Intel Corporation

Other

Tahoe Research, Ltd.

Gilbert A Neiger

Richard A Uhlig

Andrew V Anderson

Steven M Bennett

Barry E Huntley

Vedvyas Shanbhogue

Francis X Mckeen

Rajesh M Sankaran

Jason W Brandt

Ravi L Sahita

David M Durham

Carlos V Rozas

Scott Dion Rodgers

Erik C Cota-Robles

Dion Rodgers

Sebastian Schoenberg

Ittai Anati

James A Sutton, Ii

Howard C Herbert

Baiju V Patel

Vincent R Scarlata

Simon P Johnson

Ilya Alexandrovich

Shreekant S Thakkar

Roger A Golliver

Derrick Chu Lin

Millind Mittal

Uday R Savagaonkar

Michael A Goldsmith

Siddhartha Chhabra

Michael Lemay

Mark Jay Charney

H Peter Anvin

Krystof C Zmudzinski

Robert Valentine

Ioannis T Schoinas

Raghunandan Makaram

James B Crossland

Michael Mishaeli

Stephen R Van Doren

Jesus Corbal

Martin Guy Dixon

Joseph Nuzman

David A Koufaty

Sridhar Muthrasanallur

Hormuzd M Khosravi

David W Grawrock

Koichi Yamada

Jr-Shian Tsai

Sanjay Kumar

Philip R Lantz

Robert S Chappell

Edward Thomas Grochowski

Eriko Nurvitadhi

Ohad Falik

Thomas D Fletcher

Utkarsh Y Kakaiya

Ashok Raj

Xiang Chris Zou

Deborah T Marr

Bret L Toll

Christopher J Hughes

Efraim Rotem

Eliezer Weissmann

Andrew F Glew

Prashant Dewan

Kun Tian

Milind Baburao Girkar

John I Garney

Ernie F Brickell

Srinivas Chennupaty

Gary L Graunke

Kai Cheng

Sarathy Jayakumar

Ronak Singhal

Balaji Vembu

Mohan J Kumar

Shay Gueron

David I Poisner

Michael E Kounavis

Andrew J Herdrich

Karanvir S Grewal

Raj K Ramanujan

Yen-Cheng Liu

Vadim Sukhomlinov

Stanislav Shwartsman

Bryant E Bigbee

Wei Wang

Altug Koker

Vincent J Zimmer

Michael A Rothman

Glenn J Hinton

Tsung-Yuan Charles Tai

Geoffrey S Strongin

Raanan Sade

Aditya Navale

Ron Gabor

Stephen Anthony Fischer

Matthew C Merten

An embodiment of an integrated circuit may comprise a processor with one or more cores and circuitry coupled to the one or more cores, the circuitry to control one or more interrupts based on an interrupt expansion data structure, and report information derived from the interrupt expansion data structure to a software interrupt handler. Other embodiments are disclosed and claimed.

Processor interrupt expansion feature

A processor of an aspect includes a decode unit to decode an aperture access instruction, and an execution unit coupled with the decode unit. The execution unit, in response to the aperture access instruction, is to read a host physical memory address, which is to be associated with an aperture that is to be in system memory, from an access protected structure, and access data within the aperture at a host physical memory address that is not to be obtained through address translation. Other processors are also disclosed, as are methods, systems, and machine-readable medium storing aperture access instructions.

Aperture access processors, methods, systems, and instructions

In one embodiment, a processor includes: a front end circuit to fetch and decode a read list instruction, the read list instruction to cause storage to a memory of a software-provided list of processor state information; and an execution circuit coupled to the front end circuit. The execution circuit, in response to the decoded read list instruction, is to read the processor state information stored in the processor and store each datum of the processor state information into an entry of a data table in the memory. Other embodiments are described and claimed.

System, apparatus and methods for performant read and write of processor state information responsive to list instructions

Technologies disclosed herein provide cryptographic computing with cryptographically encoded pointers in multi-tenant environments. An example method comprises executing, by a trusted runtime, first instructions to generate a first address key for a private memory region in the memory and generate a first cryptographically encoded pointer to the private memory region in the memory. Generating the first cryptographically encoded pointer includes storing first context information associated with the private memory region in first bits of the first cryptographically encoded pointer and performing a cryptographic algorithm on a slice of a first linear address of the private memory region based, at least in part, on the first address key and a first tweak, the first tweak including the first context information. The method further includes permitting a first tenant in the multi-tenant environment to access the first address key and the first cryptographically encoded pointer to the private memory region.

Cryptographic computing using encrypted base addresses and used in multi-tenant environments

This disclosure is directed to a system for address mapping and translation protection. In one embodiment, processing circuitry may include a virtual machine manager (VMM) to control specific guest linear address (GLA) translations. Control may be implemented in a performance sensitive and secure manner, and may be capable of improving performance for critical linear address page walks over legacy operation by removing some or all of the cost of page walking extended page tables (EPTs) for critical mappings. Alone or in combination with the above, certain portions of a page table structure may be selectively made immutable by a VMM or early boot process using a sub-page policy (SPP). For example, SPP may enable non-volatile kernel and/or user space code and data virtual-to-physical memory mappings to be made immutable (e.g., non-writable) while allowing for modifications to non-protected portions of the OS paging structures and particularly the user space.

System for address mapping and translation protection

Embodiments of apparatuses, methods, and systems for virtualization of interprocessor interrupts are disclosed. In an embodiment, an apparatus includes a plurality of processor cores; an interrupt controller register; and logic to, in response to a write from a virtual machine to the interrupt controller register, record an interprocessor interrupt in a first data structure configured by a virtual machine monitor and send a notification of the interprocessor interrupt to at least one of the plurality of processor cores.

Virtualization of interprocessor interrupts

A processor includes a decode unit to decode an instruction that is to indicate a page of a protected container memory, and a storage location outside of the protected container memory. An execution unit, in response to the instruction, is to ensure that there are no writable references to the page of the protected container memory while it has a write protected state. The execution unit is to encrypt a copy of the page of the protected container memory. The execution unit is to store the encrypted copy of the page to the storage location outside of the protected container memory, after it has been ensured that there are no writable references. The execution unit is to leave the page of the protected container memory in the write protected state, which is also valid and readable, after the encrypted copy has been stored to the storage location.

Processors, methods, systems, and instructions to support live migration of protected containers

In an embodiment, a processor for redirecting requests includes a processing engine to execute a guest system, and monitoring circuitry coupled to the processing engine. The monitoring circuitry may be to: receive, from the guest system, a first request to access a first virtual counter; in response to a receipt of the first request, determine, based a mapping register of the processor, a first physical counter mapped to the first virtual counter; and redirect the first request to the first physical counter mapped to the first virtual counter. Other embodiments are described and claimed.

Processor including monitoring circuitry for virtual counters

Embodiments of systems, methods, and apparatuses for heterogeneous computing are described. In some embodiments, a hardware heterogeneous scheduler dispatches instructions for execution on one or more plurality of heterogeneous processing elements, the instructions corresponding to a code fragment to be processed by the one or more of the plurality of heterogeneous processing elements, wherein the instructions are native instructions to at least one of the one or more of the plurality of heterogeneous processing elements.

Systems, methods, and apparatuses for heterogeneous computing

An embodiment of an apparatus comprises decode circuitry to decode a single instruction, the single instruction to include a field for an identifier of a first source operand, a field for an identifier of a destination operand, and a field for an opcode, the opcode to indicate execution circuitry is to program a user timer, and execution circuitry to execute the decoded instruction according to the opcode to retrieve timer program information from a location indicated by the first source operand, and program a user timer indicated by the destination operand based on the retrieved timer program information. Other embodiments are disclosed and claimed.

User timer directly programmed by application

Techniques to allow use of metadata in unused bits of virtual addresses are described. A processor of an aspect includes a decode circuit to decode a memory access instruction. The instruction to indicate one or more memory address operands that are to have address generation information and metadata. An execution circuit coupled with the decode circuit to generate a 64-bit virtual address based on the one or more memory address operands. The 64-bit virtual address having a bit, an X-bit address field starting at a bitto store an address generated from the address generation information, and one or more metadata bits to store the metadata. The execution circuit also to perform a canonicality check on the 64-bit virtual address that does not fail due to non-canonical values of the metadata stored in the one or more metadata bits. Other processors, methods, systems, and instructions are disclosed.

64-bit virtual addresses having metadata bit(s) and canonicality check that does not fail due to non-canonical values of metadata bit(s)

A processor of an aspect includes a decode unit to decode a user-level suspend thread instruction that is to indicate a first alternate state. The processor also includes an execution unit coupled with the decode unit. The execution unit is to perform the instruction at a user privilege level. The execution unit in response to the instruction, is to: (a) suspend execution of a user-level thread, from which the instruction is to have been received; (b) transition a logical processor, on which the user-level thread was to have been running, to the indicated first alternate state; and (c) resume the execution of the user-level thread, when the logical processor is in the indicated first alternate state, with a latency that is to be less than half a latency that execution of a thread can be resumed when the logical processor is in a halt processor power state.

Methods, apparatus, and instructions for user-level thread suspension

A processor includes a processor core. A register of the core is to store: a bit range for a number of address bits of physical memory addresses used for key identifiers (IDs), and a first key ID to identify a boundary between non-restricted key IDs and restricted key IDs of the key identifiers. A memory controller is to: determine, via access to bit range and the first key ID in the register, a key ID range of the restricted key IDs within the physical memory addresses; access a processor state that a first logical processor of the processor core executes in an untrusted domain mode; receive a memory transaction, from the first logical processor, including an address associated with a second key ID; and generate a fault in response to a determination that the second key ID is within a key ID range of the restricted key IDs.

Restricting usage of encryption keys by untrusted software

A processor for supporting secure memory intent is disclosed. The processor of the disclosure includes a memory execution unit to access memory and a processor core coupled to the memory execution unit. The processor core is to receive a request to access a convertible page of the memory. In response to the request, the processor core to determine an intent for the convertible page in view of a page table entry (PTE) corresponding to the convertible page. The intent indicates whether the convertible page is to be accessed as at least one of a secure page or a non-secure page.

Supporting secure memory intent

According to one embodiment, a method comprises executing an untrusted host virtual machine monitor (VMM) to manage execution of at least one guest virtual machine (VM). The VMM receives an encrypted key domain key, an encrypted guest code image, and an encrypted guest control structure. The VM also issues a create command. In response, a processor creates a first key domain comprising a region of memory to be encrypted by a key domain key. The encrypted key domain key is decrypted to produce the key domain key, which is inaccessible to the VMM. The VMM issues a launch command. In response, a first guest VM is launched within the first key domain. In response to a second launch command, a second guest VM is launched within the first key domain. The second guest VM provides an agent to act on behalf of the VMM. Other embodiments are described and claimed.

Secure public cloud with protected guest-verified host control

Growing community of inventors

Portland, OR, United States of America

Gilbert A Neiger