-
公开(公告)号:US11556341B2
公开(公告)日:2023-01-17
申请号:US17341068
申请日:2021-06-07
Applicant: Intel Corporation
Inventor: Ravi Sahita , Deepak Gupta , Vedvyas Shanbhogue , David Hansen , Jason W. Brandt , Joseph Nuzman , Mingwei Zhang
Abstract: Systems, methods, and apparatuses relating to instructions to compartmentalize memory accesses and execution (e.g., non-speculative and speculative) are described. In one embodiment, a compartment manager circuit is to determine, when a compartment control register of a hardware processor core is set to an enable value, that a first subset of code requested for execution on the hardware processor core in user privilege is within a first compartment of memory, load a first compartment descriptor for the first compartment into one or more registers of the hardware processor core from the memory, check if the first compartment is marked in the first compartment descriptor, within the one or more registers of the hardware processor core, as a management compartment, and, when the first compartment is marked in the first compartment descriptor as the management compartment, allowing the first subset of the code within the first compartment to load a second compartment descriptor for a second compartment of the memory into the one or more registers of the hardware processor core from the memory, switching execution from the first subset of code within the first compartment to a second subset of code in user privilege within the second compartment, allowing speculative memory accesses for the second subset of code only within the second compartment, and preventing a memory access outside of the second compartment for the second subset of code as indicated by the second compartment descriptor stored within the one or more registers of the hardware processor core.
-
公开(公告)号:US11416415B2
公开(公告)日:2022-08-16
申请号:US16444053
申请日:2019-06-18
Applicant: Intel Corporation
Inventor: Reshma Lal , Pradeep M. Pappachan , Luis Kida , Krystof Zmudzinski , Siddhartha Chhabra , Abhishek Basak , Alpa Narendra Trivedi , Anna Trikalinou , David M. Lee , Vedvyas Shanbhogue , Utkarsh Y. Kakaiya
IPC: G06F12/14 , H04L9/32 , G06F21/76 , G06F21/60 , H04L9/08 , G06F9/455 , G06F21/57 , G06F21/64 , H04L41/28 , G06F21/79 , H04L41/046 , H04L9/06 , G06F9/38 , G06F12/0802
Abstract: Technologies for secure device configuration and management include a computing device having an I/O device. A trusted agent of the computing device is trusted by a virtual machine monitor of the computing device. The trusted agent securely commands the I/O device to enter a trusted I/O mode, securely commands the I/O device to set a global lock on configuration registers, receives configuration data from the I/O device, and provides the configuration data to a trusted execution environment. In the trusted I/O mode, the I/O device rejects a configuration command if a configuration register associated with the configuration command is locked and the configuration command is not received from the trusted agent. The trusted agent may provide attestation information to the trusted execution environment. The trusted execution environment may verify the configuration data and the attestation information. Other embodiments are described and claimed.
-
公开(公告)号:US20220197793A1
公开(公告)日:2022-06-23
申请号:US17130632
申请日:2020-12-22
Applicant: Intel Corporation
Inventor: Vedvyas Shanbhogue , Jayesh Gaur , Wajdi K. Feghali , Vinodh Gopal , Utkarsh Kakaiya
IPC: G06F12/0802
Abstract: An embodiment of an integrated circuit may comprise, coupled to a core, a hardware decompression accelerator, a compressed cache, a processor and communicatively coupled to the hardware decompression accelerator and the compressed cache, and memory and communicatively coupled to the processor, wherein the memory stores microcode instructions which when executed by the processor causes the processor to store a first address to a decompression work descriptor, retrieve a second address where a compressed page is stored in the compressed cache from the decompression work descriptor at the first address in response to an indication of a page fault, and send instructions to the hardware decompression accelerator to decompress the compressed page at the second address. Other embodiments are disclosed and claimed.
-
公开(公告)号:US20220147393A1
公开(公告)日:2022-05-12
申请号:US17212977
申请日:2021-03-25
Applicant: Intel Corporation
Inventor: Rajesh Sankaran , Gilbert Neiger , Vedvyas Shanbhogue , David Koufaty
Abstract: An embodiment of an apparatus comprises decode circuitry to decode a single instruction, the single instruction to include a field for an identifier of a first source operand, a field for an identifier of a destination operand, and a field for an opcode, the opcode to indicate execution circuitry is to program a user timer, and execution circuitry to execute the decoded instruction according to the opcode to retrieve timer program information from a location indicated by the first source operand, and program a user timer indicated by the destination operand based on the retrieved timer program information. Other embodiments are disclosed and claimed.
-
115.
公开(公告)号:US20220138286A1
公开(公告)日:2022-05-05
申请号:US17133336
申请日:2020-12-23
Applicant: Intel Corporation
Inventor: David Zage , Scott Janus , Ned M. Smith , Vidhya Krishnan , Siddhartha Chhabra , Rajesh Poornachandran , Tomer Levy , Julien Carreno , Ankur Shah , Ronald Silvas , Aravindh Anantaraman , David Puffer , Vedvyas Shanbhogue , David Cowperthwaite , Aditya Navale , Omer Ben-Shalom , Alex Nayshtut , Xiaoyu Ruan
Abstract: Systems, apparatuses and methods may provide for encryption based technology. Data may be encrypted locally with a graphics processor with encryption engines. The graphics processor components may be verified with a root-of-trust and based on collection of claims. The graphics processor may further be able to modify encrypted data from a non-pageable format to a pageable format. The graphics processor may further process data associated with a virtual machine based on a key that is known by the virtual machine and the graphics processor.
-
公开(公告)号:US11176243B2
公开(公告)日:2021-11-16
申请号:US16585373
申请日:2019-09-27
Applicant: Intel Corporation
Inventor: Vedvyas Shanbhogue , Jason W. Brandt , Ravi L. Sahita , Barry E. Huntley , Baiju V. Patel , Deepak K. Gupta
Abstract: A processor implementing techniques for processor extensions to protect stacks during ring transitions is provided. In one embodiment, the processor includes a plurality of registers and a processor core, operatively coupled to the plurality of registers. The plurality of registers is used to store data used in privilege level transitions. Each register of the plurality of registers is associated with a privilege level. An indicator to change a first privilege level of a currently active application to a second privilege level is received. In view of the second privilege level, a shadow stack pointer (SSP) stored in a register of the plurality of registers is selected. The register is associated with the second privilege level. By using the SSP, a shadow stack for use by the processor at the second privilege level is identified.
-
公开(公告)号:US20210344653A1
公开(公告)日:2021-11-04
申请号:US17369824
申请日:2021-07-07
Applicant: Intel Corporation
Inventor: David J. Harriman , Raghunandan Makaram , Ioannis T. Schoinas , Kapil Sood , Yu-Yuan Chen , Vedvyas Shanbhogue , Siddhartha Chhabra , Reshma Lal , Reouven Elbaz
Abstract: A protected link between a first computing device and a second computing device is set up, wherein communication over the protected link is to comply with a communication protocol that allows packets to be reordered during transit. A plurality of packets are generated according to a packet format that ensures the plurality of packets will not be reordered during transmission over the protected link, the plurality of packets comprising a first packet and a second packet. Data of the plurality of packets are encrypted for transmission over the protected link, wherein data of the first packet is encrypted based on the cryptographic key and a first value of a counter and data of the second packet is encrypted based on the cryptographic key and a second value of the counter.
-
公开(公告)号:US11144479B2
公开(公告)日:2021-10-12
申请号:US16686379
申请日:2019-11-18
Applicant: Intel Corporation
Inventor: Ravi L. Sahita , Gilbert Neiger , Vedvyas Shanbhogue , David M. Durham , Andrew V. Anderson , David A. Koufaty , Asit K. Mallick , Arumugam Thiyagarajah , Barry E. Huntley , Deepak K. Gupta , Michael Lemay , Joseph F. Cihula , Baiju V. Patel
IPC: G06F12/00 , G06F12/14 , G06F12/1009 , G06F12/1027 , G06F9/455 , G06F21/78
Abstract: This disclosure is directed to a system for address mapping and translation protection. In one embodiment, processing circuitry may include a virtual machine manager (VMM) to control specific guest linear address (GLA) translations. Control may be implemented in a performance sensitive and secure manner, and may be capable of improving performance for critical linear address page walks over legacy operation by removing some or all of the cost of page walking extended page tables (EPTs) for critical mappings. Alone or in combination with the above, certain portions of a page table structure may be selectively made immutable by a VMM or early boot process using a sub-page policy (SPP). For example, SPP may enable non-volatile kernel and/or user space code and data virtual-to-physical memory mappings to be made immutable (e.g., non-writable) while allowing for modifications to non-protected portions of the OS paging structures and particularly the user space.
-
119.
公开(公告)号:US11099880B2
公开(公告)日:2021-08-24
申请号:US16481441
申请日:2017-02-22
Applicant: INTEL CORPORATION
Inventor: Sanjay Kumar , Rajesh M. Sankaran , Gilbert Neiger , Philip R. Lantz , Jason W. Brandt , Vedvyas Shanbhogue , Utkarsh Y. Kakaiya , Kun Tian
IPC: G06F9/455 , G06F12/1045 , G06F12/109 , G06F9/30
Abstract: A processing device comprises an address translation circuit to intercept a work request from an I/O device. The work request comprises a first ASID to map to a work queue. A second ASID of a host is allocated for the first ASID based on the work queue. The second ASID is allocated to at least one of: an ASID register for a dedicated work queue (DWQ) or an ASID translation table for a shared work queue (SWQ). Responsive to receiving a work submission from the SVM client to the I/O device, the first ASID of the application container is translated to the second ASID of the host machine for submission to the I/O device using at least one of: the ASID register for the DWQ or the ASID translation table for the SWQ based on the work queue associated with the I/O device.
-
公开(公告)号:US20210255962A1
公开(公告)日:2021-08-19
申请号:US17156175
申请日:2021-01-22
Applicant: Intel Corporation
Inventor: Krystof C. Zmudzinski , Siddhartha Chhabra , Uday R. Savagaonkar , Simon P. Johnson , Rebekah M. Leslie-Hurd , Francis X. McKeen , Gilbert Neiger , Raghunandan Makaram , Carlos V. Rozas , Amy L. Santoni , Vincent R. Scarlata , Vedvyas Shanbhogue , Ilya Alexandrovich , Ittai Anati , Wesley H. Smith , Michael Goldsmith
IPC: G06F12/1009 , G06F12/1027 , G06F12/1036 , G06F12/109 , G06F12/14 , G06F9/455
Abstract: A processor for supporting secure memory intent is disclosed. The processor of the disclosure includes a memory execution unit to access memory and a processor core coupled to the memory execution unit. The processor core is to receive a request to access a convertible page of the memory. In response to the request, the processor core to determine an intent for the convertible page in view of a page table entry (PTE) corresponding to the convertible page. The intent indicates whether the convertible page is to be accessed as at least one of a secure page or a non-secure page.
-
-
-
-
-
-
-
-
-