System and method for providing kernel intrusion prevention and notification
View Patent ↗A memory protection module includes comparison logic that has a write-once window CSR that stores a memory address range, and window protection logic. The comparison logic receives a memory write transaction, determines a memory address of the memory write transaction, and provides an indication as to whether or not the memory address is included in the memory address range. The window protection logic receives the memory transaction, receives the indication from the comparison logic, allows the memory write transaction to proceed in response to the indication indicating that the memory address is not included in the memory address range, and drops the memory write transaction in response to the indication indicating that the memory address is included in the memory address range.
1. An information handling system, comprising:
a cache;
a memory;
a processor including a first memory protection module that includes:
first window protection logic; and
first comparison logic that includes a first window control status register (CSR) that is configured as a write-once register and that stores a memory address range, wherein the first comparison logic:
receives a first memory write transaction from the processor to the memory;
determines a first memory address of the first memory write transaction; and
provides a first indication as to whether or not the first memory address is included in the memory address range; and
a cache coherency module including a second memory protection that includes:
second window protection logic; and
second comparison logic that includes a second window CSR that is configured as a write-once register and that stores the memory address range, wherein the second comparison logic:
receives a second memory write transaction from the processor to the cache;
determines a second memory address of the second memory write transaction; and
provides a second indication as to whether or not the second memory address is included in the memory address range;
wherein the first window protection logic:
receives the first memory transaction from the memory interface;
receives the first indication from the first comparison logic;
allows the first memory write transaction to proceed in response to the first indication indicating that the first memory address is not included in the memory address range; and
drops the first memory write transaction in response to the first indication indicating that the first memory address is included in the memory address range; and
wherein the second window protection logic:
receives the second memory transaction;
receives the second indication from the second comparison logic;
allows the second memory write transaction to proceed in response to the second indication indicating that the second memory address is not included in the memory address range; and
drops the second memory write transaction in response to the second indication indicating that the second memory address is included in the memory address range.
2. The information handling system of claim 1 , further comprising:
an input/output device; and
a direct memory access (DMA) device including a third memory protection that includes:
third window protection logic; and
third comparison logic that includes a third window CSR that is configured as a write-once register and that stores the memory address range, wherein the third comparison logic:
receives a third memory write transaction from the input/output device to the memory;
determines a third memory address of the third memory write transaction; and
provides a third indication as to whether or not the third memory address is included in the memory address range; and
wherein the third window protection logic:
receives the third memory transaction;
receives the third indication from the third comparison logic;
allows the third memory write transaction to proceed in response to the third indication indicating that the third memory address is not included in the memory address range; and
drops the third memory write transaction in response to the third indication indicating that the third memory address is included in the memory address range.
3. The information handling system of claim 1 , wherein the first window protection logic further provides a third indication that the memory write transaction has been dropped.
4. The information handling system of claim 3 , wherein the third indication comprises one of a processor interrupt and a machine check exception.
5. The information handling system of claim 1 , wherein the memory address range corresponds to an address range of a memory that stores operating system kernel code.
6. The information handling system of claim 1 , wherein the first comparison logic further:
receives a third memory write transaction to re-write the first window CSR; and
provides a third indication that the first memory protection module received an attempt to re-write the first window CSR.
7. The information handling system of claim 1 , wherein the first comparison logic further comprises a plurality of window CSRs, the plurality of window CSRs comprising the first window CSR.
8. A method, comprising:
receiving, by a first comparison logic of a first memory protection module of a processor, a first memory write transaction from the processor to a memory, wherein the first comparison logic includes a first window control status register (CSR) that is configured as a write-once register and that stores a memory address range;
determining, by the first comparison logic, a first memory address of the first memory write transaction;
providing, by the first comparison logic, a first indication as to whether or not the first memory address is included in the memory address range;
receiving, by a second comparison logic of a second memory protection module of a cache coherency module of the processor, a second memory write transaction from the processor to a cache, wherein the second comparison logic a second window CSR that is configured as a write-once register and that stores the memory address range, wherein the second comparison logic;
determining, by the second comparison logic, a second memory address of the second memory write transaction;
providing, by the second comparison logic, a second indication as to whether or not the second memory address is included in the memory address range;
receiving, by a first window protection logic of the first memory protection module, the first memory transaction from the memory interface;
receiving, by the first window protection logic, the first indication from the first comparison logic;
allowing, by the first window protection logic, the first memory write transaction to proceed in response to the first indication indicating that the first memory address is not included in the memory address range;
dropping, by the first window protection logic, the first memory write transaction in response to the first indication indicating that the first memory address is included in the memory address range;
receiving, by a second window protection logic of the second memory protection module, the second memory transaction;
receiving, by the second window protection logic, the second indication from the second comparison logic;
allowing, by the second window protection logic, the second memory write transaction to proceed in response to the second indication indicating that the second memory address is not included in the memory address range; and
dropping, by the second window protection logic, the second memory write transaction in response to the second indication indicating that the second memory address is included in the memory address range.
9. The method of claim 8 , further comprising:
receiving, by third comparison logic of a third memory protection module of a direct memory access (DMA) device, a third memory write transaction from the input/output device to the memory, wherein the third comparison logic includes a third window CSR that is configured as a write-once register and that stores the memory address range, wherein the third comparison logic;
determining, by the third comparison logic, a third memory address of the third memory write transaction;
providing, by the third comparison logic, a third indication as to whether or not the third memory address is included in the memory address range; and
receiving, by a third window protection logic of the third memory protection module, the third memory transaction;
receiving, by the third window protection logic, the third indication from the third comparison logic;
allowing, by the third window protection logic, the third memory write transaction to proceed in response to the third indication indicating that the third memory address is not included in the memory address range; and
dropping, by the third window protection logic, the third memory write transaction in response to the third indication indicating that the third memory address is included in the memory address range.
10. The method of claim 8 , further comprising:
providing, by the first window protection logic, a third indication that the memory write transaction has been dropped.
11. The method of claim 10 , wherein the third indication comprises one of a processor interrupt and a machine check exception.
12. The method of claim 8 , wherein the memory address range corresponds to an address range of a memory that stores operating system kernel code.
13. The method of claim 8 , further comprising:
receiving, by the first comparison logic, a third memory write transaction to re-write the first window CSR; and
providing, by the first comparison logic, a third indication that the first memory protection module received an attempt to re-write the first window CSR.
14. The method of claim 8 , wherein the first comparison logic further comprises a plurality of window CSRs, the plurality of window CSRs comprising the first window CSR.