Flash memory protection scheme for secured shared BIOS implementation in personal computers with an embedded controller

A method for performing a boot operation in a Host and in an embedded controller of a computerized system employing a shared memory, said method comprising the steps of:

• providing access paths to said shared memory, to said Host, and to said embedded controller;
• providing an arbitration device for allocating access paths to said shared memory;
• partitioning said shared memory into separate blocks, each of which is designated for storing different types of data;
• permitting access, via said arbitration device, to said separate parts of said shared memory by using an access control unit that enables/disables access to predetermined portions of said shared memory by at least one of said access paths;
• resetting an operation of said embedded controller by performing the following steps:
• (a) whenever a “flash touched/untouched” flag is set, performing a validity test to determine validity of said parts of the said shared memory;
• (b) whenever said parts of said shared memory are valid, performing the following steps:
• (1) setting said “flash touched/untouched” flag to a untouched state;
• (2) enabling said Host's read access from at least one Host section;
• (3) issuing a “no problem”, indication to said Host;
• (4) changing a mode of operation of said embedded controller into a normal operation mode;
• (c) whenever said parts of said shared memory are invalid, performing the following steps:
• (1) issuing a “problem” indication to said Host;
• and
• (2) starting a recovery procedure;
• (d) whenever said “flash touched/untouched” flag is not set, performing steps (b) (2) through (b) (4) above;
• and resetting an operation of said Host by performing the following steps:
• (a) performing basic initializations of said Host;
• (b) waiting for an indication from said embedded controller indicating if said parts of said shared memory are valid or invalid;
• (c) if a “problem” indication is issued by said embedded controller, performing a recovery procedure and resetting operations of said Host and said embedded controller;
• and
• (d) if a “no problem” indication is issued by said embedded controller, continuing a boot process for said Host.

The apparatus as claimed in claim 24, wherein said memory device comprises:

• a first block for storing information and code required for an operation of one of:
• said Host and said embedded controller, said first block comprising:
• a section for storing said Host's boot code;
• a section for storing said embedded controller's boot code;
• and
• remaining sections for storing remaining information and code required for the operation of one of:
• said Host and said embedded controller;
• and
• a second block for storing protection information related to access permission to said memory device and remaining information and code required for the operation of said embedded controller, said second block comprising:
• a section for storing protection information;
• and
• a section of the remaining sections for storing remaining information and code required for the operation of said embedded controller.

The apparatus as claimed in claim 24, wherein said access permission comprises access permissions for a Host access path, comprising:

• “read only” for Host access to said Host boot section in said first block;
• “no access” for said Host to said embedded controller boot section in said first block and to said second block, such that any operation in said sections is prohibited to said Host;
• “read, write and erase” for Host access to other sections of said first block to permit operations;
• wherein said access permission comprises access permissions for said embedded controller comprising:
• “read only” access permission for an embedded controller access path to said embedded controller boot section, in said first block, and to said section containing protection information, in said second block;
• and
• “read, write and erase” permission for an embedded controller access path to said Host boot section and to remaining sections in said first block, and to remaining sections in said second block.