Providing protected access to critical memory regions

• US 20080162849A1
• Filed: 12/27/2006
• Published: 07/03/2008
• Est. Priority Date: 12/27/2006
• Status: Active Grant

• Current Assignee: Intel Corporation
• Original Assignee: Intel Corporation
• Inventors: Savagaonkar, Uday, Khosravi, Hormuzd, Sahita, Ravi, Durham, David, Schluessler, Travis T., Nagabhushan, Gayathri
• Granted Patent: US 8,099,574 B2
• Time in Patent Office: Days
• US Class Current: 711/163
• CPC Class Codes: G06F 12/145 the protection being virtual, e.g. for virtual blocks or segments before a translation mechanism

Abstract

Hardware of a virtualized processor based system detecting a specified type of memory access to an identified region of memory and in response to the detecting generating an interrupt for a virtual machine monitor (VMM) of the virtualized processor based system.

Claims

1. A method comprising:

detecting, by hardware of a virtualized processor based system, a specified type of memory access to an identified region of memory; and

in response to the detecting, generating an interrupt for a virtual machine monitor (VMM) of the virtualized processor based system.

2. The method of claim 1 further comprising:

the VMM responding to the interrupt at least in part by identifying a source of the memory access and taking action based at least in part on the identifying, wherein the action further comprises at least one of

reconfiguring the hardware to allow the memory access if the source of the memory access is a valid memory location in a program;

denying the access if the source of the memory access is not a valid entry point in a program; and

performing a notification action.

3. The method of claim 1 further comprising identifying a range of memory locations in one or more registers;

and specifying a type of access for the range of memory locations in the one or more registers.

4. The method of claim 3 wherein the type of access further comprises one of a no access type, a read only access type, and a no protection access type.

5. The method of claim 1 further comprising configuring a memory controller, the configuring further comprising identifying a range of memory locations to the memory controller;

and specifying a type of access for the range of memory locations to the memory controller.

6. The method of claim 5 wherein the type of access further comprises one of a no access type, a read only access type, and a no protection access type.

7. The method of claim 5 wherein configuring the memory controller further comprises accessing the memory controller via a predefined I/O port.

8. The method of claim 6 wherein configuring the memory controller further comprises accessing the memory controller with an APIC transaction.

9. The method of claim 1 further comprising the VMM specifying a range of memory locations within which the VMM and a configuration area of the VMM are present, to the hardware and a type of access for the range of memory locations that at least does not allow modification of the memory locations of the range.

10. The method of claim 1 further comprising the VMM specifying a range of memory locations, within which a program to be protected is present, to the hardware and a type of access for the range of memory locations that at least does not allow modification of the memory locations of the range.

11. A processor based system comprising:

a processor, further comprising virtualization support logic;

a memory; and

hardware logic to detect a specified type of memory access to an identified region of memory and in response to the detecting to an interrupt for a virtual machine monitor (VMM) of the processor based system.

12. The system of claim 11 wherein the VMM is further to respond to the interrupt at least in part by identifying a source of the memory access and to take action based at least in part on the identifying, wherein the action further comprises one of

reconfiguring the hardware to allow the memory access if the source of the memory access is a valid entry point in a program;

denying the access if the source of the memory access is not a valid entry point in a program; and

performing a notification action.

13. The system of claim 11 wherein the hardware logic further comprises one or more registers of the processor

to define a range of memory locations;

and

to specify a type of access for the range of memory locations in the one or more registers.

14. The system of claim 13 wherein the type of access further comprises one of a no access type, a read only access type, and a no protection access type.

15. The system of claim 11 wherein the hardware logic further comprises a memory controller, wherein the identified region of memory comprises a range of memory locations identified to the memory controller by a configuration process;

and the specified type of memory access comprises a type of access for the range of memory locations to the memory controller identified to the memory controller by the configuration process.

19. The system of claim 11 wherein the VMM is further to specify a range of memory locations within which the VMM and a configuration area of the VMM are present, to the hardware logic and a type of access for the range of memory locations that at least does not allow modification of the memory locations of the range.

20. The system of claim 11 wherein the VMM is further to specify a range of memory locations, within which a program to be protected is present, to the hardware logic and a type of access for the range of memory locations that at least does not allow modification of the memory locations of the range.

16. The system of claim 16 wherein the type of access further comprises one of a no access type, a read only access type, and a no protection access type.

17. The system of claim 16 wherein the configuration process further comprises accessing the memory controller via a predefined I/O port.

18. The system of claim 17 wherein the configuration process further comprises accessing the memory controller with an APIC transaction.