ACCESS TYPE PROTECTION OF MEMORY RESERVED FOR USE BY PROCESSOR LOGIC

• US 20140189261A1
• Filed: 12/28/2012
• Published: 07/03/2014
• Est. Priority Date: 12/28/2012
• Status: Active Grant

• Current Assignee: Intel Corporation
• Original Assignee: Alex Berenzon, Geoffrey S. Strongin, Gideon Gerzon, Gur Hildesheim, Iris Sorani, Ittai Anati, Shlomo Raikin
• Inventors: ANATI, ITTAI, GERZON, GIDEON, HILDESHEIM, GUR, RAIKIN, SHLOMO, SHAFI, HISHAM, BERENZON, ALEX, STRONGIN, GEOFFREY S., SORANI, IRIS
• Granted Patent: US 9,720,843 B2
• Time in Patent Office: Days
• US Class Current: 711/152
• CPC Class Codes: G06F 12/1027 using associative or pseudo-associative address translation means, e.g. translation look-aside buffer [TLB]
• CPC Class Codes: G06F 12/1441 for a range
• CPC Class Codes: G06F 12/145 the protection being virtual, e.g. for virtual blocks or segments before a translation mechanism
• CPC Class Codes: G06F 2212/1052 Security improvement

Abstract

A processor of an aspect includes operation mode check logic to determine whether to allow an attempted access to an operation mode and access type protected memory based on an operation mode that is to indicate whether the attempted access is by an on-die processor logic. Access type check logic is to determine whether to allow the attempted access to the operation mode and access type protected memory based on an access type of the attempted access to the operation mode and access type protected memory. Protection logic is coupled with the operation mode check logic and is coupled with the access type check logic. The protection logic is to deny the attempted access to the operation mode and access type protected memory if at least one of the operation mode check logic and the access type check logic determines not to allow the attempted access.

Claims

1. A processor comprising:

operation mode check logic to determine whether to allow an attempted access to an operation mode and access type protected memory based on an operation mode that is to indicate whether the attempted access is by an on-die processor logic;

access type check logic to determine whether to allow the attempted access to the operation mode and access type protected memory based on an access type of the attempted access to the operation mode and access type protected memory; and

protection logic coupled with the operation mode check logic, and coupled with the access type check logic, the protection logic to deny the attempted access to the operation mode and access type protected memory if at least one of the operation mode check logic and the access type check logic determines not to allow the attempted access.

2. The processor of claim 1, further comprising at least one register to indicate a set of one or more allowed access types for the operation mode and access type protected memory, and wherein the access type check logic is to determine whether to allow the attempted access by comparing the access type of the attempted access to the set of the one or more allowed access types indicated by the at least one register.

3. The processor of claim 2, wherein the at least one register is to explicitly specify a set of access types.

4. The processor of claim 2, wherein a set of access types are to be implicit to the at least one register.

5. The processor of claim 1, further comprising a translation lookaside buffer (TLB) having access type check and protection logic to check and protect against an attempted access with a physical address to the operation mode and access type protected memory via the TLB.

6. The processor of claim 5, wherein the access type check and protection logic of the TLB is to prevent the attempted access with the physical address to the operation mode and access type protected memory if an access type of the attempted access with the physical address is not among a set of one or more allowed access types that are to be indicated by a corresponding entry of the TLB.

7. The processor of claim 6, wherein paging attribute bits of the entry are to indicate the set of the one or more allowed access types, and wherein corresponding paging attribute bits in corresponding positions in other entries are to be used for virtual to physical address translations and for virtual address protection by one or more of an operating system and a virtual machine monitor.

8. The processor of claim 6, wherein bits of the entry that are to indicate the set of the one or more allowed access types are different than paging attribute bits of the entry that are to be used for virtual to physical address translations.

9. The processor of claim 1, wherein the operation mode check logic is to determine to allow the attempted access if the operation mode indicates that the attempted access is by the on-die processor logic and is to determine not to allow the attempted access if the operation mode indicates the attempted access is by executing software.

10. The processor of claim 1, further comprising logic to determine that a physical address of the attempted access is within the operation mode and access type protected memory by determining whether the physical address is within a plurality of other operation mode protected memories and evaluating a logical combination of whether the physical address is within the other operation mode protected memories.

11. The processor of claim 1, wherein the access type is one of read, write, and execute.

25. The processor of claim 1, wherein the operation mode check logic is to determine to allow the attempted access to the operation mode and access type protected memory if the operation mode indicates that the attempted access is by the on-die processor logic, and wherein the access type check logic is to determine to allow the attempted access to the operation mode and access type protected memory if the access type of the attempted access matches one or more allowed access types corresponding to the operation mode and access type protected memory.

12. A method comprising:

determining that an operation mode of an attempted access to an operation mode and access type protected memory is allowed because the attempted access is by an on-die processor logic;

determining that an access type of the attempted access to the operation mode and access type protected memory is not allowed; and

denying the attempted access to the operation mode and access type protected memory by the on-die processor logic based on the determination that the access type of the attempted access is not allowed.

13. The method of claim 12, wherein determining that the access type is not allowed comprises:

comparing the access type of the attempted access with all of one or more allowed access types indicated by at least one register that corresponds to the operation mode and access type protected memory; and

determining that the access type of the attempted access is different than all of the allowed access types indicated by the at least one register.

14. The method of claim 13, wherein the at least one register explicitly specifies a set of access types.

15. The method of claim 13, wherein a set of access types are implicit to the at least one register.

16. The method of claim 12, wherein determining that the access type is not allowed comprises determining that the access type of the attempted access does not match a set of one or more allowed access types indicated in an entry of a translation lookaside buffer (TLB) that corresponds to the attempted access.

17. The method of claim 16, wherein paging attribute bits of the entry indicate the one or more allowed access types, and wherein corresponding paging attribute bits of other entries are used for virtual to physical address translations and for virtual address protection by one or more of an operating system and a virtual machine monitor.

18. The method of claim 16, wherein bits of the entry that indicate the one or more allowed access types are different than paging attribute bits of the entry that are used for virtual to physical address translations.

19. The method of claim 12, wherein the operation mode of the attempted access would not be allowed if the attempted access was be executing software.

20. The method of claim 12, further comprising determining that a physical address of the attempted access is within the operation mode and access type protected memory by:

determining whether the physical address is within a plurality of other operation mode protected memories; and

evaluating a logical combination with the determinations of whether the physical address is within the other operation mode protected memories.

21. The method of claim 12, wherein determining comprises determining that at least one of a read, write, and execute access type is not allowed.

22. A system comprising:

a dynamic random access memory (DRAM) having an operation mode and access type protected memory region; and

a processor coupled with the DRAM, the processor including;

operation mode check logic to determine whether to allow an attempted access to the operation mode and access type protected memory region based on an operation mode that is to indicate whether the attempted access is by an on-die logic of the processor selected from hardware, firmware, and a combination thereof, wherein the operation mode check logic is to determine not to allow the attempted access if the attempted access is from software executing on the processor;

access type check logic to determine whether to allow the attempted access to the operation mode and access type protected memory region based on an access type of the attempted access to the operation mode and access type protected memory region, wherein the access type is selected from a read, a write, and an execute; and

protection logic coupled with the operation mode check logic, and coupled with the access type check logic, the protection logic to deny the attempted access to the operation mode and access type protected memory region if at least one of the operation mode check logic and the access type check logic determines not to allow the attempted access.

23. The system of claim 22, further comprising at least one register to indicate a set of one or more allowed access types for the operation mode and access type protected memory region.

24. The system of claim 22, further comprising a translation lookaside buffer (TLB) having access type check and protection logic to check and protect against an attempted access with a physical address to the operation mode and access type protected memory via the TLB.