-
公开(公告)号：US11436161B2
公开(公告)日：2022-09-06
申请号：US16686379
申请日：2019-11-18
Applicant: Intel Corporation
Inventor： Ravi L. Sahita , Gilbert Neiger , Vedvyas Shanbhogue , David M. Durham , Andrew V. Anderson , David A. Koufaty , Asit K. Mallick , Arumugam Thiyagarajah , Barry E. Huntley , Deepak K. Gupta , Michael Lemay , Joseph F. Cihula , Baiju V. Patel
IPC: G06F12/00 , G06F12/14 , G06F9/455 , G06F12/1009 , G06F12/1027 , G06F21/78
Abstract: This disclosure is directed to a system for address mapping and translation protection. In one embodiment, processing circuitry may include a virtual machine manager (VMM) to control specific guest linear address (GLA) translations. Control may be implemented in a performance sensitive and secure manner, and may be capable of improving performance for critical linear address page walks over legacy operation by removing some or all of the cost of page walking extended page tables (EPTs) for critical mappings. Alone or in combination with the above, certain portions of a page table structure may be selectively made immutable by a VMM or early boot process using a sub-page policy (SPP). For example, SPP may enable non-volatile kernel and/or user space code and data virtual-to-physical memory mappings to be made immutable (e.g., non-writable) while allowing for modifications to non-protected portions of the OS paging structures and particularly the user space.
-
公开(公告)号：US10394595B2
公开(公告)日：2019-08-27
申请号：US15684002
申请日：2017-08-23
Applicant: Intel Corporation
Inventor： Gilbert Neiger , Deepak K. Gupta , Ravi L. Sahita , Barry E. Huntley , Vedvyas Shanbhogue , Joseph F. Cihula
IPC: G06F9/455 , G06F12/1009 , G06F12/1027
Abstract: A processor comprises a register to store a first reference to a context data structure specifying a virtual machine context, the context data structure comprising a second reference to a target array and an execution unit comprising a logic circuit to execute a virtual machine (VM) based on the virtual machine context, wherein the VM comprises a guest operating system (OS) associated with a page table comprising a first memory address mapping between a guest virtual address (GVA) space and a guest physical address (GPA) space, receive a request by the guest OS to switch from the first memory address mapping to a second memory address mapping, the request comprising an index value and a first root value, retrieve an entry, identified by the index value, from the target array, the entry comprising a second root value, and responsive to determining that the first root value matches the second root value, cause a switch from the first memory address mapping to the second memory address mapping.
-
公开(公告)号：US20190065226A1
公开(公告)日：2019-02-28
申请号：US15684002
申请日：2017-08-23
Applicant: Intel Corporation
Inventor： Gilbert Neiger , Deepak K. Gupta , Ravi L. Sahita , Barry E. Huntley , Vedvyas Shanbhogue , Joseph F. Cihula
IPC: G06F9/455 , G06F12/1009 , G06F12/1027
CPC classification number: G06F9/45558 , G06F12/1009 , G06F12/1027 , G06F2009/45583
Abstract: A processor comprises a register to store a first reference to a context data structure specifying a virtual machine context, the context data structure comprising a second reference to a target array and an execution unit comprising a logic circuit to execute a virtual machine (VM) based on the virtual machine context, wherein the VM comprises a guest operating system (OS) associated with a page table comprising a first memory address mapping between a guest virtual address (GVA) space and a guest physical address (GPA) space, receive a request by the guest OS to switch from the first memory address mapping to a second memory address mapping, the request comprising an index value and a first root value, retrieve an entry, identified by the index value, from the target array, the entry comprising a second root value, and responsive to determining that the first root value matches the second root value, cause a switch from the first memory address mapping to the second memory address mapping.
-
公开(公告)号：US11010310B2
公开(公告)日：2021-05-18
申请号：US16777067
申请日：2020-01-30
Applicant: Intel Corporation
Inventor： David M. Durham , Siddhartha Chhabra , Michael E. Kounavis , Sergej Deutsch , Karanvir S. Grewal , Joseph F. Cihula , Saeedeh Komijani
Abstract: Apparatus, systems, computer readable storage mediums and/or methods may provide memory integrity by using unused physical address bits (or other metadata passed through cache) to manipulate cryptographic memory integrity values, allowing software memory allocation routines to control the assignment of pointers (e.g., implement one or more access control policies). Unused address bits (e.g., because of insufficient external memory) passed through cache, may encode key domain information in the address so that different key domain addresses alias to the same physical memory location. Accordingly, by mixing virtual memory mappings and cache line granularity aliasing, any page in memory may contain a different set of aliases at the cache line level and be non-deterministic to an adversary.
-
公开(公告)号：US20200278937A1
公开(公告)日：2020-09-03
申请号：US16777067
申请日：2020-01-30
Applicant: Intel Corporation
Inventor： David M. Durham , Siddhartha Chhabra , Michael E. Kounavis , Sergej Deutsch , Karanvir S. Grewal , Joseph F. Cihula , Saeedeh Komijani
Abstract: Apparatus, systems, computer readable storage mediums and/or methods may provide memory integrity by using unused physical address bits (or other metadata passed through cache) to manipulate cryptographic memory integrity values, allowing software memory allocation routines to control the assignment of pointers (e.g., implement one or more access control policies). Unused address bits (e.g., because of insufficient external memory) passed through cache, may encode key domain information in the address so that different key domain addresses alias to the same physical memory location. Accordingly, by mixing virtual memory mappings and cache line granularity aliasing, any page in memory may contain a different set of aliases at the cache line level and be non-deterministic to an adversary.
-
公开(公告)号：US10585809B2
公开(公告)日：2020-03-10
申请号：US15089140
申请日：2016-04-01
Applicant: Intel Corporation
Inventor： David M. Durham , Siddhartha Chhabra , Michael E. Kounavis , Sergej Deutsch , Karanvir S. Grewal , Joseph F. Cihula , Saeedeh Komijani
Abstract: Apparatus, systems, computer readable storage mediums and/or methods may provide memory integrity by using unused physical address bits (or other metadata passed through cache) to manipulate cryptographic memory integrity values, allowing software memory allocation routines to control the assignment of pointers (e.g., implement one or more access control policies). Unused address bits (e.g., because of insufficient external memory) passed through cache, may encode key domain information in the address so that different key domain addresses alias to the same physical memory location. Accordingly, by mixing virtual memory mappings and cache line granularity aliasing, any page in memory may contain a different set of aliases at the cache line level and be non-deterministic to an adversary.
-
公开(公告)号：US10089247B2
公开(公告)日：2018-10-02
申请号：US15282647
申请日：2016-09-30
Applicant: INTEL CORPORATION
Inventor： Nitin V. Sarangdhar , Baiju V. Patel , Tin-Cheung Kung , Joseph F. Cihula , Prashant Sethi , Vinay Kumar Rangineni
Abstract: One embodiment provides an apparatus. The apparatus includes an input output memory management unit (I/O MMU), a non-secure operating system (OS) driver, a secure OS driver and a virtual machine monitor (VMM). The I/OMMU is to couple an I/O Controller to a memory. The I/O Controller is coupled to a secure device and a non-secure device and has one I/O Controller identifier. The non-secure OS driver is associated with the non-secure device. The secure OS driver is associated with the secure device. The VMM is to allocate a secure address space to a secure OS and a non-secure address space to a non-secure OS. The secure address space is non-overlapping with the non-secure address space.
-
公开(公告)号：US20180095900A1
公开(公告)日：2018-04-05
申请号：US15282647
申请日：2016-09-30
Applicant: INTEL CORPORATION
Inventor： Nitin V. Sarangdhar , Baiju V. Patel , Tin-Cheung Kung , Joseph F. Cihula , Prashant Sethi , Vinay Kumar Rangineni
CPC classification number: G06F12/1425 , G06F9/45558 , G06F12/0223 , G06F13/1668 , G06F13/28 , G06F21/57 , G06F2009/45579 , G06F2009/45583 , G06F2009/45587 , G06F2212/1052
Abstract: One embodiment provides an apparatus. The apparatus includes an input output memory management unit (I/O MMU), a non-secure operating system (OS) driver, a secure OS driver and a virtual machine monitor (VMM). The I/OMMU is to couple an I/O Controller to a memory. The I/O Controller is coupled to a secure device and a non-secure device and has one I/O Controller identifier. The non-secure OS driver is associated with the non-secure device. The secure OS driver is associated with the secure device. The VMM is to allocate a secure address space to a secure OS and a non-secure address space to a non-secure OS. The secure address space is non-overlapping with the non-secure address space.
-
公开(公告)号：US11144479B2
公开(公告)日：2021-10-12
申请号：US16686379
申请日：2019-11-18
Applicant: Intel Corporation
Inventor： Ravi L. Sahita , Gilbert Neiger , Vedvyas Shanbhogue , David M. Durham , Andrew V. Anderson , David A. Koufaty , Asit K. Mallick , Arumugam Thiyagarajah , Barry E. Huntley , Deepak K. Gupta , Michael Lemay , Joseph F. Cihula , Baiju V. Patel
IPC: G06F12/00 , G06F12/14 , G06F12/1009 , G06F12/1027 , G06F9/455 , G06F21/78
Abstract: This disclosure is directed to a system for address mapping and translation protection. In one embodiment, processing circuitry may include a virtual machine manager (VMM) to control specific guest linear address (GLA) translations. Control may be implemented in a performance sensitive and secure manner, and may be capable of improving performance for critical linear address page walks over legacy operation by removing some or all of the cost of page walking extended page tables (EPTs) for critical mappings. Alone or in combination with the above, certain portions of a page table structure may be selectively made immutable by a VMM or early boot process using a sub-page policy (SPP). For example, SPP may enable non-volatile kernel and/or user space code and data virtual-to-physical memory mappings to be made immutable (e.g., non-writable) while allowing for modifications to non-protected portions of the OS paging structures and particularly the user space.
