Trusted execution and access protection for embedded memory
A semiconductor device includes, in various embodiments, a memory and a processor, with the processor configured to perform a permission check prior to execution of a memory-access instruction. The permission check comprises evaluating a permission attribute of the memory-access instruction and a permission attribute of a memory location to be accessed. The memory-access instruction is denied unless the permission attribute of the memory-access instruction is compatible with the permission attribute of the memory location to be accessed. In various embodiments, permission attributes are obtained by the processor from a one-time-programmable (OTP) memory module. In various embodiments, the permission attributes are determined based on a source address of the memory-access instruction and an address of the memory location to be accessed. In various embodiments, the OTP memory module stores permission settings that are based on the identity of suppliers for various portions of code stored in the memory.
1. A method comprising:
retrieving an instruction from a first memory address in memory;
determining a trust attribute that is associated with the instruction, wherein the trust attribute is one of a plurality of trust attributes stored in a one-time programmable (OTP) memory module;
identifying a second memory address in the memory to be accessed by a processor executing the instruction;
determining a protection attribute that is associated with of the second memory address, based at least upon the second memory address, wherein the protection attribute is one of a plurality of protection attributes stored in the OTP memory module;
comparing the trust attribute and the protection attribute; and
allowing execution of the instruction by the processor in response to a determination that the protection attribute of the second memory address is compatible with the trust attribute of the instruction.
2. The method of claim 1 , wherein:
the trust attribute is determined to be associated with the instruction based upon the trust attribute being associated with the first memory address.
3. The method of claim 1 , wherein:
the trust attribute is the determined to be associated with the instruction based upon the trust attribute being associated with a range of memory addresses that includes the first memory address.
4. The method of claim 1 , wherein:
the instruction is a firmware instruction,
the instruction has a type that is one of a group comprising: a load instruction type, a store instruction type, and a branch instruction type, and
the trust attribute is determined to be associated with the instruction based upon the type of the instruction.
5. The method of claim 1 , wherein the trust attribute of the instruction and the protection attribute of the second memory address each comprise security information stored in the one-time programmable (OTP) memory module.
6. The method of claim 5 , comprising:
fabricating the OTP memory module, the memory, and the processor onto a semiconductor substrate; and
loading the security information into the OTP memory module during a secure write operation period that immediately follows the fabricating, wherein the OTP memory module does not accept erase operations or overwrite operations.
7. The method of claim 6 , wherein:
the OTP memory module is configured to receive a first set of security information for a first set of memory addresses;
the OTP memory module is configured to receive the first set of security information from a first supplier under a first configuration procedure;
the OTP memory module is configured to receive a second set of security information for a second set of memory addresses; and
the OTP memory module is configured to receive the second set of security information from a second supplier under a second configuration procedure, wherein the first supplier is not authorized for the second configuration procedure.
8. The method of claim 5 , wherein:
the security information comprises at least one of a group comprising: a vendor identifier, a security category, a safety category, a priority category, a cost category, a customer identity, a user identify, user privilege, a token, a signature, and an indicator associated with the instruction.
9. The method of claim 1 , wherein:
the determination that the protection attribute is compatible with the trust attribute comprises a determination that a protection category identifier of the protection attribute matches a trust category identifier of the trust attribute, and
execution of the instruction is disallowed when the protection category identifier does not match the trust category identifier.
10. The method of claim 1 , wherein:
the determination that the protection attribute is compatible with the trust attribute comprises a determination that a trust level of the trust attribute matches or exceeds a protection level of the protection attribute, and
execution of the instruction is disallowed when the trust level is less than the protection level.
11. The method of claim 1 , wherein:
the protection attribute is associated with a range of memory addresses that includes the second memory address.
12. A system comprising:
a memory disposed on a semiconductor substrate;
a processor disposed on the semiconductor substrate; and
a protection interface configured between the memory and the processor, wherein the protection interface comprises a one-time programmable (OTP) memory module, the protection interface is configured to:
determine a trust attribute that is associated with an instruction fetched from the memory, wherein the trust attribute is one of memory module, a plurality of trust attributes stored in the OTP memory module,
determine a target address in the memory that is targeted by the instruction,
determine a protection attribute that is associated with the target address, wherein the protection attribute is one of a plurality of protection attributes stored in the OTP memory module,
compare the trust attribute and the protection attribute, and
allow execution of the instruction by the processor in response to a determination that the trust attribute is compatible with the protection attribute.
13. The system of claim 12 , wherein:
the protection interface further comprises a plurality of write-once registers that are configured to be written only once during a startup operation of the system;
the protection interface is configured to load the plurality of trust attributes and the plurality of protection attributes from the OTP memory module into the write-once registers during the startup operation; and
the protection interface is configured to obtain the trust attribute and the protection attribute from the write-once registers at a time after the a startup operation.
14. The system of claim 12 , wherein the processor is configured to:
initiate an exception handling routine if the trust attribute is incompatible with the protection attribute.
15. The system of claim 12 , wherein:
the instruction comprises a branching instruction, and
the target address indicates a location of a target instruction to be fetched.
16. The system of claim 12 , wherein:
the instruction comprises one of a load instruction and a store instruction, and
the target address indicates a target data location that is targeted by the instruction.
17. The system of claim 12 , wherein:
the protection interface is integrated into the processor.
18. A method comprising:
fetching an instruction from a memory to a processor;
determining a first permission attribute that is associated with the instruction, wherein the first permission attribute is one of a plurality of permission attributes stored in a protected section of memory;
determining a target address in the memory targeted by the instruction;
determining a second permission attribute that is associated with the target address, wherein the second permission attribute is one of the plurality of permission attributes stored in the protected section of memory;
granting access to the target address, by the processor, only if the first permission attribute of the instruction is compatible with the second permission attribute of the target address.
19. The method of claim 18 , wherein:
the first permission attribute is determined to be associated with the instruction based upon the first permission attribute being associated with an address of the instruction.
20. The method of claim 18 , wherein:
the memory and the processor are comprised within a system-on-a-chip semiconductor device.