Intel Corporation

Jacob Doweck

Ittai Anati

Vinodh Gopal

Zeev Sperber

Wajdi K Feghali

Amit Gradstein

Simon Rubanovich

Sean M Gulley

Jose Yallouz

Regev Shemy

Ilya Albrekht

David M Durham

Carlos V Rozas

Francis X Mckeen

Gideon Gerzon

Ido Ouziel

Baruch Chaikin

Gilbert A Neiger

Ravi L Sahita

Vedvyas Shanbhogue

Eliezer Weissmann

Barry E Huntley

Michael Lemay

Ohad Falik

Ben-Zion Friedman

James B Crossland

Evgeni Krimer

Idan Mondjak

Shay Gueron

Hormuzd M Khosravi

Uday R Savagaonkar

Kirk S Yap

Raanan Sade

Rajat Agarwal

George Vergis

Raghunandan Makaram

Bill Nale

Deepak K Gupta

Dror Caspi

Arie Aharon

Guillermo Savransky

Assaf Zaltsman

Moshe Maor

Nicholas G Samra

Simcha Gochman

Tom Altus

Ahmad Yasin

Belliappa Manavattira Kuttanna

Zvika Greenfield

Chaim Shen-Orr

Reuven Elbaum

Ofir Mulla

Uri Bear

Yonatan Shlomovich

Gyora M Benedek

Elad Peer

Dimitry Kloper

Moshe Cohen

Systems, methods, and apparatuses relating to performing hashing operations on packed data elements are described. In one embodiment, a processor includes a decode circuit to decode a single instruction into a decoded single instruction, the single instruction including at least one first field that identifies eight 32-bit state elements A, B, C, D, E, F, G, and H for a round according to a SM3 hashing standard and at least one second field that identifies an input message; and an execution circuit to execute the decoded single instruction to: rotate state element C left by 9 bits to form a rotated state element C, rotate state element D left by 9 bits to form a rotated state element D, rotate state element G left by 19 bits to form a rotated state element G, rotate state element H left by 19 bits to form a rotated state element H, perform two rounds according to the SM3 hashing standard on the input message and state element A, state element B, rotated state element C, rotated state element D, state element E, state element F, rotated state element G, and rotated state element H to generate an updated state element A, an updated state element B, an updated state element E, and an updated state element F, and store the updated state element A, the updated state element B, the updated state element E, and the updated state element F into a location specified by the single instruction.

Apparatuses, methods, and systems for hashing instructions

A processor includes a processor core. A register of the core is to store: a bit range for a number of address bits of physical memory addresses used for key identifiers (IDs), and a first key ID to identify a boundary between non-restricted key IDs and restricted key IDs of the key identifiers. A memory controller is to: determine, via access to bit range and the first key ID in the register, a key ID range of the restricted key IDs within the physical memory addresses; access a processor state that a first logical processor of the processor core executes in an untrusted domain mode; receive a memory transaction, from the first logical processor, including an address associated with a second key ID; and generate a fault in response to a determination that the second key ID is within a key ID range of the restricted key IDs.

Restricting usage of encryption keys by untrusted software

An apparatus and method for efficient process-based compartmentalization. For example, one embodiment of a processor comprises: execution circuitry to execute instructions and process data; memory management circuitry coupled to the execution circuitry, the memory management circuitry to manage access to a system memory by a plurality of related processes using one or more process-specific translation structures and one or more shared translation structures to be shared by the related processes; and one or more control registers to store a process-specific base address pointer associated with a first process of the plurality of related processes and to store a shared base address pointer to identify the shared translation structures; wherein the memory management circuitry is to use the process-specific base address pointer in combination with a first linear address provided by the first process to walk the process-specific translation structures to identify any permissions and/or physical address associated with the first linear address, wherein if permissions are identified, the memory management circuitry is to use the permissions in place of any permissions specified in the shared translation structures.

Apparatus and method for efficient process-based compartmentalization

Implementations described provide hardware support for the co-existence of restricted and non-restricted encryption keys on a computing system. Such hardware support may comprise a processor having a core, a hardware register to store a bit range to identify a number of bits, of physical memory addresses, that define key identifiers (IDs) and a partition key ID identifying a boundary between non-restricted and restricted key IDs. The core may allocate at least one of the non-restricted key IDs to a software program, such as a hypervisor. The core may further allocate a restricted key ID to a trust domain whose trust computing base does not comprise the software program. A memory controller coupled to the core may allocate a physical page of a memory to the trust domain, wherein data of the physical page of the memory is to be encrypted with an encryption key associated with the restricted key ID.

Co-existence of trust domain architecture with multi-key total memory encryption technology in servers

Embodiments of the invention are generally directed to systems, methods, and apparatuses for linear to physical address translation with support for page attributes. In some embodiments, a system receives an instruction to translate a memory pointer to a physical memory address for a memory location. The system may return the physical memory address and one or more page attributes. Other embodiments are described and claimed.

Linear to physical address translation with support for page attributes

An apparatus and method are described for generating performance metrics of a processor. For example, one embodiment of a processor comprises: one or more simultaneous multithreading cores to simultaneously execute multiple instruction threads; a plurality of performance monitor counters, each to maintain a count of events occurring as a result of the execution of the multiple instruction threads; and a performance monitor unit to generate a plurality of performance metric values using the event counts stored in the performance monitor counters and in response to receipt of a request from software for the performance metric values.

Apparatus and method for generating performance monitoring metrics

Various systems and methods for detecting and preventing side-channel attacks, including attacks aimed at discovering the location of KASLR-randomized privileged code sections in virtual memory address space, are described. In an example, a computing system includes electronic operations for detecting unauthorized attempts to access kernel virtual memory pages via trap entry detection, with operations including: generating a trap page with a physical memory address; assigning a phantom page at an open location in the privileged portion of the virtual memory address space; generating a plurality of phantom page table entries corresponding to an otherwise-unmapped privileged virtual memory region; placing the trap page in physical memory and placing the phantom page table entry in a page table map; and detecting an access to the trap page via the phantom page table entry, to trigger a response to a potential attack.

Mitigating attacks on kernel address space layout randomization

A processor includes a decoder, a data return buffer, and an execution unit. The decoder is to decode an instruction for a non-posted load into a decoded instruction for loading data from memory mapped input/output. The execution unit is for executing the decoded instruction. The execution is to start a timer, determine whether the timer exceeds a timeout threshold, allocate an entry in the data return buffer for the load, and determine whether an event arrived. The timer is to measure an amount of time taken to return the non-posted load instruction. The determination whether an event arrived is made in response to at least one of the allocation of the entry for the load, or a determination that the timer exceeds the timeout threshold.

Method and apparatus for supporting quasi-posted loads

Growing community of inventors

Haifa, Israel

Jacob Doweck