Locking mechanism override and disable for personal computer ROM access protection

• US 7,003,676 B1
• Filed: 05/30/2001
• Issued: 02/21/2006
• Est. Priority Date: 05/10/2001
• Status: Expired due to Fees

• Current Assignee: GlobalFoundries, Inc.
• Original Assignee: Advanced Micro Devices, Inc.
• Inventors: Gulick, Dale E., Weber, Frederick D.
• Primary Examiner(s): Zand, Kambiz
• Application Number:
  US09/871,084
• Time in Patent Office: 1,728 Days
• Field of Search: 713/182, 713/194, 713/200, 714/30, 714/758
• US Class Current: 713/194
• CPC Class Codes: G06F 21/74 operating in dual or compartmented mode, i.e. at least one secure mode
• CPC Class Codes: G06F 21/79 in semiconductor storage media, e.g. directly-addressable memories
• CPC Class Codes: G06F 21/82 Protecting input, output or interconnection devices

Abstract

A method and system for overriding access locks on secure assets in a computer system. The system includes a processor and a device coupled to the processor. The device includes one or more sub-devices, one or more access locks, and an access lock override register that stores one or more access lock override bits, including a lock override bit. The one or more access locks are configured to prevent access to the one or more sub-devices when the one or more access locks are engaged. Access to the one or more sub-devices is not allowed when the lock override bit is set. The method includes requesting a memory transaction for one or more memory addresses and determining a lock status for the one or more memory addresses. The method also includes returning the lock status for the one or more memory addresses. The method may determine if the lock status for the one or more memory address can be changed. The method may change the lock status of the one or more memory addresses to allow the memory transaction.

Claims

1. A system, comprising:

a processor configured to operate in an operating mode, wherein the operating mode is one of a plurality of operating modes including a secure operating mode;

one or more secured assets coupled to the processor; and

security hardware configured to control access to the secured assets dependant upon the operating mode of the processor, wherein the security hardware is configured to allow access to the secure assets in the secure operating mode, and wherein the security hardware includes a lock override register configured to deny access to the secure assets when a lock override bit is set.

2. The system of claim 1, wherein the secured assets comprise one or more of the group consisting of:

a random number generator,

a secure management register,

a monotonic counter, and

a secure memory.

3. The system of claim 1, wherein the security hardware comprises:

an initiation register, wherein an entry in the initiation register is an indication to change the operating mode of the processor to the secure mode.

4. The system of claim 1, wherein the secure operating mode comprises system management mode.

5. The system of claim 1, wherein the security hardware comprises:

a kick-out timer configured to provide an indication to the processor to exit the secure mode.

6. The system of claim 5, wherein the security hardware further comprises:

a re-initiation timer configured to provide an indication to the processor to enter the secure mode.

7. The system of claim 1, wherein the security hardware comprises:

a duration timer configured to operate while the processor is operating in the secure mode, wherein the duration timer is configured to provide an indication of how long the processor is in the secure mode.

8. The system of claim 7, wherein the security hardware comprises:

a kick-out timer configured to provide an indication to the processor to exit the secure mode.

9. The system of claim 8, wherein the kick-out timer and the duration timer comprise a single timer.

10. The system of claim 8, wherein the security hardware further comprises:

a re-initiation timer configured to provide an indication to the processor to re-enter the secure mode.

11. The system of claim 1, wherein the security hardware comprises:

mailbox RAM configured to store input and output data, wherein the mailbox RAM includes an inbox for storing input data for the one or more secured assets and an outbox for storing output data from the one or more secured assets.

12. The system of claim 11, wherein the input data for the one or more secured assets is addressed to the inbox of the mailbox RAM.

13. The system of claim 11, wherein the output data from the one or more secured assets is retrieved from an address at the outbox of the mailbox RAM.

14. The system of claim 11, wherein the security hardware further comprises:

access filters configured to provide input data or access requests to the inbox of the mailbox RAM if the processor is operating in the secure operating mode, wherein the access filters are further configured not to provide input data to the inbox of the mailbox RAM if the processor is not operating in the secure operating mode, and wherein the access filters are further configured to provide a predetermined response upon receipt of said access requests if the processor is not operating in the secure operating mode.

15. The system of claim 1, wherein the security hardware further comprises:

scratchpad RAM, wherein each of the one or more secured assets is configured to access the scratchpad RAM for the storage of data.

16. The system of claim 1, further comprising:

a memory for storing data, wherein the memory is coupled to the processor and the processor is configured to store and retrieve data from the memory in all of the plurality of operating modes.

17. The system of claim 1, wherein the security hardware comprises:

access filters configured to provide access requests to one or more of the one or more secured assets when the processor is operating in the secure operating mode, wherein the access filters are further configured to provide a predetermined response if the processor is not operating in the secure operating mode.

18. The system of claim 17, wherein the security hardware further comprises:

access locks coupled to the access filters, wherein the access locks are configured to disable the access filters in an unlocked mode.

19. The system of claim 1, further comprising:

a battery, wherein the battery provides reserve power to the one or more secured assets.

20. The system of claim 1, further comprising:

a battery, wherein the battery provides reserve power to the security hardware.

21. A method for providing access to secured assets in a computer system, the method comprising:

operating the computer system in a first operating mode different from a secure operating mode;

restricting access to the secured assets in response to the computer system being in the first operating mode; and

determining if the secured assets would be accessible if the computer system were in the secure operating mode;

requesting access to the secured assets while in the first operating mode;

receiving access to the secured assets while in the first operating mode; and

permitting access to the secured assets in response to receiving access to the secured assets while in the first operating mode.

22. The method as set forth in claim 21, wherein the secured assets comprise a secure memory, and wherein permitting access to the secured assets comprises reading data from or writing data to the secure memory.

23. The method as set forth in claim 21, wherein the secured assets comprise a random number generator, and wherein permitting access to the secured assets comprises requesting a random number from the random number generator and receiving the random number from the random number generator.

24. The method as set forth in claim 21, wherein the secured assets comprise a monotonic counter, and wherein permitting access to the secured assets comprises requesting a value stored in the monotonic counter and receiving the value stored in the monotonic counter.

25. The method as set forth in claim 21, wherein permitting access to the secured assets comprises reading output data from or writing input data to a mailbox RAM from which the secure assets write the output data and read the input data.

26. The method as set forth in claim 21, further comprising:

receiving an access request for one of the secured assets;

receiving the access request to the secured assets while in the first operating mode; and

wherein restricting access to the secured assets further comprises responding with a predetermined response in response to receiving the access request for one of the secured assets, and in response to the access request to the secured assets while in the first operating mode being denied.

27. The method as set forth in claim 21, further comprising:

setting an access lock to an unlocked state; and

wherein permitting access to the secured assets further comprises overriding restricting access to the secured assets and providing the access request to a selected one of the secured assets in response to receiving the access request for the selected one of the secured assets and in response to setting the access lock to the unlocked state.

28. The method of claim 21, wherein determining if the secured assets would be accessible if the computer system were in the secure operating mode comprises determining if a lock is set to indicate that secured assets are accessible when in the secure operating mode.

29. A computer readable program storage device encoded with instructions that, when executed by a computer system performs a method for providing access to secured assets in the computer system, the method comprising:

operating the computer system in a first operating mode different from a secure operating mode;

restricting access to the secured assets in response to the computer system being in the first operating mode; and

determining if the secured assets would be accessible if the computer system were in the secure operating mode;

requesting access to the secured assets while in the first operating mode;

receiving access to the secured assets while in the first operating mode; and

permitting access to the secured assets in response to receiving access to the secured assets while in the first operating mode.

30. The computer readable program storage device as set forth in claim 29, wherein the secured assets comprise a secure memory, and wherein permitting access to the secured assets comprises reading data from or writing data to the secure memory.

31. The computer readable program storage device as set forth in claim 29, wherein the secured assets comprise a random number generator, and wherein permitting access to the secured assets comprises requesting a random number from the random number generator and receiving the random number from the random number generator.

32. The computer readable program storage device as set forth in claim 29, wherein the secured assets comprise a monotonic counter, and wherein permitting access to the secured assets comprises requesting a value stored in the monotonic counter and receiving the value stored in the monotonic counter.

33. The computer readable program storage device as set forth in claim 29, wherein permitting access to the secured assets comprises reading output data from or writing input data to a mailbox RAM from which the secure assets write the output data and read the input data.

34. The computer readable program storage device as set forth in claim 29, the method further comprising:

receiving an access request for one of the secured assets;

receiving the access request to the secured assets while in the first operating mode; and

wherein restricting access to the secured assets further comprises responding with a predetermined response in response to receiving the access request for one of the secured assets, and in response to the access request to the secured assets while in the first operating mode being denied.

35. The method as set forth in claim 29, the method further comprising:

setting an access lock to an unlocked state; and

wherein permitting access to the secured assets further comprises overriding restricting access to the secured assets and providing the access request to a selected one of the secured assets in response to receiving the access request for the selected one of the secured assets and in response to setting the access lock to the unlocked state.

36. The method of claim 29, wherein determining if the secured assets would be accessible if the computer system were in the secure operating mode comprises determining if a lock is set to indicate that secured assets are accessible when in the secure operating mode.