed access requests to the shared memory generated by the first requestor is provided as plain write data, without any encryption nor decryption, for storage into the shared memory.