Scalable memory protection mechanism
An apparatus to protect contents of a memory region is presented. In one embodiment, the apparatus includes a non-volatile memory, memory check logic to generate check values for protected memory regions, and comparison logic to compare stored check values from the non-volatile memory with generated check values from the memory check logic. The apparatus also includes security logic to prevent executing code in the protected memory regions if the comparison logic detects a mismatch between the stored check values and the generated check values.
1. An apparatus, comprising:
memory check logic circuitry to generate first error checking information from program code after the program code has been loaded into a protected region of a system memory and during execution of the program code from the protected region of the system memory, wherein the memory check logic circuitry is to calculate the first error checking information from the protected region of system memory for every Nth memory location; and
comparison logic circuitry comprising a first input and a second input, the first input to receive the first error checking information, the second input to receive second error checking information, the second error checking information retrieved from a non volatile memory and including an image of the program code, the comparison logic circuitry to generate an error signal if the comparison logic circuitry detects a mismatch between the first error checking information and the second error checking information; and,
circuitry to generate the second error checking information in response to an update of the program code prior to the loading and execution of the program code and to store the second error checking information in the non volatile memory.
2. The apparatus of claim 1 wherein the system memory comprises a volatile memory.
3. The apparatus of claim 1 wherein the program code comprises one or more of:
firmware;
BIOS;
a boot loader;
a manageability engine;
a driver; and
an OS kernel.
4. The apparatus of claim 1 wherein the error signal is to stall and/or throttle execution of the program code from system memory.
5. The apparatus of claim 1 wherein the memory check logic circuitry and the comparison logic circuitry are integrated into a memory controller.
6. A computing system, comprising:
a) a plurality of processing cores;
b) a system memory, the system memory to include protected regions;
c) a memory controller coupled between one or more of the plurality of processing cores and the system memory, the memory controller further comprising:
i) memory check logic circuitry to generate first error checking information from program code after the program code has been loaded into a protected region of the system memory and during execution of the program code from the protected region of the system memory, wherein the memory check logic circuitry is to calculate the first error checking information from the protected region of system memory for every Nth memory location; and
ii) comparison logic circuitry comprising a first input and a second input, the first input to receive the first error checking information, the second input to receive second error checking information, the second error checking information retrieved from a non volatile memory and including an image of the program code, the comparison logic circuitry to generate an error signal if the comparison logic circuitry detects a mismatch between the first error checking information and the second error checking information;
iii) circuitry to generate the second error checking information in response to an update of the program code prior to the loading and execution of the program code and to store the second error checking information in the non volatile memory.
7. The computing system of claim 6 wherein the system memory comprises volatile memory.
8. The computing system of claim 6 wherein the program code comprises one or more of:
firmware;
BIOS;
a boot loader;
a manageability engine;
a driver; and
an OS kernel.
9. The computing system of claim 6 wherein the error signal is to stall and/or throttle execution of the program code from system memory.
10. The computing system of claim 6 wherein the memory check logic circuitry and the comparison logic circuitry are integrated into a memory controller.
11. A method, comprising:
generating second error checking information in response to an update of program code prior to the loading and execution of the program code;
storing the second error checking information in a non volatile memory;
loading the program code into a protected region of system memory and executing the program code from the protected region of system memory;
detecting a read of the program code that is executing from the protected region of system memory;
calculating first error checking information from the program code read from the protected region of system memory for every Nth memory location;
reading the second error checking information for the program code from the non volatile memory
comparing the first error checking information with the second error checking information; and,
generating an error signal in response to the comparing resulting in a mismatch.
12. The method of claim 11 further comprising throttling and/or stalling execution of the program code in response to the error signal.
13. The method of claim 11 wherein the program code comprises one or more:
firmware;
BIOS;
a boot loader;
a manageability engine;
a driver; and
an OS kernel.
14. The method of claim 11 wherein the detecting, calculating, comparing and generating are performed by a memory controller.
15. The method of claim 14 wherein the reading of second error checking information is performed by the memory controller.
16. The method of claim 11 wherein the system memory comprises volatile memory.