Apparatuses and methods with secure configuration update
One example securely updates an integrated circuit to mitigate undesirable modifications and this involves an application circuit accessing an external network while a (e.g., nonvolatile) program memory is write protected; and a reset-boot circuit resetting and booting the application circuit while access to the external network is disabled, and causing an update for the application circuit. In response to an indication that an update is downloaded for installation, the downloaded update is installed in the memory while access to the external network is disabled, and execution of the reset mode is permitted after the update is installed. Also, a retrieval module may download, in response to an indication that an update is not downloaded, an update provided via the external network while the memory is write-protected and thereby permitting execution of the reset mode after the update is downloaded.
1. An apparatus comprising:
an application-specific circuit to receive, while a nonvolatile memory circuit which has a programmed configuration is in a write-protection state and while access to an external network data-access circuit is enabled, an indication that an update corresponding to a change in the configuration is appropriate;
a reset-and-boot circuit to, in response to the indication, execute reset and boot the application-specific circuit while access to an external network data-access circuit is disabled, and, in response to the indication, to cause the application-specific circuit to operate consistent with an updated configuration which overrides the configuration previously programmed into the nonvolatile memory circuit;
a recovery circuit including
a circuit-based install module to cause, in response to an indication that an update is downloaded for installation, the downloaded update to be installed in the nonvolatile memory circuit while access to the external network data-access circuit is disabled, and to permit execution of the reset mode after the update is installed, and
a circuit-based retrieval module to download, in response to an indication that an update is not downloaded for installation, an update provided via the external network data-access circuit while the nonvolatile memory circuit is in the write-protection state, and to permit execution of the reset mode after the update is downloaded.
2. The apparatus of claim 1 , wherein the reset-and-boot circuit is further to disable the write-protection state and, in response to a reset action by the reset-and-boot circuit, the write-protection state is no longer enabled.
3. The apparatus of claim 1 , wherein the reset-and-boot circuit is to remove the nonvolatile memory circuit from the write-protection state by initiating a reset mode for the apparatus, and wherein, while the downloaded update is installed in the nonvolatile memory circuit.
4. The apparatus of claim 1 , wherein the circuit-based install module is further to conduct an internal check on whether the update is already downloaded for installation.
5. The apparatus of claim 1 , wherein the circuit-based retrieval module is further to enable access to external data and then to request an update from an external server and, in response to a communication from the external server, download the update provided via the external network data-access circuit.
6. The apparatus of claim 1 , wherein the nonvolatile memory circuit further includes a flash memory circuit, and wherein programmed configuration includes a resilient recovery image.
7. The apparatus of claim 1 , further including a system-on-chip (SoC) circuit including the application-specific circuit, the reset-and-boot circuit and the recovery circuit.
8. The apparatus of claim 1 , further including at least one Internet of Thing (IoT) device including circuitry to enable the IoT device to communicate over a broadband network.
9. The apparatus of claim 1 , further including communications circuitry to enable the apparatus device to communicate over a network.
10. The apparatus of claim 1 , further including an integrated circuit of which the application-specific circuit, the reset-and-boot circuit and the recovery circuit form a part, wherein the nonvolatile memory circuit includes
an external memory circuit situated external to the integrated circuit, including a resilient recovery image, and controlled by using a XOM mode which allows fetching access but not read-and/or-write access, in combination with a write-protection mode, and
an internal memory circuit, as part of the integrated circuit, including a first use-case region having a use-case image containing code for functional operation of the IC and including a second use-case region having a use-case image containing code for functional operation of the IC, the first and second use-case regions to be operably controlled by using a write-lock mode and the XOM mode,
wherein the resilient recovery image is updated by:
booting the resilient recovery image from the external memory circuit while the external memory circuit is in the write-protection state and while access to the external network data-access circuit is enabled,
downloading and validating the update as an update resilient recovery image to the second use-case region, and
rebooting into the update resilient recovery image while the external memory circuit is not in the write-protection state and while access to the external network data-access circuit is disabled and, based on whether the reboot is deemed successful, install the update resilient recovery image as a replacement for the resilient recovery image in the external memory circuit or reboot into the resilient recovery image in the external memory circuit to permit for another attempt in updating the resilient recovery image.
11. The apparatus of claim 10 , wherein the integrated circuit is to transfer, in response to the reboot being deemed successful, a copy of the use-case image from the first use-case region to the second use-case region.
12. The apparatus of claim 10 , wherein the use-case image containing code for functional operation of the IC in the second use-case region is a copy of the resilient recovery image.
13. The apparatus of claim 1 , further including an integrated circuit (IC) of which the application-specific circuit, the reset-and-boot circuit and the recovery circuit form a part, wherein the nonvolatile memory circuit includes an internal flash memory circuit as part of the integrated circuit, and the internal flash memory circuit including a first use-case region having a use-case image containing code for functional operation of the IC and having a resilient recovery image, and including a second use-case region also having a use-case image containing code for functional operation of the IC and having a resilient recovery image, the first and second use-case regions to be operably controlled by using a write-lock mode and an XOM mode which allows fetching access but not read-and/or-write access, in combination with a write-protection mode, wherein the resilient recovery image is updated by tracking versions of the use-case image containing code for functional operation of the IC and having a resilient recovery image in each of the first and second use-case regions.
14. The apparatus of claim 1 , further including an integrated circuit of which the application-specific circuit, the reset-and-boot circuit and the recovery circuit form a part, wherein the nonvolatile memory circuit includes
an external flash memory circuit situated external to the integrated circuit, including a resilient recovery image, and controlled by using a XOM mode which allows fetching access but not read-and/or-write access, in combination with a write-protection mode, and
an internal flash memory circuit, as part of the integrated circuit, including an SBL (secondary bootloader) region having an SBL which is combinable with a recent copy of the resilient recovery image, having a first use-case region, and including a second use-case region, the SBL region and the first and second use-case regions being operably controllable by using a write-lock mode and the XOM mode,
wherein the resilient recovery image is updated by:
booting the resilient recovery image from a copy in the first use-case region of the internal flash memory circuit while the nonvolatile memory circuit is in the write-protection state and while access to the external network data-access circuit is enabled,
downloading and validating the update as an update resilient recovery image to the external flash memory circuit, and
rebooting into the update resilient recovery image while the nonvolatile memory circuit is not in the write-protection state and while access to the external network data-access circuit is disabled and, based on whether the reboot is deemed successful, install the update resilient recovery image as a replacement first use-case region of the internal flash memory circuit and, if there is an indication of a failed update, reboot into the resilient recovery image in the external flash memory circuit to permit for another attempt in updating the resilient recovery image.
15. A method comprising:
storing a programmed configuration in a nonvolatile memory circuit of an integrated circuit;
operating an application-specific circuit, while the nonvolatile memory circuit is in a write-protection state and while access to an external network data-access circuit is enabled, consistent with the configuration programmed into the nonvolatile memory circuit and receive an indication that an update corresponding to a change in the configuration is appropriate;
executing a reset-and-boot circuit to, in response to the indication, execute reset and boot the application-specific circuit while access to an external network data-access circuit is disabled, and in response to the indication, to cause the application-specific circuit to operate consistent with an updated configuration which overrides the configuration previously programmed into the nonvolatile memory circuit; via a recovery circuit,
causing, in response to an indication that an update is downloaded for installation, the downloaded update to be installed in the nonvolatile memory circuit while access to the external network data-access circuit is disabled, and to permit execution of the reset mode after the update is installed, and
downloading, in response to an indication that an update is not downloaded for installation, an update provided via the external network data-access circuit while the nonvolatile memory circuit is in the write-protection state, and thereby permitting execution of the reset mode after the update is downloaded.
16. The method of claim 15 , wherein the nonvolatile memory circuit includes an external memory circuit situated external to the integrated circuit, including a resilient recovery image, and controlled by using a first mode which allows fetching access but not read-and/or-write access, in combination with a second, write-protection mode.
17. The method of claim 16 , wherein the nonvolatile memory circuit includes an internal memory circuit, as part of the integrated circuit, including a first use-case region having a use-case image containing code for functional operation of the IC and including a second use-case region having a use-case image containing code for functional operation of the IC, the first and second use-case regions to be operably controlled by using a write-lock mode.
18. The method of claim 17 , wherein at least one of the internal memory circuit and the external memory circuit is a flash-type memory circuit, and the use-case image containing code for functional operation of the IC in the second use-case region is a copy of the resilient recovery image.
19. The method of claim 15 , wherein the method further comprises removing the nonvolatile memory circuit from the write protection state by initiating a reset mode.
20. A non-transient computer storage medium containing instructions to be executed by a computer processor for carrying out a method including a set of steps comprising:
storing a programmed configuration in a nonvolatile memory circuit of an integrated circuit;
operating an application-specific circuit, while the nonvolatile memory circuit is in a write-protection state and while access to an external network data-access circuit is enabled, consistent with the configuration programmed into the nonvolatile memory circuit and receive an indication that an update corresponding to a change in the configuration is appropriate;
executing a reset-and-boot circuit to, in response to the indication, execute reset and boot the application-specific circuit while access to an external network data-access circuit is disabled, and, in response to the indication, to cause the application-specific circuit to operate consistent with an updated configuration which overrides the configuration previously programmed into the nonvolatile memory circuit;
via a recovery circuit,
causing, in response to an indication that an update is downloaded for installation, the downloaded update to be installed in the nonvolatile memory circuit while access to the external network data-access circuit is disabled, and to permit execution of the reset mode after the update is installed, and
downloading, in response to an indication that an update is not downloaded for installation, an update provided via the external network data-access circuit while the nonvolatile memory circuit is in the write-protection state, and thereby permitting execution of the reset mode after the update is downloaded.