Abstract:
A memory system in accordance with the invention includes a programmable non-volatile memory that contains a security indication and program instructions. A volatile register is also provided. Memory interface logic circuitry operates responsive to the contents of the volatile register, to selectively allow access to the memory. Security indication copying circuitry receives a reset signal for the memory system. In response to the reset signal, the copying circuitry causes the security indication to be copied into the volatile register as the contents thereof.

Description:
TECHNICAL FIELD 
     The present invention relates to security for programmable non-volatile memories (PNVM) and, in particular, to such a memory and associated circuitry equipped to handle and act upon, in a secure manner, a security status data stored within the memory itself. 
     BACKGROUND 
     Programmable non-volatile memories (e.g. electrically erasable programmable read-only memory and flash memory circuits) are well-known. In some applications, such as in control of safety functions in automobiles, security circuitry for read/write protection of the contents of PNVM circuits is commonly used. In this way, end-consumers are prevented from altering the contents of these memories and causing potentially life-threatening conditions. For example, security circuitry would commonly be used to protect the contents of an PNVM containing a program to control a vehicle&#39;s anti-lock brake system. 
     Conventionally, such security circuitry includes non-volatile security register circuitry, separate from the PNVM memory array itself, and the contents of which determine the security status of the PNVM contents. A major disadvantage of using non-volatile register circuitry for security functions is that it uses a large amount of chip area, and also that it requires special complex circuitry apart from the memory circuitry itself. 
     SUMMARY 
     A memory system in accordance with the invention includes a non-volatile memory to contain a security indication and program instructions. A volatile register is also provided. 
     Memory interface logic circuitry operates responsive to the contents of the volatile register, to selectively allow access to the memory. Security indication copying circuitry receives a reset signal for the memory system. In response to the reset signal, the copying circuitry causes the security indication to be copied into the volatile register as the contents thereof. 
    
    
     BRIEF DESCRIPTION OF FIGURES 
     FIG. 1 illustrates an embodiment of the invention in block form. 
     FIG. 2 is a timing diagram that illustrates the operation of the FIG. 1 system. 
    
    
     DETAILED DESCRIPTION 
     In accordance with the invention, a memory is provided having a plurality of addressable memory locations, one of which addressable for holding security data for the memory. The security of the memory depends on the security data. In particular, associated interface circuitry controls access to the memory based upon the security data. 
     A particular embodiment in accordance with the invention is disclosed in FIG.  1 . As shown in FIG. 1, a flash memory array  102  includes a security “word” location  104 . (As used herein, “word” is not meant to imply any particular bit-length of the security data or of the location in which it is stored.) As will be seen in greater detail later with reference to the timing diagram of FIG. 2, upon reset but before any other memory fetch is allowed, the contents of the security word location  104  is provided from the memory  102  into a volatile register  106  external to the memory array  102 . Because the register  102  is volatile, it does not require the complex circuitry of the conventional non-volatile security register circuitry. Based on the security word in the volatile register, “write enable”  107   a  and “read enable”  107   b  signals are generated. 
     Flash memory array interface logic  108  includes within it combining circuitry (e.g., AND logic) to combine the “write enable”  107   a  and “read enable”  107   b  signals with memory write request  109   a  and read request  109   b  signals, respectively, to generate appropriate memory control signals  111  for accessing the flash memory array  110 . While the FIG. 1 embodiment shows the memory system having a flash memory array  102  that includes the security word  104  and another flash memory array  110  that includes program instructions, it is within the scope of the invention for the security word and the memory to be secured to be within a single memory array. 
     The security word location  104  itself is protected from being erased if any of the security features are enabled, as indicated by the content of the security word in the security word location  104 . That is, as discussed above, the contents of the security word location  104  are latched into the volatile register  106  upon reset and before any other memory fetch is allowed. As shown schematically in FIG. 1, AND circuitry combines the write enable  107   a  and read enable  107   b  signals together to generate a security word erase enable signal  114 . Thus, it can be seen that only if the security word in the volatile register  106  indicates both write enable and read enable can the security word in the security word location  104  of the flash memory array  102  be erased. 
     The operation of the FIG. 1 circuit is now explained in greater detail with reference to the FIG. 2 timing diagram. In FIG. 2, the reset_z signal  202  is the active low external reset input. The g_reset signal is the active high internal reset input going to all blocks. The gadp[ 20 : 0 ] signal  206  is the instruction fetch address. The fldmls_se signal  208 , when active, enables the sense amplifier of the memory array containing the security bits to transfer the security bits to the volatile register  106 . 
     Now, turning to FIG. 2, at point  252  the external reset signal goes inactive, signalling that the circuit is to go out of reset. At point  254 , some time later, the g_reset signal  204  goes inactive, bringing the blocks of the circuit  100  out of reset. What happens between point  252  and point  254  is significant. 
     In particular, the gadp[ 20 : 0 ] signal is the instruction fetch address. At point  256 , the first address is ready for the instruction to be fetched. Notably, point  256  is after point  254 . That is, in the interim between points  252  and  254 , the security bits are being read from the security word  104  of the memory  102  into the volatile register  106 . The fldmls_se signal  208  enables the sense amplifier of the memory  102  holding the security word  104 . The high period (between  258  and  260 ) is the period during which the security word  104  is being read out of the memory  102 . 
     There are some test modes available on the chip to test its functionality. One is to supply instructions from an external source rather than executing instructions stored in the program memory array so that any instruction sequence can be executed, not limited to what is in the memory array. Another is to allow direct access to the non-volatile memory array (i.e. provide address inputs, read/write control signals and data I/O port on various device pins) to treat it like a standard memory. This allows one to isolate and interface directly to the memory array and make memory testing much easier and faster, as the memory array does not have to be accessed through read/write operations by the CPU. Test mode is usually entered through a set of input pins being in a certain state. 
     The problem is that if this test mode is entered this way, and the memory test mode allows direct access to the memory, the security feature would be bypassed as the memory is controlled from external pins, and therefore the internal logic is not able to load the security word into the volatile register. Therefore, the test mode logic is made so that this memory test mode is not entered until after reset, i.e. after the security word has been loaded into the volatile latch); thereafter, the security feature has been set up properly and then all accesses to the memory in this test mode are made subject to the security status. 
     It should be noted that, in general, the memory being protected includes program instructions. However, the memory could also include constant data, such as a look-up table. In one embodiment, the write protection prevents any further write to the memory. As for read protection, in one embodiment, the read protection only prevents reading of the memory in certain modes like test mode, but it does not prevent the CPU from reading the memory and executing the instructions (as it would not be particularly meaningful or useful to prevent the CPU from reading the memory to execute instructions). 
     It should also be noted that, also for security reasons, even though reading a piece of data out of the memory array, including the security word, requires only one cycle, the (security word read) is made to be multiple cycles long (longer than the number of cycles for a normal read access) to ensure the security word is read out properly. In one embodiment, 32 cycles was used, but only because that signal already existed in the chip for another purpose. This prevents someone from defeating the read by reading the security word out with a clock that is out of specification (e.g., with a faster than expected clock).