Protected configuration space in a protected environment

• US 20050022002A1
• Filed: 06/25/2004
• Published: 01/27/2005
• Est. Priority Date: 06/12/2002
• Status: Active Grant

• Current Assignee: David I. Poisner
• Original Assignee: David I. Poisner
• Inventors: Poisner, David I.
• Granted Patent: US 7,366,849 B2
• Time in Patent Office: Days
• US Class Current: 726/26
• CPC Class Codes: G06F 12/1441 for a range
• CPC Class Codes: G06F 12/1458 by checking the subject access rights

Abstract

A protected configuration space is implemented as at least one range of memory addresses that are mapped to logic external to system memory. The memory addresses access logic that performs control and status operations pertaining to a protected operating environment. Some of the addresses may access protected configuration registers. Commands having destination addresses within the protected configuration space may not be completed if the commands are not issued by a processor, or if the commands are not part of a group of one or more designated protected commands. A separately addressable non-protected configuration space may also be implemented, accessible by processors, non-processors and/or non-protected commands.

Claims

1. An apparatus, comprising:

an interface to communicate with at least one processor; and

a first set of registers coupled to the interface and accessible within a first predetermined range of memory addresses, the first set of registers to include control information and status information for a protected operating environment.

2. The apparatus of claim 1, wherein:

the first predetermined range of memory addresses are accessible by the at least one processor and are inaccessible by non-processor devices.

3. The apparatus of claim 1, further comprising:

control logic coupled between the interface and the first set of registers;

wherein the control logic is to direct commands addressed to one or more addresses within the first predetermined range of memory addresses to the first set of registers.

4. The apparatus of claim 3, wherein:

the control logic includes first and second modes of operation;

the control logic in the first mode is to accept protected commands addressed to the first predetermined range of memory addresses and is to reject non-protected commands addressed to the first predetermined range of memory addresses; and

the control logic in the second mode is to accept the non-protected commands addressed to the first predetermined range of memory addresses.

5. The apparatus of claim 4, wherein:

the control logic is to switch the control logic from the first mode to the second mode responsive to a first protected command and is to switch the control logic from the second mode to the first mode responsive to a second protected command.

6. The apparatus of claim 1, wherein:

the control logic is to perform an operation not directed to the set of registers, responsive to accepting a particular command having a particular address within the first predetermined range of memory addresses.

7. The apparatus of claim 1, wherein:

the control logic includes a mapping of a particular address within the first predetermined range of memory addresses to a particular register in the first set of registers.

8. The apparatus of claim 1, further comprising:

a second set of registers coupled to the interface and accessible within a second predetermined range of memory addresses, the second set of registers to include control information and status information for a non-protected operating environment.

9. The apparatus of claim 8, wherein:

the second predetermined range of memory addresses are accessible by the at least one processor and are inaccessible by the non-processor devices.

10. The apparatus of claim 8, wherein:

the control logic includes a first mapping of a first particular address within the first predetermined range of memory addresses to a first particular register in the first set of registers and a second mapping of a second particular address within the second predetermined range of memory addresses to a second particular register in the second set of registers.

11. The apparatus of claim 8, wherein:

the second particular register is the first particular register.

12. A method, comprising:

issuing a protected command to a first memory address within a first range of memory addresses reserved for a protected configuration space;

redirecting the protected command from a memory to a logic circuit external to the memory; and

performing a first operation specified by the protected command within the logic circuit, responsive to determining the protected command has been issued by a processor.

13. The method of claim 12, further comprising:

rejecting the protected command responsive to determining the protected command has been issued by a non-processor device.

14. The method of claim 12, wherein:

said performing the first operation includes one of writing to a protected configuration register and reading from the protected configuration register.

15. The method of claim 12, wherein:

said performing the first operation excludes writing to a protected configuration register and excludes reading from the protected configuration register.

16. The method of claim 12, further comprising:

issuing a non-protected command to a second memory address within a second range of memory addresses reserved for a non-protected configuration space;

redirecting the non-protected command from the memory to the logic circuit;

performing a second operation specified by the non-protected command within the logic circuit responsive to the non-protected command being issued by the processor; and

rejecting the non-protected command responsive to the non-protected command being issued by a non-processor device.

17. The method of claim 16, wherein:

said performing a second operation includes one of writing to a non-protected configuration register and reading from the non-protected configuration register.

18. The method of claim 15, wherein:

said issuing the protected command, said redirecting the protected command, and said performing the first operation are included in a protected operating environment;

said issuing the non-protected command, said redirecting the non-protected command, and said performing the second operation are included in a non-protected operating environment; and

the protected operating environment and the non-protected operating environment operate concurrently.

19-28. -28. (Cancelled).