# US 2017/0285986 A1 · Secure memory controller

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2017/0285986 A1
- Document ID: US20170285986A1
- Status: Published application
- Kind: A1
- Application number: 15/086,523
- Filed: 2016-03-31
- Published: 2017-10-05
- Earliest claimed: 2016-03-31
- Assignees: Intel Corporation
- Inventors: Vinodh Gopal
- Web page: https://patentgrep.com/patent/US20170285986A1

## CPC

- G06F 12/0897: with two or more cache hierarchy levels (with multilevel cache hierarchies G06F12/0811)
- G06F 12/1425: {the protection being physical, e.g. cell, word, block}
- G06F 21/78: to assure secure storage of data (address-based protection against unauthorised use of memory G06F12/14; record carriers for use with machines and with at least a part designed to carry digital markings G06K19/00)
- G06F 2212/1052: Security improvement
- G06F 2212/451: Stack data
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

Methods and apparatus for a secure memory controller. The secure memory controller includes circuitry and logic that is programmed to prevent malicious code from overwrite protected regions of system memory. The memory controller observes memory access patterns and trains itself to identify thread stacks and addresses relating to the thread stacks including stack-frame pointers and return addresses. In one aspect, the memory controller prevents a return address from being overwritten until a proper return from a function call is detected. The memory controller is also configured to prevent malicious code from overwriting page table entries (PTEs) in page tables. Pages containing PTEs are identified, and access is prevented to the PTEs from user-mode code. The PTEs are also scanned to detect corrupted PTEs resulting from bit manipulation by malicious code.

## Claims

### Claim 1

A method performed by a memory controller, comprising:
controlling access to system memory, the accesses including memory writes and memory reads;
monitoring patterns of accesses to the system memory;
detecting a return address for a function call in the system memory; and
preventing the return address from being overwritten unless the memory controller determines it is safe.

### Claim 2 (depends on 1)

The method of claim 1, further comprising operations performed by the memory controller including:
monitoring bursts of writes to the system memory, the burst of writes corresponding to function calls from an execution thread;
detecting that a new stack frame corresponding to a called function is added to a stack for the execution thread, the new stack frame beginning with a frame pointer; and
updating a current frame-pointer for the stack to the frame-pointer for the new stack frame.

### Claim 3 (depends on 2)

The method of claim 2, further comprising operations performed by the memory controller including:
implementing a linked list of frame-pointers, the linked list including a first frame-pointer; and
when a new stack frame is detected to be added to the stack, appending a frame pointer for the new stack frame to the end of the linked list,
wherein each frame-pointer except the first frame-pointer is a previous frame-pointer that that points to the frame pointer preceding it in the linked list.

### Claim 4 (depends on 3)

The method of claim 3, further comprising operations performed by the memory controller including:
detecting that a stack frame has been popped off of the stack for the execution thread;
removing the frame-pointer corresponding to the stack frame that is detected to have been popped off of the stack from the end of the linked list; and
setting the frame-pointer that is now at the end of the linked list as the current frame-pointer.

### Claim 5 (depends on 2)

The method of claim 2, further comprising operations performed by the memory controller including:
identifying a location in the stack containing a return address for called function; and
preventing the location from being overwritten until the called function has properly returned to the return address.

### Claim 6 (depends on 5)

The method of claim 5, wherein the location in the stack containing the return address for the called function is a memory location having an address in the system memory, further comprising operations performed by the memory controller including:
blocking the memory location from being overwritten;
observing a pattern comprising a burst of reads to the system memory;
detecting that an address for one of the reads in the burst of reads is the address for the memory location; and
unblocking the memory location to allow the memory location to be overwritten.

### Claim 7 (depends on 5)

The method of claim 5, wherein the location in the stack containing the return address for the called function is a memory location having an address in the system memory, further comprising operations performed by the memory controller including:
blocking the memory location from being overwritten;
detecting, while the memory location is blocked, a write access having an address for the memory location;
determining the write access is unsafe; and
asserting an error to cause execution of the thread to halt.

### Claim 8 (depends on 2)

The method of claim 2, wherein each memory write includes an address and data further comprising operations performed by the memory controller including:
storing a current frame-pointer for the stack, the current frame pointer having a data value that points to the location in a system memory physical address space of a current stack frame for the stack;
for each write in a burst of writes,
comparing the data in the write with the data value for the current frame-pointer; and
if the data matches the data value for the current frame-pointer, identifying the memory write as the frame-pointer for a new stack frame.

### Claim 9 (depends on 1)

The method of claim 1, further comprising operations performed by the memory controller that prevent malicious code from overwriting page table entries in the system memory.

### Claim 10 (depends on 1)

The method of claim 1, wherein the memory controller is integrated in a processor including a user-mode of execution and a privileged-mode of execution, each execution thread being executed by the processor being executed in one of the user-mode and privileged mode, the method further comprising operations performed by the memory controller including:
permitting page table entries to be written to the system memory via threads executing in privileged mode; and
preventing page table entries from being written to the system memory via threads executing in the user-mode.

### Claim 11 (depends on 1)

The method of claim 1, further comprising operations performed by the memory controller including:
scanning memory pages in the system memory to identify if a memory page contains a page table structure; and
for a memory page containing a page table structure including a plurality of page table entries;
checking bit fields in the page table entries to determine whether a page table entry has been corrupted.

### Claim 12 (depends on 11)

The method of claim 11, further comprising operations performed by the memory controller including:
detecting that a memory write will result in a change to a patent table entry (PTE) mapping;
determining if a new page corresponding to the PTE mapping is legitimate; and
if the new page is determined to be legitimate, allowing the change to the PTE to proceed, otherwise preventing the change to the PTE.

### Claim 13

An apparatus, configured to interface with system memory when installed in a computer system including system memory, comprising:
a memory controller including circuitry and logic configure to,
receive memory access requests comprising write and read accesses for writing to and reading from the system memory, each write and read access including an address in an address space for the system memory;
monitor patterns of accesses to the system memory;
identify, via observation of access patterns to the system memory, regions of memory to protect write access from malicious code;
detect, based on observed memory access patterns, a memory write access request to a region of memory to be protected from malicious code; and
detect whether the memory write access request is unsafe, and if it is, deny the write access request,
otherwise, allow the write access request to proceed.

### Claim 14 (depends on 13)

The apparatus of claim 13, wherein the memory controller includes at least one of local memory and a plurality of registers and the circuitry and logic in the memory controller is further configured to:
monitor bursts of writes to the system memory, the burst of writes corresponding to function calls from an execution thread executing on a processor core in the computer system;
detect that a new stack frame corresponding to a called function is added to a stack maintained in system memory for the execution thread, the new stack frame beginning with a frame-pointer; and
store a local current frame-pointer for the stack in the local memory or a register; and
update the local current frame-pointer for the stack to the frame-pointer for the new stack frame.

### Claim 15 (depends on 14)

The apparatus of claim 14, wherein the circuitry and logic in the memory controller is further configured to:
implement a linked list of frame-pointers in the local memory, the linked list including a first frame-pointer; and
when a new stack frame is detected to be pushed on the stack, append a frame-pointer for the new stack frame to the end of the linked list,
wherein each frame-pointer in the linked list except the first frame-pointer is a previous frame-pointer that that points to the frame pointer preceding it in the linked list.

### Claim 16 (depends on 15)

The apparatus of claim 15, wherein the circuitry and logic in the memory controller is further configured to:
detect that a stack frame has been popped off of the stack for the execution thread;
remove the frame-pointer corresponding to the stack frame that is detected to have been popped off of the stack from the end of the linked list; and
update the local current frame-pointer to the frame-pointer that is now at the end of the linked list.

### Claim 17 (depends on 14)

The apparatus of claim 14, wherein the circuitry and logic in the memory controller is further configured to:
identify a location in the stack containing a return address for the called function; and
prevent data in system memory at an address corresponding to the location from being overwritten until execution of the called function has properly returned to the return address.

### Claim 18 (depends on 17)

The apparatus of claim 17, wherein the location in the stack containing the return address for the called function is a memory location having an address in the system memory, and wherein the circuitry and logic in the memory controller is further configured to:
block the memory location from being overwritten;
observe an access pattern comprising a burst of reads to the system memory;
detect that an address for one of the reads in the burst of reads is the address for the memory location; and
unblock the memory location to allow the memory location to be overwritten.

### Claim 19 (depends on 17)

The apparatus of claim 17, wherein the location in the stack containing the return address for the called function is a memory location having an address in the system memory, and wherein the circuitry and logic in the memory controller is further configured to:
block the memory location from being overwritten;
detect, while the memory location is blocked, a write access having an address for the memory location;
determine the write access is unsafe; and
assert an error.

### Claim 20 (depends on 13)

The apparatus of claim 13, wherein during operation of the computer system an operating system accesses and modifies a memory page table containing a plurality of page table entries and the circuitry and logic in the memory controller is further configured to prevent malicious code from overwriting page table entries.

### Claim 21 (depends on 20)

The apparatus of claim 20, wherein the memory controller is integrated in a processor including a user-mode of execution and a privileged-mode of execution, each execution thread being executed by the processor being executed in one of the user-mode and privileged mode, and wherein the circuitry and logic in the memory controller is further configured to:
permit page table entries to be written to the system memory via threads executing in privileged mode; and
preventing page table entries from being written to the system memory via threads executing in the user-mode.

### Claim 22 (depends on 13)

The apparatus of claim 13, wherein the memory controller includes at least one of local memory and a plurality of registers and the circuitry and logic in the memory controller is further configured to:
scan memory pages in the system memory to identify if a memory page contains a page table structure; and
for a memory page containing a page table structure including a plurality of page table entries,
checking bit fields in the page table entries to determine whether a page table entry has been corrupted.

### Claim 23

A system comprising:
system memory having an address space;
a processor including,
a plurality of processor cores, each including a local level 1 (L1) and level 2 (L2) cache and coupled to an interconnect;
a last level cache, coupled to the interconnect;
system memory;
a memory controller, operative coupled to the last level cache and including an interface coupled to system memory, including circuitry and logic configure to,
receive memory access requests comprising write and read accesses for writing to and reading from the system memory, each write and read access including an address in the system memory;
monitor patterns of accesses to the system memory;
identify, via observation of access patterns to the system memory, regions of memory to protect write access from malicious code;
detect, based on observed memory access patterns, a memory write access request to a region of memory to be protected from malicious code; and
detect whether the memory write access request is unsafe, and if it is, deny the write access request,
otherwise, allow the write access request to proceed.

### Claim 24 (depends on 23)

The system of claim 23, wherein the memory controller includes at least one of local memory and a plurality of registers and the circuitry and logic in the memory controller is further configured to:
monitor bursts of writes to the system memory, the burst of writes corresponding to function calls from an execution thread executing on a processor core in the computer system;
detect that a new stack frame corresponding to a called function is added to a stack maintained in system memory for the execution thread, the new stack frame beginning with a frame-pointer;
identify a location in the stack containing a return address for the called function; and
prevent data in system memory at an address corresponding to the location from being overwritten until execution of the called function has properly returned to the return address, wherein proper return of the of the called function is detected by observing a burst of reads corresponding to the new stack frame being pushed off of the stack.

### Claim 25 (depends on 23)

The system of claim 23, wherein during operation of the system an operating system accesses and modifies a memory page table containing a plurality of page table entries and the circuitry and logic in the memory controller is further configured to prevent malicious code from overwriting page table entries.