# US 6,363,463 B1 · Method and apparatus for protecting flash memory

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 6,363,463 B1
- Document ID: US6363463B1
- Status: Granted
- Kind: B1
- Application number: 09/060,679
- Filed: 1998-04-15
- Granted: 2002-03-26
- Earliest claimed: 1996-06-28
- Assignees: Intel Corporation
- Inventors: Phillip E. Mattison
- Web page: https://patentgrep.com/patent/US6363463B1

## CPC

- G11C 16/22: Safety or protection circuits preventing unauthorised or accidental access to memory cells
- G06F 12/1408: {by using cryptography (for digital transmission H04L9/00)}
- G06F 12/1433: {for a module or a part of a module}
- G06F 21/572: {Secure firmware programming, e.g. of basic input output system [BIOS]}
- G11C 16/102: {External programming circuits, e.g. EPROM programmers; In-circuit programming or reprogramming; EPROM emulators}
- G11C 16/105: {Circuits or methods for updating contents of nonvolatile memory, especially with 'security' features to ensure reliable replacement, i.e. preventing that old data is lost before new data is reliably written}
- G11C: STATIC STORES (semiconductor memory devices H10B)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

In a computer system including a processor, a system memory, a flash memory, and a memory controller, memory address/window detector coupled to the processor, the memory controller, a first input of a OR logic gate and a first input of an AND gate. The OR logic gate has an output coupled to the memory controller and a second input for receiving a system memory access enable signal. Also included is a memory window control coupled to the system memory, the memory controller, the flash memory, the memory address/window detector, an output of a NOT logic gate and a first input of another AND logic gate. The additional AND logic gate has a second input for receiving a flash memory programming enable signal. A system memory access enable register is included and is coupled to an output of the first AND logic gate, a second input of the OR logic gate, and an input of the NOT logic gate. The memory window control is only accessible when the system memory access enable register is set to disabled. A flash memory programming enable register is included where it is coupled to an output of the additional AND logic gate. Also included is a flash memory programming circuit that is coupled to the flash memory programming enable register and the flash memory. The flash memory programming enable register is disabled if said system memory access enable register is enabled.

## Claims

### Claim 1

In a computer system having a processor, a system memory, a flash memory, a memory controller, an apparatus comprising:
a memory address/window detector coupled to said processor, said memory controller, a first input of a first logic gate and a first input of a second logic gate, said first logic gate having an output coupled to said memory controller and a second input for receiving a system memory access enable signal;
a memory window control coupled to said system memory, said memory controller, said flash memory, said memory address/window detector, an output of a third logic gate and a first input of a fourth logic gate, said fourth logic gate having a second input for receiving a flash memory programming enable signal;
a system memory access enable register coupled to an output of said second logic gate, a second input of said first logic gate, and an input of said third logic gate, wherein said memory window control is only accessible when said system memory access enable register is set to disabled;
a flash memory programming enable register coupled to an output of said fourth logic gate; and
a flash memory programming circuit coupled to said flash memory programming enable register and said flash memory, wherein said flash memory programming enable register is disabled if said system memory access enable register is set to enabled.

### Claim 2 (depends on 1)

The apparatus of claim 1, where said first logic gate is an OR gate.

### Claim 3 (depends on 1)

The apparatus of claim 1, where said second logic gate is an AND gate.

### Claim 4 (depends on 1)

The apparatus of claim 1, where said third logic gate is a NOT gate.

### Claim 5 (depends on 1)

The apparatus of claim 1, where said fourth logic gate is an AND gate.

### Claim 6 (depends on 1)

The apparatus of claim 1, where said system memory includes a cache memory.

### Claim 7 (depends on 1)

The apparatus of claim 1, where said memory window control includes a set of registers.

### Claim 8 (depends on 7)

The apparatus of claim 7, where said set of registers includes a base register and a limit register.

### Claim 9

A memory controller comprising:
a first input for receiving an access enable signal; and logic for limiting access by an electronic device to a predetermined portion of a system memory by disabling the access enable signal, wherein if the predetermined portion is all of the system memory allowing the electronic device to only access a flash memory.

### Claim 10 (depends on 9)

The memory controller of claim 9, where the logic is configured to limit access by the electronic device by prohibiting translation of a request pertaining to an address space used to access any portion of the system memory which is outside of the predetermined portion.

### Claim 11 (depends on 9)

The memory controller of claim 9, where the logic includes a system memory access enable register coupled to the first input.

### Claim 12 (depends on 11)

The memory controller of claim 11, where the logic further includes a memory address detector coupled to the first input of the memory controller.

### Claim 13 (depends on 12)

The memory controller of claim 12, where the memory address detector monitors addresses accessed by the electronic device and allows software obtained from a flash memory to modify the contents of the system memory access enable register.

### Claim 14 (depends on 9)

The memory controller of claim 9, where the memory controller further comprises:
a first package containing the logic and having the first input; and
a second package containing the system memory.

### Claim 15 (depends on 9)

The memory controller of claim 9, where the system memory is contained in a package that is coupled to the memory controller.

### Claim 16 (depends on 9)

The memory controller of claim 9, where the electronic device is a processor.

### Claim 17

A system comprising:
a system memory containing a flash memory upgrade program, wherein said flash memory upgrade program contains a BIOS image;
a flash memory protection unit coupled to the system having a first input for receiving an access enable signal; and logic for limiting access to the flash memory upgrade program by flash upgrade program contained in the system memory.

### Claim 18 (depends on 17)

The system of claim 17, where the flash memory upgrade program includes a new BIOS image to replace a current BIOS image in a flash memory.

### Claim 19 (depends on 18)

The system of claim 18, where the flash memory upgrade program includes a digital signature being a hash value of at least the new flash memory image encrypted with a private key of a vendor of the flash memory.

### Claim 20 (depends on 17)

The system of claim 17, where the logic limits access by other electronic devices to the system memory.

### Claim 21

A method comprising:
writing a set of instructions to a non-volatile memory if the instructions comprise an authenticating digital signature.

### Claim 22 (depends on 21)

The method of claim 21, further comprising reading the instructions from a system memory.

### Claim 23 (depends on 22)

The method of claim 22, further comprising initializing a memory controller so that only the portion of the system memory comprising the set of instructions is read.

### Claim 24 (depends on 23)

The method of claim 23, wherein initializing a memory controller includes:
loading a base register with a starting address; and
loading a limit register with a value corresponding to the length of the set of instructions.

### Claim 25 (depends on 21)

The method of claim 21, further comprising loading the set of instructions into a system memory.

### Claim 26 (depends on 21)

The method of claim 21, wherein writing a set of instructions to a non-volatile memory includes writing the set of instructions to a memory comprising flash memory.

### Claim 27

An apparatus comprising:
a processor;
a non-volatile memory coupled to the processor;
a system memory coupled to the processor to store a set of instructions; and
a memory controller adapted to write at least a portion of the set of instructions from the system memory to the non-volatile memory if the set of instructions comprise an authenticating digital signature.

### Claim 28 (depends on 27)

The apparatus of claim 27, wherein the memory controller is further adapted to access only the portion of the system memory comprising the set of instructions.

### Claim 29 (depends on 27)

The apparatus of claim 27, wherein the non-volatile memory comprises flash memory.

### Claim 30

An article comprising: a storage medium having stored thereon instructions, that, when executed by a computing platform, results in:
writing a set of instructions to a non-volatile memory if the instructions comprise an authenticating digital signature.

### Claim 31 (depends on 30)

The article of claim 30, wherein the instructions, when executed, further result in reading the instructions from a system memory.

### Claim 32 (depends on 31)

The article of claim 31, wherein the instructions, when executed, further result in initializing a memory controller so that only the portion of the system memory comprising the set of instructions is read.

### Claim 33 (depends on 30)

The article of claim 30, wherein the instructions, when executed, further result in loading the set of instructions into a system memory.