公开(公告)号：US10515023B2

公开(公告)日：2019-12-24

申请号：US15088739

申请日：2016-04-01

申请人： Ravi L. Sahita ,  Gilbert Neiger ,  Vedvyas Shanbhogue ,  David M. Durham ,  Andrew V. Anderson ,  David A. Koufaty ,  Asit K. Mallick ,  Arumugam Thiyagarajah ,  Barry E. Huntley ,  Deepak K. Gupta ,  Michael Lemay ,  Joseph F. Cihula ,  Baiju V. Patel

发明人： Ravi L. Sahita ,  Gilbert Neiger ,  Vedvyas Shanbhogue ,  David M. Durham ,  Andrew V. Anderson ,  David A. Koufaty ,  Asit K. Mallick ,  Arumugam Thiyagarajah ,  Barry E. Huntley ,  Deepak K. Gupta ,  Michael Lemay ,  Joseph F. Cihula ,  Baiju V. Patel

IPC分类号： G06F12/00 ,  G06F12/14 ,  G06F12/1009 ,  G06F9/455 ,  G06F12/1027 ,  G06F21/78

摘要： This disclosure is directed to a system for address mapping and translation protection. In one embodiment, processing circuitry may include a virtual machine manager (VMM) to control specific guest linear address (GLA) translations. Control may be implemented in a performance sensitive and secure manner, and may be capable of improving performance for critical linear address page walks over legacy operation by removing some or all of the cost of page walking extended page tables (EPTs) for critical mappings. Alone or in combination with the above, certain portions of a page table structure may be selectively made immutable by a VMM or early boot process using a sub-page policy (SPP). For example, SPP may enable non-volatile kernel and/or user space code and data virtual-to-physical memory mappings to be made immutable (e.g., non-writable) while allowing for modifications to non-protected portions of the OS paging structures and particularly the user space.

公开(公告)号：US20160179665A1

公开(公告)日：2016-06-23

申请号：US14581730

申请日：2014-12-23

申请人： Michael LeMay ,  Ravi L. Sahita ,  Barry E. Huntley ,  David M. Durham ,  Vedvyas Shanbhogue

发明人： Michael LeMay ,  Ravi L. Sahita ,  Barry E. Huntley ,  David M. Durham ,  Vedvyas Shanbhogue

IPC分类号： G06F12/08 ,  G06F9/455

CPC分类号： G06F12/08 ,  G06F9/45558 ,  G06F12/1009 ,  G06F12/1491 ,  G06F21/79 ,  G06F2009/45583 ,  G06F2009/45591 ,  G06F2212/151 ,  G06F2212/657

摘要： Generally, this disclosure provides systems, devices, methods and computer readable media for controlled memory view switching. The system may include a memory module comprising a shared address space between a first memory view and a second memory view. The system may also include a virtual machine monitor (VMM) to maintain a list of Controlled View Switch (CVS) descriptors. The system may further include a processor to receive a memory view switch request and to execute an instruction to save processor state information and switch from the first memory view to the second memory view, wherein the second memory view is specified by an extended page table pointer (EPTP) provided by one of the CVS descriptors.

摘要翻译： 通常，本公开提供了用于受控存储器视图切换的系统，设备，方法和计算机可读介质。 该系统可以包括存储器模块，该存储器模块包括第一存储器视图和第二存储器视图之间的共享地址空间。 该系统还可以包括维护受控视图切换（CVS）描述符的列表的虚拟机监视器（VMM）。 该系统还可以包括处理器，用于接收存储器视图切换请求并且执行用于保存处理器状态信息并从第一存储器视图切换到第二存储器视图的指令，其中第二存储器视图由扩展页表指针 （EPTP）由其中一个CVS描述符提供。

公开(公告)号：US20160180079A1

公开(公告)日：2016-06-23

申请号：US14576665

申请日：2014-12-19

申请人： Ravi L. Sahita ,  Xiaoning Li ,  Barry E. Huntley ,  Ofer Levy ,  Vedvyas Shanbhogue ,  Yuriy Bulygin ,  Ido Ouziel ,  Michael Lemay ,  John M. Esper

发明人： Ravi L. Sahita ,  Xiaoning Li ,  Barry E. Huntley ,  Ofer Levy ,  Vedvyas Shanbhogue ,  Yuriy Bulygin ,  Ido Ouziel ,  Michael Lemay ,  John M. Esper

IPC分类号： G06F21/52

CPC分类号： G06F21/52 ,  G06F9/45558 ,  G06F11/30 ,  G06F21/554 ,  G06F2009/45591 ,  G06F2221/033

摘要： A method comprises filtering branch trap events at a branch event filter, monitoring a branch event filter to capture indirect branch trap events that cause a control flow trap exception, receiving the indirect branch trap events at a handler and the handler processing the indirect branch trap events

摘要翻译： 一种方法包括在分支事件过滤器处过滤分支陷阱事件，监视分支事件过滤器以捕获导致控制流陷阱异常的间接分支陷阱事件，在处理器处接收间接分支陷阱事件，并处理处理间接分支陷阱事件

公开(公告)号：US20210382987A1

公开(公告)日：2021-12-09

申请号：US17407035

申请日：2021-08-19

申请人： Vedvyas Shanbhogue ,  Jason W. Brandt ,  Ravi L. Sahita ,  Barry E. Huntley ,  Baiju V. Patel ,  Deepak K. Gupta

发明人： Vedvyas Shanbhogue ,  Jason W. Brandt ,  Ravi L. Sahita ,  Barry E. Huntley ,  Baiju V. Patel ,  Deepak K. Gupta

IPC分类号： G06F21/52 ,  G06F3/06 ,  G06F12/14 ,  G06F9/30 ,  G06F9/46

摘要： A processor implementing techniques for processor extensions to protect stacks during ring transitions is provided. In one embodiment, the processor includes a plurality of registers and a processor core, operatively coupled to the plurality of registers. The plurality of registers is used to store data used in privilege level transitions. Each register of the plurality of registers is associated with a privilege level. An indicator to change a first privilege level of a currently active application to a second privilege level is received. In view of the second privilege level, a shadow stack pointer (SSP) stored in a register of the plurality of registers is selected. The register is associated with the second privilege level. By using the SSP, a shadow stack for use by the processor at the second privilege level is identified.

公开(公告)号：US20130117743A1

公开(公告)日：2013-05-09

申请号：US13629395

申请日：2012-09-27

申请人： Gilbert Neiger ,  Barry E. Huntley ,  Ravi L. Sahita ,  Vedvyas Shanbhogue ,  Jason W. Brandt

发明人： Gilbert Neiger ,  Barry E. Huntley ,  Ravi L. Sahita ,  Vedvyas Shanbhogue ,  Jason W. Brandt

IPC分类号： G06F9/455

CPC分类号： G06F9/45545 ,  G06F9/455 ,  G06F9/45533 ,  G06F9/4555

摘要： A processing core comprising instruction execution logic circuitry and register space. The register space to be loaded from a VMCS, commensurate with a VM entry, with information indicating whether a service provided by the processing core on behalf of the VMM is enabled. The instruction execution logic to, in response to guest software invoking an instruction: refer to the register space to confirm that the service has been enabled, and, refer to second register space or memory space to fetch input parameters for said service written by said guest software.

摘要翻译： 处理核心，包括指令执行逻辑电路和寄存器空间。 要从VMCS加载的与VM条目相称的寄存器空间，其中指示是否启用了代表VMM的由处理核心提供的服务的信息。 指令执行逻辑响应客户软件调用指令：参考寄存器空间以确认服务已经被使能，并且参考第二寄存器空间或存储器空间来获取由所述访客写入的所述服务的输入参数 软件。

公开(公告)号：US20140013326A1

公开(公告)日：2014-01-09

申请号：US13843337

申请日：2013-03-15

申请人： Gilbert Neiger ,  Barry E. Huntley ,  Ravi L. Sahita ,  Vedvyas Shanbhogue ,  Jason W. Brandt

发明人： Gilbert Neiger ,  Barry E. Huntley ,  Ravi L. Sahita ,  Vedvyas Shanbhogue ,  Jason W. Brandt

IPC分类号： G06F9/455

CPC分类号： G06F9/45545 ,  G06F9/455 ,  G06F9/45533 ,  G06F9/4555

摘要： A processing core comprising instruction execution logic circuitry and register space. The register space to be loaded from a VMCS, commensurate with a VM entry, with information indicating whether a service provided by the processing core on behalf of the VMM is enabled. The instruction execution logic to, in response to guest software invoking an instruction: refer to the register space to confirm that the service has been enabled, and, refer to second register space or memory space to fetch input parameters for said service written by said guest software.

摘要翻译： 处理核心，包括指令执行逻辑电路和寄存器空间。 要从VMCS加载的与VM条目相称的寄存器空间，其中指示是否启用了代表VMM的由处理核心提供的服务的信息。 指令执行逻辑响应客户软件调用指令：参考寄存器空间以确认服务已经被使能，并且参考第二寄存器空间或存储器空间来获取由所述访客写入的所述服务的输入参数 软件。

公开(公告)号：US20190095350A1

公开(公告)日：2019-03-28

申请号：US15714217

申请日：2017-09-25

申请人： David M. Durham ,  Siddhartha Chhabra ,  Amy L. Santoni ,  Gilbert Neiger ,  Barry E. Huntley ,  Hormuzd M. Khosravi ,  Baiju V. Patel ,  Ravi L. Sahita ,  Gideon Gerzon ,  Ido Ouziel ,  Ioannis T. Schoinas ,  Rajesh M. Sankaran

发明人： David M. Durham ,  Siddhartha Chhabra ,  Amy L. Santoni ,  Gilbert Neiger ,  Barry E. Huntley ,  Hormuzd M. Khosravi ,  Baiju V. Patel ,  Ravi L. Sahita ,  Gideon Gerzon ,  Ido Ouziel ,  Ioannis T. Schoinas ,  Rajesh M. Sankaran

IPC分类号： G06F12/14 ,  G06F21/60 ,  G06F21/82 ,  G06F3/06

摘要： In one embodiment, a cryptographic circuit is adapted to receive a data line including at least an encrypted portion from a memory in response to a read request having a memory address from a first agent, obtain a key identifier for a key of the first agent from the data line, obtain the key using the key identifier, decrypt the at least encrypted portion of the data line using the key and send decrypted data of the at least encrypted portion of the data line to the first agent. Other embodiments are described and claimed.

公开(公告)号：US09858411B2

公开(公告)日：2018-01-02

申请号：US14576665

申请日：2014-12-19

申请人： Ravi Sahita ,  Xiaoning Li ,  Barry E. Huntley ,  Ofer Levy ,  Vedvyas Shanbhogue ,  Yuriy Bulygin ,  Ido Ouziel ,  Michael Lemay ,  John M. Esper

发明人： Ravi Sahita ,  Xiaoning Li ,  Barry E. Huntley ,  Ofer Levy ,  Vedvyas Shanbhogue ,  Yuriy Bulygin ,  Ido Ouziel ,  Michael Lemay ,  John M. Esper

IPC分类号： G06F9/45 ,  G06F21/52 ,  G06F21/55 ,  G06F9/455 ,  G06F11/30

CPC分类号： G06F21/52 ,  G06F9/45558 ,  G06F11/30 ,  G06F21/554 ,  G06F2009/45591 ,  G06F2221/033

摘要： A method comprises filtering branch trap events at a branch event filter, monitoring a branch event filter to capture indirect branch trap events that cause a control flow trap exception, receiving the indirect branch trap events at a handler and the handler processing the indirect branch trap events.

公开(公告)号：US20140189326A1

公开(公告)日：2014-07-03

申请号：US13729371

申请日：2012-12-28

申请人： Rebekah Leslie ,  Carlos V. Rozas ,  Vincent R. Scarlata ,  Simon P. Johnson ,  Uday R. Savagaonkar ,  Barry E. Huntley ,  Vedvyas Shanbhogue ,  Ittai Anati ,  Francis X. Mckeen ,  Michael A. Goldsmith ,  Ilya Alexandrovich ,  Alex Berenzon ,  Wesley H. Smith

发明人： Rebekah Leslie ,  Carlos V. Rozas ,  Vincent R. Scarlata ,  Simon P. Johnson ,  Uday R. Savagaonkar ,  Barry E. Huntley ,  Vedvyas Shanbhogue ,  Ittai Anati ,  Francis X. Mckeen ,  Michael A. Goldsmith ,  Ilya Alexandrovich ,  Alex Berenzon ,  Wesley H. Smith

IPC分类号： G06F9/30

CPC分类号： G06F9/3004 ,  G06F9/30047 ,  G06F9/30076 ,  G06F9/44 ,  G06F12/084 ,  G06F12/0875 ,  G06F12/1483 ,  G06F2212/452

摘要： Embodiments of an invention for memory management in secure enclaves are disclosed. In one embodiment, a processor includes an instruction unit and an execution unit. The instruction unit is to receive a first instruction and a second instruction. The execution unit is to execute the first instruction, wherein execution of the first instruction includes allocating a page in an enclave page cache to a secure enclave. The execution unit is also to execute the second instruction, wherein execution of the second instruction includes confirming the allocation of the page.

摘要翻译： 公开了用于安全飞行器中的存储器管理的发明的实施例。 在一个实施例中，处理器包括指令单元和执行单元。 指令单元接收第一指令和第二指令。 执行单元执行第一指令，其中第一指令的执行包括将飞地页面缓存中的页面分配到安全飞地。 执行单元还执行第二指令，其中第二指令的执行包括确认页的分配。

公开(公告)号：US20140189325A1

公开(公告)日：2014-07-03

申请号：US13729277

申请日：2012-12-28

申请人： Francis X. Mckeen ,  Michael A. Goldsmith ,  Barry E. Huntley ,  Simon P. Johnson ,  Rebekah Leslie ,  Carlos V. Rozas ,  Uday R. Savagaonkar ,  Vincent R. Scarlata ,  Vedvyas Shanbhogue ,  Wesley H. Smith ,  Ittai Anati ,  Ilya Alexandrovich ,  Alex Berenzon

发明人： Francis X. Mckeen ,  Michael A. Goldsmith ,  Barry E. Huntley ,  Simon P. Johnson ,  Rebekah Leslie ,  Carlos V. Rozas ,  Uday R. Savagaonkar ,  Vincent R. Scarlata ,  Vedvyas Shanbhogue ,  Wesley H. Smith ,  Ittai Anati ,  Ilya Alexandrovich ,  Alex Berenzon

IPC分类号： G06F9/30

CPC分类号： G06F12/0804 ,  G06F9/30047 ,  G06F12/0875 ,  G06F12/1408 ,  G06F2212/1052 ,  G06F2212/402

摘要： Embodiments of an invention for paging in secure enclaves are disclosed. In one embodiment, a processor includes an instruction unit and an execution unit. The instruction unit is to receive a first instruction. The execution unit is to execute the first instruction, wherein execution of the first instruction includes evicting a first page from an enclave page cache.

摘要翻译： 公开了用于在安全飞行器中寻呼的发明的实施例。 在一个实施例中，处理器包括指令单元和执行单元。 指令单元接收第一条指令。 执行单元执行第一指令，其中第一指令的执行包括从飞地页面缓存中逐出第一页。