Memory map protection mechanism

Patent metadata

Field	Value
Publication number	US-11429289-B2
Application number	US-202016832125-A
Country	US
Kind code	B2
Filing date	Mar 27, 2020
Priority date	Mar 27, 2020
Publication date	Aug 30, 2022
Grant date	Aug 30, 2022

Abstract

An apparatus to facilitate memory map security in a system on chip (SOC), is disclosed. The apparatus includes a micro controller to receive a request to grant a host device an access to a memory device and perform an alias checking process to verify accuracy of a memory map of the memory device.

First claim

What is claimed is:

1. A method to facilitate memory map security in a system on chip (SOC), comprising:
receiving a request at a micro controller from a Basic Input/output System (BIOS) firmware to grant a host device access to a memory device and perform access grant requests initiated by a boot firmware;
the micro controller performing an alias checking process to verify accuracy of a memory map of the memory device that indicates how the memory device is configured for use by interconnect protocol (IP) agents, comprising:
comparing a memory range across each of the IP agents; and
verifying that one or more rules are adhered to across the IP agents;

the micro controller performing an attestation process to verify the integrity of the memory map; and
storing the memory map in cryptographic hardware;
wherein the micro controller in the SOC attests to each of the IP agents that the memory map has been verified;
wherein the alias checking process and the attestation are performed by the micro controller prior to enabling the access to the memory device for the host device, and
wherein there is no range overlap in the memory range across all of the IP agents.

2. The method of claim 1 , further comprising the micro controller locking registers associated with the memory map.

3. The method of claim 1 , further comprising the micro controller permitting the host device to access the memory device upon a determination that the integrity has been verified.

4. The method of claim 3 , further comprising the micro controller blocking access to the host device upon a determination that the integrity has not been verified.

5. The method of claim 4 , wherein the micro controller blocks access to the host device via a hardware locking mechanism.

6. The method of claim 3 , further comprising the micro controller publishing the results of the attestation process to the BIOS firmware.

7. An apparatus to facilitate memory map security in a system on chip (SOC), comprising:
a memory device;
a plurality of interconnect protocol (IP) agents configured to access the memory device;
a micro controller to receive a request to grant a host device an access to the memory device and perform an alias checking process for each of the plurality of IP agents, the alias checking process verifies accuracy of a memory map of the memory device that indicates how the memory device is configured for use by the plurality of IP agents, wherein the micro controller performs the alias checking process by comparing a memory range across each of the IP agents and verifying that one or more rules are adhered to across the IP agents; and
cryptographic hardware to store the memory map;
wherein the micro controller in the SOC attests to each of the IP agents that the memory map has been verified;
wherein the alias checking process and the attestation are performed by the micro controller prior to enabling the access to the memory device for the host device, and
wherein there is no range overlap in the memory range across all of the plurality of IP agents.

8. The apparatus of claim 7 , wherein the micro controller locks registers associated with the memory map.

9. The apparatus of claim 8 , further comprising a Basic Input/output System (BIOS) firmware to program the memory map for the plurality of IP agents.

10. The apparatus of claim 9 , wherein the micro controller further performs an attestation process to verify the integrity of the memory map.

11. The apparatus of claim 10 , wherein the micro controller permits the host device to access the memory device upon a determination that the integrity has been verified.

12. The apparatus of claim 11 , wherein the micro controller blocks access to the host device upon a determination that the integrity has not been verified.

13. The apparatus of claim 12 , wherein the micro controller blocks access to the host device via a hardware locking mechanism.

14. The apparatus of claim 10 , wherein the micro controller publishes results of the attestation process to the BIOS firmware.

15. A computing device comprising:
a processor;
a memory device;
a Basic Input/output System (BIOS) firmware to program a memory map that indicates how the memory device is configured for a plurality of interconnect protocol (IP) agents;
an integrated on-chip system fabric coupled between the processor, the memory device and the BIOS firmware;
a micro controller, coupled to the system fabric, to receive a request from the BIOS firmware to grant the processor access to the memory device and perform access grant requests initiated by a boot firmware and perform an alias checking process to verify accuracy of the memory map of the memory device, including comparing a memory range across each of the IP agents and verifying that one or more rules are adhered to across the IP agents; and
cryptographic hardware to store the memory map, wherein the memory map indicates how the memory is configured for use by the plurality of IP agents;
wherein the micro controller in the computing device attests to each of the IP agents that the memory map has been verified;
wherein the alias checking process and the attestation are performed by the micro controller prior to enabling the access to the memory device for the processor, and
wherein there is no range overlap in the memory range across all of the IP agents.

16. The computing device of claim 15 , wherein the micro controller further performs an attestation process to verify the integrity of the memory map.

17. The computing device of claim 16 , wherein the micro controller permits the processor to access the memory device upon a determination that the integrity has been verified.

18. The computing device of claim 17 , wherein the micro controller blocks access to the processor upon a determination that the integrity has not been verified.

19. The computing device of claim 17 , wherein the micro controller blocks access to the processor via a hardware locking mechanism.

20. The computing device of claim 15 , further comprising the plurality of IP agents coupled to the system fabric.

Assignees

• Intel Corp

Inventors

• Kotary Karunakara
• Rajagopal Pannerkumar
• Dureja Sahil
• Haniffa Mohamed
• Dewan Prashant

Classifications

• G06F13/1668 Primary

  Details of memory controller · CPC title

• G06F3/0622 Primary

  in relation to access · CPC title

• G06F9/4403

  Processor initialisation · CPC title

• G06F3/0659

  Command handling arrangements, e.g. command buffers, queues, command scheduling · CPC title

• G06F3/0679

  Non-volatile semiconductor memory device, e.g. flash memory, one time programmable memory [OTP] · CPC title