Register access white listing

摘要

A system employs a white list of authorized transactions to control access to system registers. In an embodiment, the white list is loaded into filter registers during system boot. Routing logic monitors a logical interconnect fabric of the system for register access requests. The routing logic parses source, destination information from a request to index the white list. If the white list includes an entry corresponding to the processing entity indicated in the source information and the register indicated in the destination information, the routing logic will permit the requested access.

主权项

1. A processor comprising:
a fetch unit to fetch instructions; a decode unit to decode instructions; at least one execution unit to execute instructions; and a filter logic to monitor a fabric coupled to the processor for register access requests, wherein the filter logic is to:
access data indicative of pairs of source and destination authorized for register access transactions, the data including:
a map including a plurality of entries, wherein each entry is to store a pair of source and destination and a corresponding range of authorized register addresses; anda key including a plurality of entries to store respective portions of the map to which a pair of source and destination are mapped, the plurality of entries to store a pair of source and destination, an offset within the map, and a number of authorized ranges; wherein the filter logic is to use a pair of source and destination of a register access request to access an entry of the key and use information of the entry of the key to access an entry of the map, wherein the filter logic is to jump to an offset in the map via the offset of the entry of the key and cycle through the number of authorized ranges in the map via the number of authorized ranges of the entry of the key, to determine whether to authorize access, and grant register access requests having a pair of source and destination identified in the data and deny register access requests having a pair of source and destination not identified in the data.