Method and apparatus for protecting flash memory

• US 6,363,463 B1
• Filed: 04/15/1998
• Issued: 03/26/2002
• Est. Priority Date: 06/28/1996
• Status: Expired due to Term

• Current Assignee: Intel Corporation
• Original Assignee: Intel Corporation
• Inventors: Mattison, Phillip E.
• Primary Examiner(s): Kim, Matthew
• Assistant Examiner(s): ANDERSON, MATTHEW D
• Application Number:
  US09/060,679
• Time in Patent Office: 1,441 Days
• Field of Search: 711/103, 711/163, 711/164, 713/202
• US Class Current: 711/164
• CPC Class Codes: G06F 12/1408 by using cryptography for digital transmission H04L9/00
• CPC Class Codes: G06F 12/1433 for a module or a part of a module
• CPC Class Codes: G06F 21/572 Secure firmware programming, e.g. of basic input output system [BIOS]
• CPC Class Codes: G11C 16/102 External programming circuits, e.g. EPROM programmers; In-circuit programming or reprogramming; EPROM emulators
• CPC Class Codes: G11C 16/105 Circuits or methods for updating contents of nonvolatile memory, especially with 'security' features to ensure reliable replacement, i.e. preventing that old data is lost before new data is reliably written
• CPC Class Codes: G11C 16/22 Safety or protection circuits preventing unauthorised or accidental access to memory cells

Abstract

In a computer system including a processor, a system memory, a flash memory, and a memory controller, memory address/window detector coupled to the processor, the memory controller, a first input of a OR logic gate and a first input of an AND gate. The OR logic gate has an output coupled to the memory controller and a second input for receiving a system memory access enable signal. Also included is a memory window control coupled to the system memory, the memory controller, the flash memory, the memory address/window detector, an output of a NOT logic gate and a first input of another AND logic gate. The additional AND logic gate has a second input for receiving a flash memory programming enable signal. A system memory access enable register is included and is coupled to an output of the first AND logic gate, a second input of the OR logic gate, and an input of the NOT logic gate. The memory window control is only accessible when the system memory access enable register is set to disabled. A flash memory programming enable register is included where it is coupled to an output of the additional AND logic gate. Also included is a flash memory programming circuit that is coupled to the flash memory programming enable register and the flash memory. The flash memory programming enable register is disabled if said system memory access enable register is enabled.

Claims

1. In a computer system having a processor, a system memory, a flash memory, a memory controller, an apparatus comprising:

a memory address/window detector coupled to said processor, said memory controller, a first input of a first logic gate and a first input of a second logic gate, said first logic gate having an output coupled to said memory controller and a second input for receiving a system memory access enable signal;

a memory window control coupled to said system memory, said memory controller, said flash memory, said memory address/window detector, an output of a third logic gate and a first input of a fourth logic gate, said fourth logic gate having a second input for receiving a flash memory programming enable signal;

a system memory access enable register coupled to an output of said second logic gate, a second input of said first logic gate, and an input of said third logic gate, wherein said memory window control is only accessible when said system memory access enable register is set to disabled;

a flash memory programming enable register coupled to an output of said fourth logic gate; and

a flash memory programming circuit coupled to said flash memory programming enable register and said flash memory, wherein said flash memory programming enable register is disabled if said system memory access enable register is set to enabled.

2. The apparatus of claim 1, where said first logic gate is an OR gate.

3. The apparatus of claim 1, where said second logic gate is an AND gate.

4. The apparatus of claim 1, where said third logic gate is a NOT gate.

5. The apparatus of claim 1, where said fourth logic gate is an AND gate.

6. The apparatus of claim 1, where said system memory includes a cache memory.

7. The apparatus of claim 1, where said memory window control includes a set of registers.

8. The apparatus of claim 7, where said set of registers includes a base register and a limit register.

9. A memory controller comprising:

a first input for receiving an access enable signal; and

logic for limiting access by an electronic device to a predetermined portion of a system memory by disabling the access enable signal, wherein if the predetermined portion is all of the system memory allowing the electronic device to only access a flash memory.

10. The memory controller of claim 9, where the logic is configured to limit access by the electronic device by prohibiting translation of a request pertaining to an address space used to access any portion of the system memory which is outside of the predetermined portion.

11. The memory controller of claim 9, where the logic includes a system memory access enable register coupled to the first input.

12. The memory controller of claim 11, where the logic further includes a memory address detector coupled to the first input of the memory controller.

13. The memory controller of claim 12, where the memory address detector monitors addresses accessed by the electronic device and allows software obtained from a flash memory to modify the contents of the system memory access enable register.

14. The memory controller of claim 9, where the memory controller further comprises:

a first package containing the logic and having the first input; and

a second package containing the system memory.

15. The memory controller of claim 9, where the system memory is contained in a package that is coupled to the memory controller.

16. The memory controller of claim 9, where the electronic device is a processor.

17. A system comprising:

a system memory containing a flash memory upgrade program, wherein said flash memory upgrade program contains a BIOS image;

a flash memory protection unit coupled to the system having a first input for receiving an access enable signal; and

logic for limiting access to the flash memory upgrade program by flash upgrade program contained in the system memory.

18. The system of claim 17, where the flash memory upgrade program includes a new BIOS image to replace a current BIOS image in a flash memory.

19. The system of claim 18, where the flash memory upgrade program includes a digital signature being a hash value of at least the new flash memory image encrypted with a private key of a vendor of the flash memory.

20. The system of claim 17, where the logic limits access by other electronic devices to the system memory.

21. A method comprising:

writing a set of instructions to a non-volatile memory if the instructions comprise an authenticating digital signature.

22. The method of claim 21, further comprising reading the instructions from a system memory.

23. The method of claim 22, further comprising initializing a memory controller so that only the portion of the system memory comprising the set of instructions is read.

24. The method of claim 23, wherein initializing a memory controller includes:

loading a base register with a starting address; and

loading a limit register with a value corresponding to the length of the set of instructions.

25. The method of claim 21, further comprising loading the set of instructions into a system memory.

26. The method of claim 21, wherein writing a set of instructions to a non-volatile memory includes writing the set of instructions to a memory comprising flash memory.

27. An apparatus comprising:

a processor;

a non-volatile memory coupled to the processor;

a system memory coupled to the processor to store a set of instructions; and

a memory controller adapted to write at least a portion of the set of instructions from the system memory to the non-volatile memory if the set of instructions comprise an authenticating digital signature.

28. The apparatus of claim 27, wherein the memory controller is further adapted to access only the portion of the system memory comprising the set of instructions.

29. The apparatus of claim 27, wherein the non-volatile memory comprises flash memory.

30. An article comprising:

a storage medium having stored thereon instructions, that, when executed by a computing platform, results in;

writing a set of instructions to a non-volatile memory if the instructions comprise an authenticating digital signature.

31. The article of claim 30, wherein the instructions, when executed, further result in reading the instructions from a system memory.

32. The article of claim 31, wherein the instructions, when executed, further result in initializing a memory controller so that only the portion of the system memory comprising the set of instructions is read.

33. The article of claim 30, wherein the instructions, when executed, further result in loading the set of instructions into a system memory.