Abstract:
Mitigating or managing an effect known as “rowhammer” upon a DRAM device may include a memory controller receiving an activation count threshold value from the DRAM device. The memory controller may detect row activation commands directed to the DRAM device and count the number of the row activation commands. The memory controller may send a mitigative refresh command to the DRAM device based on the result of comparing the counted number of row activation commands with the received activation count threshold value.
Abstract:
In an aspect, a method for protecting software includes obtaining a payload including at least one of instructions or data, establishing a realm in a memory device, encrypting the payload based on an ephemeral encryption key (EEK) associated with the realm, and storing the encrypted payload in the realm of the memory device. In another aspect, a method for protecting software includes receiving a memory transaction associated with the memory device, the memory transaction including at least a realm identifier (RID) and a realm indicator bit, obtaining the EEK associated with the RID when the RID indicates the realm and when the realm indicator bit is enabled, decrypting an instruction and/or data retrieved from the realm based on the EEK when the memory transaction is a read transaction, and encrypting second data for storage in the realm based on the EEK when the memory transaction is a write transaction.
Abstract:
Aspect may relate to a device that comprises an interface and a processor. The interface may be configured to: obtain a statement from an asserting party exercising an authorization. The processor may be coupled to the interface and the processor may be configured to: implement an evaluator to evaluate the statement from the asserting party with policy verification instructions to determine if the asserting party was authorized to issue the statement.
Abstract:
Techniques for protecting software in a computing device are provided. A method according to these techniques includes receiving a request from a non-secure software module to execute an instruction of a secure software module comprising encrypted program code, determining whether the instruction comprises an instruction associated with a controlled point of entry to the secure software module accessible outside of the secure software module, executing one or more instructions of the secure software module responsive to the instruction comprising an instruction associated with the controlled point of entry to the secure software module, and controlling exit from the secure software module to return execution to the non-secure software module.
Abstract:
In an aspect, a cache memory device receives a request to read an instruction or data associated with a memory device. The request includes a first realm identifier and a realm indicator bit, where the first realm identifier enables identification of a realm that includes one or more selected regions in the memory device. The cache memory device determines whether the first realm identifier matches a second realm identifier in a cache tag when the instruction or data is stored in the cache memory device, where the instruction or data stored in the cache memory device has been decrypted based on an ephemeral encryption key associated with the second realm identifier when the first realm identifier indicates the realm and when the realm indicator bit is enabled. The cache memory device transmits the instruction or data when the first realm identifier matches the second realm identifier.
Abstract:
In an aspect, a method for protecting software includes obtaining a payload including at least one of instructions or data, establishing a realm in a memory device, encrypting the payload based on an ephemeral encryption key (EEK) associated with the realm, and storing the encrypted payload in the realm of the memory device. In another aspect, a method for protecting software includes receiving a memory transaction associated with the memory device, the memory transaction including at least a realm identifier (RID) and a realm indicator bit, obtaining the EEK associated with the RID when the RID indicates the realm and when the realm indicator bit is enabled, decrypting an instruction and/or data retrieved from the realm based on the EEK when the memory transaction is a read transaction, and encrypting second data for storage in the realm based on the EEK when the memory transaction is a write transaction.
Abstract:
In an aspect, a cache memory device receives a request to read an instruction or data associated with a memory device. The request includes a first realm identifier and a realm indicator bit, where the first realm identifier enables identification of a realm that includes one or more selected regions in the memory device. The cache memory device determines whether the first realm identifier matches a second realm identifier in a cache tag when the instruction or data is stored in the cache memory device, where the instruction or data stored in the cache memory device has been decrypted based on an ephemeral encryption key associated with the second realm identifier when the first realm identifier indicates the realm and when the realm indicator bit is enabled. The cache memory device transmits the instruction or data when the first realm identifier matches the second realm identifier.
Abstract:
An effect known as “rowhammer” may be mitigated in a DRAM organized in sub-banks of two or more rows. Row activation commands directed to a sub-bank may be detected. The number of row activation commands occurring within a refresh window may be counted and compared with a threshold. When it is detected that the number of row activation commands within the refresh window exceeds the threshold, an additional refresh command may be provided to the DRAM.
Abstract:
An effect known as “rowhammer” may be mitigated in a DRAM organized in sub-banks of two or more rows. Row activation commands directed to a sub-bank may be detected. The number of row activation commands occurring within a refresh window may be counted and compared with a threshold. When it is detected that the number of row activation commands within the refresh window exceeds the threshold, an additional refresh command may be provided to the DRAM.