Memory protection for embedded controllers
View Patent ↗System and method for protecting data in a system including a main processor, an embedded controller, and a memory. In response to a power-on-reset (POR), access to the memory is enabled, e.g., access by the embedded controller. First data is read from the memory (e.g., by the embedded controller) in response to the enabling, where the first data are usable to perform security operations for the system prior to boot-up of the main processor. The first data are used, e.g., by the embedded controller, to perform one or more security operations for the system, then access to the memory, e.g., by the embedded controller, is disabled, where after the disabling the memory is not accessible, e.g., until the next POR initiates enablement.
1. A method for protecting data in a system, the method comprising:
in response to a power-on-reset, enabling access to a memory of the system, wherein said enabling access to the memory comprises:
providing a first control value to masking logic coupled to the memory, wherein the masking logic is configured to perform a first logical operation using the first control value and second data read from the memory, and wherein the first logical operation leaves the second data read from the memory unchanged;
reading first data from the memory in response to said enabling, wherein the first data are usable to perform security operations for the system prior to boot-up of a main processor in the system, wherein the system comprises an embedded controller, wherein the first data comprises initialization code for the system, wherein the initialization code has an address range, wherein said enabling access to the memory comprises enabling access to the address range in the memory;
after the first data are used to perform one or more security operations for the system, disabling access to the memory, wherein after said disabling the memory is not accessible at least until a subsequent power-on-reset, wherein said disabling access to the memory comprises:
providing a second control value to the masking logic, wherein the masking logic is configured to perform a second logical operation using the second control value and second data read from the memory, wherein the second logical operation masks the second data read from the memory, wherein said disabling access to the memory comprises disabling access to the address range of the memory, and wherein said providing the second control value to the masking logic comprises:
setting a third control value to enable said providing the second control value; and
subsequent to said setting the third control value, determining that the embedded controller is attempting to access the memory outside the address range, and generating an indication that the embedded controller is attempting to access the memory outside the address range; and
disabling access to the address range of the memory in response to said third control value and said indication.
2. The method of claim 1 , wherein the first data comprises one or more of:
a password; or
a key.
3. The method of claim 1 , further comprising:
using the first data to perform one or more security operations for the system, including executing initialization code for the system; and
wherein said disabling access to the memory comprises writing a set value to a memory element after executing the initialization code for the system to disable access to the memory.
4. The method of claim 1 , further comprising:
wherein said enabling access to the memory comprises enabling access to the memory by the embedded controller, wherein said reading the first data from the memory comprises the embedded controller reading the first data from the memory, and wherein said disabling access to the memory comprises disabling access to the memory by the embedded controller.
5. The method of claim 4 , further comprising:
determining if an address generated by the embedded controller is outside of the address range;
enabling protection of the memory in response to determining that the address generated by the embedded controller is outside of the address range, wherein said enabling protection is performed prior to said disabling access, wherein the memory is accessible after said enabling protection and prior to said disabling access;
wherein said disabling access is performed for addresses generated within the address range, wherein said disabling is performed after said enabling protection.
6. The method of claim 5 ,
wherein said disabling prevents the embedded controller from accessing the address range after having generated at least one address outside of the address range.
7. The method of claim 5 ,
wherein access to the memory is enabled for addresses generated outside of the address range.
8. The method of claim 5 , further comprising:
setting a read protect enable value in a memory element prior to said enabling protection of the memory, wherein said setting the read protect enable value allows said enabling protection of the memory.
9. The method of claim 1 , further comprising:
disabling debug access in response to the POR; and
enabling debug access in response to said disabling access to the memory by the embedded controller.
10. The method of claim 1 , wherein the embedded controller is a peripheral device controller for a computer system.
11. The method of claim 1 , wherein the embedded controller and the memory are comprised in a System-on-Chip (SoC).
12. A system, comprising:
a first memory which stores data;
an embedded controller coupled to the first memory;
a second memory, wherein the second memory is configured to store a first value that prevents access to the first memory, wherein the second memory includes an input configured to receive a signal indicating a power-on-reset generated within the system;
first logic coupled to the first memory and the second memory, wherein the first logic is configured to control access to the data in the first memory based on the first value stored in the second memory;
wherein the first logic is configured to determine if an address generated by the embedded controller is within an initialization address range;
wherein the first logic is configured to enable access to the first memory for addresses generated by the embedded controller within the initialization address range;
wherein, after the embedded controller generates at least one address outside of the initialization address range, the first logic is configured to disable access to the first memory for subsequent addresses generated by the embedded controller within the initialization address range,
wherein in response to a power-on-reset being generated, the second memory is configured to store a second value, wherein the first logic enables access to the first memory in response to the second value being stored in the second memory.
13. The system of claim 12 ,
wherein controlling access to the data comprises controlling access by the embedded controller to the data.
14. The system of claim 12 , wherein the first logic comprises:
a comparator, wherein the comparator has a first input configured to receive addresses generated by the embedded controller, wherein the comparator is configured to compare the addresses generated by the embedded controller with the initialization address range.
15. A system, comprising:
an embedded controller;
a first memory coupled to the embedded controller which stores initialization code and/or data for the embedded controller;
a second memory, wherein the second memory is configured to store a first value that enables prevention of access to the first memory, wherein the second memory includes an input configured to receive a signal indicating a power-on-reset generated within the system;
first logic coupled to the first memory and the second memory, wherein the first logic is configured to control access to the data in the first memory based on the first value stored in the second memory;
wherein in response to a power-on-reset being generated, the second memory is configured to store a second value, wherein the first logic enables access to the first memory in response to the second value being stored in the second memory.
wherein the first logic is configured to determine if an address generated by the embedded controller is within an initialization address range;
wherein the first logic is configured to enable access to the first memory for addresses generated by the embedded controller within the initialization address range;
wherein, after the power-on-reset and after the embedded controller generates at least one address outside of the initialization address range, the first logic is configured to disable access to the first memory for subsequent addresses generated by the embedded controller within the initialization address range.
16. The system of claim 15 ,
wherein the first logic is configured to enable access to the memory for addresses generated outside of the initialization address range.
17. A method for protecting data in a system, the method comprising:
in response to a power-on-reset, enabling access to a memory of the system, wherein the system comprises an embedded controller, wherein said enabling access to the memory comprises enabling access to the memory by the embedded controller;
reading first data from the memory in response to said enabling, wherein the first data are usable to perform security operations for the system prior to boot-up of a main processor in the system, wherein said reading the first data from memory comprises the embedded controller reading the first data from the memory;
after the first data are used to perform one or more security operations for the system, disabling access to the memory, wherein after said disabling the memory is not accessible at least until a subsequent power-on-reset (POR), and wherein said disabling access to the memory comprises disabling access to the memory by the embedded controller;
determining if an address generated by the embedded controller is outside of an initialization address range;
enabling protection of the memory in response to determining that the address generated by the embedded controller is outside of the initialization address range, wherein said enabling protection is performed prior to said disabling access, wherein the memory is accessible after said enabling protection and prior to said disabling access;
wherein said disabling access is performed for addresses generated within the initialization address range, wherein said disabling is performed after said enabling protection.
18. The method of claim 17 , wherein the first data comprises one or more of:
a password; or
a key.
19. The method of claim 17 , further comprising:
using the first data to perform one or more security operations for the system, including executing initialization code for the system; and
wherein said disabling access to the memory comprises writing a set value to a memory element after executing the initialization code for the system to disable access to the memory.
20. The method of claim 17 ,
wherein said disabling prevents the embedded controller from accessing the initialization address range after having generated at least one address outside of the initialization address range.
21. The method of claim 17 ,
wherein access to the memory is enabled for addresses generated outside of the initialization address range.
22. The method of claim 17 , further comprising:
setting a read protect enable value in a memory element prior to said enabling protection of the memory, wherein said setting the read protect enable value allows said enabling protection of the memory.
23. The method of claim 17 , further comprising:
disabling debug access in response to the POR; and
enabling debug access in response to said disabling access to the memory by the embedded controller.
24. The method of claim 17 , wherein the embedded controller is a peripheral device controller for a computer system.
25. The method of claim 17 , wherein the embedded controller and the memory are comprised in a System-on-Chip (SoC).