Patent application number | Description | Published |
20120222114 | METHOD AND APPARATUS FOR NETWORK FILTERING AND FIREWALL PROTECTION ON A SECURE PARTITION - A management virtual machine on a virtualization technology enabled platform includes a means for providing a firewall and deep packet inspection. An isolated secure partition is provided to host the management application and network packet filtering and firewall functions to provide a secure and trusted platform for manageability applications. A protected component in the operating system in a user partition moves network traffic to the secure partition for inspection and filtering. | 08-30-2012 |
20130117743 | Instruction-Set Support for Invocation of VMM-Configured Services without VMM Intervention - A processing core comprising instruction execution logic circuitry and register space. The register space to be loaded from a VMCS, commensurate with a VM entry, with information indicating whether a service provided by the processing core on behalf of the VMM is enabled. The instruction execution logic to, in response to guest software invoking an instruction: refer to the register space to confirm that the service has been enabled, and, refer to second register space or memory space to fetch input parameters for said service written by said guest software. | 05-09-2013 |
20130283369 | Providing A Multi-Phase Lockstep Integrity Reporting Mechanism - In one embodiment, a processor can enforce a blacklist and validate, according to a multi-phase lockstep integrity protocol, a device coupled to the processor. Such enforcement may prevent the device from accessing one or more resources of a system prior to the validation. The blacklist may include a list of devices that have not been validated according to the multi-phase lockstep integrity protocol. Other embodiments are described and claimed. | 10-24-2013 |
20140013326 | Instruction-Set Support for Invocation of VMM-Configured Services without VMM Intervention - A processing core comprising instruction execution logic circuitry and register space. The register space to be loaded from a VMCS, commensurate with a VM entry, with information indicating whether a service provided by the processing core on behalf of the VMM is enabled. The instruction execution logic to, in response to guest software invoking an instruction: refer to the register space to confirm that the service has been enabled, and, refer to second register space or memory space to fetch input parameters for said service written by said guest software. | 01-09-2014 |
20140189242 | LOGGING IN SECURE ENCLAVES - Embodiments of an invention for logging in secure enclaves are disclosed. In one embodiment, a processor includes an instruction unit and an execution unit. The instruction unit is to receive an instruction having an associated enclave page cache address. The execution unit is to execute the instruction without causing a virtual machine exit, wherein execution of the instruction includes logging the instruction and the associated enclave page cache address. | 07-03-2014 |
20140189325 | PAGING IN SECURE ENCLAVES - Embodiments of an invention for paging in secure enclaves are disclosed. In one embodiment, a processor includes an instruction unit and an execution unit. The instruction unit is to receive a first instruction. The execution unit is to execute the first instruction, wherein execution of the first instruction includes evicting a first page from an enclave page cache. | 07-03-2014 |
20140189326 | MEMORY MANAGEMENT IN SECURE ENCLAVES - Embodiments of an invention for memory management in secure enclaves are disclosed. In one embodiment, a processor includes an instruction unit and an execution unit. The instruction unit is to receive a first instruction and a second instruction. The execution unit is to execute the first instruction, wherein execution of the first instruction includes allocating a page in an enclave page cache to a secure enclave. The execution unit is also to execute the second instruction, wherein execution of the second instruction includes confirming the allocation of the page. | 07-03-2014 |
20140223429 | SYSTEMS, METHODS AND COMPUTER PROGRAM PRODUCTS FOR BOOTSTRAPPING A TYPE 1 VIRTUAL MACHINE MONITOR AFTER OPERATING SYSTEM LAUNCH - Systems, methods, and computer program products that provide for the use of a type 2 VMM to de-link or isolate underlying processor hardware from an operating system. This may allow the launching of a task that requires direct access to processor hardware, where such access requires the absence of an operating system. Such a task may take the form of a type 1 VMM, such as an information security or integrity VMM, e.g., an anti-malware VMM. | 08-07-2014 |
20140297962 | INSTRUCTIONS AND LOGIC TO PROVIDE ADVANCED PAGING CAPABILITIES FOR SECURE ENCLAVE PAGE CACHES - Instructions and logic provide advanced paging capabilities for secure enclave page caches. Embodiments include multiple hardware threads or processing cores, a cache to store secure data for a shared page address allocated to a secure enclave accessible by the hardware threads. A decode stage decodes a first instruction specifying said shared page address as an operand, and execution units mark an entry corresponding to an enclave page cache mapping for the shared page address to block creation of a new translation for either of said first or second hardware threads to access the shared page. A second instruction is decoded for execution, the second instruction specifying said secure enclave as an operand, and execution units record hardware threads currently accessing secure data in the enclave page cache corresponding to the secure enclave, and decrement the recorded number of hardware threads when any of the hardware threads exits the secure enclave. | 10-02-2014 |
20140325110 | Enabling Virtualization Of A Processor Resource - In one embodiment, a processor includes an access logic to determine whether an access request from a virtual machine is to a device access page associated with a device of the processor and if so, to re-map the access request to a virtual device page in a system memory associated with the VM, based at least in part on information stored in a control register of the processor. Other embodiments are described and claimed. | 10-30-2014 |
20140359754 | Providing A Multi-Phase Lockstep Integrity Reporting Mechanism - In one embodiment, a processor can enforce a blacklist and validate, according to a multi-phase lockstep integrity protocol, a device coupled to the processor. Such enforcement may prevent the device from accessing one or more resources of a system prior to the validation. The blacklist may include a list of devices that have not been validated according to the multi-phase lockstep integrity protocol. Other embodiments are described and claimed. | 12-04-2014 |
20150033012 | SECURE PROCESSING ENVIRONMENT MEASUREMENT AND ATTESTATION - Embodiments of an invention for secure processing environment measurement and attestation are disclosed. In one embodiment, a processor includes an instruction unit and an execution unit. The instruction unit is to receive a first instruction associated with a build or a rebuild of a secure enclave. The execution unit is to execute the first instruction. Execution of the first instruction, when associated with the build, includes calculation of a first measurement and a second measurement of the secure enclave. Execution of the first instruction, when associated with the rebuild, includes calculation of the second measurement without calculation of the first measurement. | 01-29-2015 |
20150089173 | SECURE MEMORY REPARTITIONING - Secure memory repartitioning technologies are described. A processor includes a processor core and a memory controller coupled between the processor core and main memory. The main memory includes a memory range including a section of convertible pages are convertible to secure pages or non-secure pages. The processor core, in response to a page conversion instruction, is to determine from the instruction a convertible page in the memory range to be converted and convert the convertible page to be at least one of a secure page or a non-secure page. The memory range may also include a hardware reserved section are convertible in response to a section conversion instruction. | 03-26-2015 |
20150095617 | USING SOFTWARE HAVING CONTROL TRANSFER TERMINATION INSTRUCTIONS WITH SOFTWARE NOT HAVING CONTROL TRANSFER TERMINATION INSTRUCTIONS - In an embodiment, the present invention includes a processor having a decode unit, an execution unit, and a retirement unit. The decode unit is to decode control transfer instructions and the execution unit is to execute control transfer instructions. The retirement unit is to retire a first control transfer instruction, and to raise a fault if a next instruction to be retired after the first control transfer instruction is not a second control transfer instruction and a target instruction of the first control transfer instruction is in code using the control transfer instructions. | 04-02-2015 |
20150121366 | VIRTUALIZATION EXCEPTIONS - Embodiments of an invention for virtualization exceptions are disclosed. In one embodiment, a processor includes instruction hardware, control logic, and execution hardware. The instruction hardware is to receive a plurality of instructions, including an instruction to enter a virtual machine. The control logic is to determine, in response to a privileged event occurring within the virtual machine, whether to generate a virtualization exception. The execution hardware is to generate a virtualization exception in response to the control logic determining to generate a virtualization exception. | 04-30-2015 |
20150143071 | MEMORY EVENT NOTIFICATION - Embodiments of apparatuses and methods for memory event notification are disclosed. In one embodiment, a processor includes address translation hardware and memory event hardware. The address translation hardware is to support translation of a first address, used by software to access a memory, to a second address, used by the processor to access the memory. The memory event hardware is to detect an access to a registered portion of memory. | 05-21-2015 |
20150161408 | Protecting Information Processing System Secrets From Debug Attacks - Embodiments of an invention for protecting information processing system secrets from debug attacks are disclosed. In one embodiment, a processor includes storage, a debug unit, and a test access port. The debug unit is to receive a policy from a debug aggregator. The policy is based on a value of a first fuse and has a production mode corresponding to a production value of the first fuse and a debug mode corresponding to a debug value of the fuse. The test access port is to provide access to the storage using a debug command in the debug mode and to prevent access to the storage using the debug command in the production mode. | 06-11-2015 |
20150186290 | SYSTEM, APPARATUS, AND METHOD FOR TRANSPARENT PAGE LEVEL INSTRUCTION TRANSLATION - Detailed herein are systems, apparatuses, and methods for transparent page level instruction translation. Exemplary embodiments include an instruction translation lookaside buffer (iTLB), wherein each iTLB entry includes a linear address of a page in memory, a physical address of the page in memory, and a remapping indicator. | 07-02-2015 |
20150186659 | MODIFYING MEMORY PERMISSIONS IN A SECURE PROCESSING ENVIRONMENT - Embodiments of an invention for modifying memory permissions in a secure processing environment are disclosed. In one embodiment, a processor includes an instruction unit and an execution unit. The instruction unit is to receive an instruction to modify access permissions for a page in a secure enclave. The execution unit is to execute the instruction. Execution of the instruction includes setting new access permissions in an enclave page cache map entry. Furthermore, the page is immediately accessible from inside the secure enclave according to the new access permissions. | 07-02-2015 |