Protection scheme for embedded code
A code protection scheme for controlling access to a memory region in an integrated circuit includes a processor with an instruction pipeline that includes multiple processing stages. A first processing stage receives one or more instructions. A second processing stage receives address information identifying a protected memory region of the memory from the first processing stage and protection information for an identified protected memory region. The protection information indicates a protection state assigned to each protected memory region. Based on the instruction type of the received instruction and the protection information associated with a particular protected memory region, the second processing stage determines whether to enable or disable access to the particular protected memory region by the processor or other external host.
1. An integrated circuit comprising a memory and a processor, the memory comprising one or more memory regions and the processor comprising:
a protection bit management element configured to receive protection setting information from a secured bus and generate protection information that specifies a unique protection bit corresponding to a memory region of the one or more memory regions;
a plurality of processing stages for processing instructions retrieved from the memory; and
a commit processing stage, of the plurality of processing stages configured to:
receive address information from a previous processing stage of the plurality of processing stages, the address information identifying a protected memory region of the one or more memory regions;
determine the protection state of the protected memory region in accordance with a corresponding protection bit derived from the protection information;
control a state of one or more switches included in the commit processing stage based at least in part on the determined protection state for the protected memory region; and
regulate access to the protected memory region using the one or more switches.
2. The integrated circuit of claim 1 , wherein the protected memory region is associated with an instruction received from the previous processing stage.
3. The integrated circuit of claim 2 , wherein the commit processing stage is further configured to control the state of the one or more switches included in the commit processing stage based at least in part on an instruction type of the instruction received from the previous processing stage.
4. The integrated circuit of claim 3 , wherein, for an instruction received from the previous processing stage having a memory access type, the commit processing stage is configured to have the one or more switches in a first state to disable access to the protected memory region when the determined protection state for the protected memory region is set, and have the one or more switches in a second state to enable access to the protected memory region when the protection state for the protected memory region is not set.
5. The integrated circuit of claim 3 , wherein, for instructions having a memory access type, the commit processing stage is configured to:
disable access to the protected memory region when the protection state assigned to the protected memory region is set; and
generate an exception based on a code protection usage mode of the protected memory region.
6. The integrated circuit of claim 1 , wherein the protection bit management element is comprised of circuit elements shared with other portions of the integrated circuit.
7. The integrated circuit of claim 1 , wherein the commit processing stage is further configured to regulate access to the protected memory region using the one or more switches by permitting load and store access to the protected memory region when the corresponding protection bit has a first state.
8. The integrated circuit of claim 1 , wherein the commit processing stage is further configured to regulate access to the protected memory region using the one or more switches by not permitting load and store access to the protected memory region when the corresponding protection bit has a second state.
9. The integrated circuit of claim 1 , wherein the integrated circuit is configured to modify the protection setting information for the protected memory region when the processor is an idle state.
10. A method of controlling access to one or more regions of a memory in an integrated circuit, the integrated circuit comprising an instruction pipeline comprised of a plurality of processing stages, the method comprising:
receiving protection setting information from a secured bus;
generating protection information that specifies a unique protection bit corresponding to a memory region of the one or more memory regions;
receiving by a commit processing stage, of the plurality of processing stages, address information from a previous processing stage of the plurality of processing stages, the address information identifying a protected memory region of the one or more memory regions;
determining the protection state of the protected memory region in accordance with a corresponding protection bit derived from the protection information;
controlling a state of one or more switches included in the commit processing stage based at least in part on the determined protection state; and
regulating access to the protected memory region using the one or more switches.
11. The method of claim 10 , wherein the protected memory region is associated with an instruction received from the previous processing stage.
12. The method of claim 11 , further comprising controlling a state of one or more switches included in the commit processing stage based at least in part on an instruction type of the instruction received from the previous processing stage.
13. The method of claim 12 , wherein, for an instruction received from the previous processing stage having a memory access type, setting the one or more switches in a first state to disable access to the protected memory region when the determined protection state for the protected memory region is set, and setting the one or more switches in a second state to enable access to the protected memory region when the protection state for the protected memory region is not set.
14. The method of claim 13 , further comprising, for instructions having a memory access type:
disabling access to the protected memory region when the protection state assigned to the protected memory region is set; and
generating an exception based on a code protection usage mode of the protected memory region.
15. The method of claim 10 , wherein the protection bit management element is comprised of circuit elements shared with other portions of the integrated circuit.
16. The method of claim 10 , further comprising modifying, by the integrated circuit, protection information settings for the protected memory region when the processor is an idle state.
17. The method of claim 10 , further comprising regulating access to the protected memory region using the one or more switches by permitting load and store access to the protected memory region when the corresponding protection bit has a first state.
18. The method of claim 10 , further comprising regulating access to the protected memory region using the one or more switches by not permitting load and store access to the protected memory region when the corresponding protection bit has a second state.