What is the point of "software data protection" in a rewriteable ROM?

Question

I've been considering trying to hack an old '98 era motherboard. The ROM(I presume for the BIOS) is a Winbond W29C020-70. In it's datasheet, there is a thing called "Software-protected Data Write". The gist of it is that 3 specific bytes must be written to certain addresses before the ROM will allow you to write to it.

The values and addresses that need to be written are documented in the datasheet, and I don't believe there is a way to change these magic values. So, using this feature for security doesn't seem likely. I can't really think of any other reason for this feature to exist.

What is the point in this kind of feature?

Answer 1

The sequence of bytes is not for hiding the content from others, but to prevent accidental overwrites of data. You can accidentally write a byte to the EEPROM, but accidentally writing the three specific bytes in a row is much less likely.

And no, you can't change the bytes.

Answer 2

Could it be to prevent accidental writes from misbehaved (buggy) software?

The thinking could be that there is a low probability that a program will mistakenly output the magic bytes.

Answer 3

In many microprocessor systems, it's possible for a glitch to send the processor into a state which will overwrite all addressable memory. If a processor includes software interrupts or traps on invalid instructions, and the associated interrupt vector points to another software-interrupt or an invalid instruction, then the processor may respond to the trap by pushing some registers onto the stack, jumping to the trap address, pushing some registers, jumping to the trap address, etc. If the act of pushing registers overwrites the trap vector with the location of another instruction that causes a trap or software interrupt, this process may continue with the stack pointer repeatedly wrapping so as to repeatedly hit all addressable memory. Note that while some processors have stack-bounds registers and double-fault handlers to deal with the scenario where an attempt to push registers in response to one fault causes a stack fault, and may have logic to force a shutdown or hard reset in the event that another fault occurs before the double-fault handler takes control of the stack, many older and/or smaller processors have no such concept.

If a single store to the address space of a flash or EEPROM could suffice to obliterate the content stored therein, such a microprocessor glitch could render a product useless until its firmware chip could be replaced. Ignoring any requests to write or erase information which are not part of a proper command sequence greatly reduces the likelihood of accidental firmware via this mechanism.

Answer 4

And most likely, there are another 3 bytes (not documented) you can write to different addresses (not documented) to selectively enable or disable address mapping of memory cells.

To improve yield, they need to have a way of selecting good cells, and hiding bad cells. On modern flash memory, the validation and mapping is complex. On those old chips, it was simpler.