Intel Corporation

Joseph Frank Cihula

David M Durham

Gilbert A Neiger

Baiju V Patel

Ernie F Brickell

Ravi L Sahita

Vedvyas Shanbhogue

Barry E Huntley

Asit K Mallick

Deepak K Gupta

Andrew V Anderson

Michael Lemay

David A Koufaty

Arumugam Thiyagarajah

Don Alan Van Dyke

Uday R Savagaonkar

Prashant Dewan

Carlos V Rozas

Francis X Mckeen

Vincent R Scarlata

John I Garney

Simon P Johnson

Howard C Herbert

Gary L Graunke

Dion Rodgers

Michael A Goldsmith

Stephen R Van Doren

Stalinselvaraj Jeyasingh

Bernard Lint

Asher M Altman

Stephen J Tolopka

Jiang Tao Li

Siddhartha Chhabra

Michael E Kounavis

Richard A Uhlig

Karanvir S Grewal

Sergej Deutsch

Clifford D Hall

Saeedeh Komijani

Mark Jay Charney

Martin Guy Dixon

Andrew F Glew

Scott Dion Rodgers

David W Grawrock

Prashant Sethi

Nitin V Sarangdhar

James B Crossland

Willard M Wiseman

Matthew D Wood

Tin-Cheung Kung

Robert J Kushlis

Rajeev Gopalakrishna

Vinay Kumar Rangineni

Devendra N Rath

Jacob (Koby) Gottlieb

This disclosure is directed to a system for address mapping and translation protection. In one embodiment, processing circuitry may include a virtual machine manager (VMM) to control specific guest linear address (GLA) translations. Control may be implemented in a performance sensitive and secure manner, and may be capable of improving performance for critical linear address page walks over legacy operation by removing some or all of the cost of page walking extended page tables (EPTs) for critical mappings. Alone or in combination with the above, certain portions of a page table structure may be selectively made immutable by a VMM or early boot process using a sub-page policy (SPP). For example, SPP may enable non-volatile kernel and/or user space code and data virtual-to-physical memory mappings to be made immutable (e.g., non-writable) while allowing for modifications to non-protected portions of the OS paging structures and particularly the user space.

System for address mapping and translation protection

Apparatus, systems, computer readable storage mediums and/or methods may provide memory integrity by using unused physical address bits (or other metadata passed through cache) to manipulate cryptographic memory integrity values, allowing software memory allocation routines to control the assignment of pointers (e.g., implement one or more access control policies). Unused address bits (e.g., because of insufficient external memory) passed through cache, may encode key domain information in the address so that different key domain addresses alias to the same physical memory location. Accordingly, by mixing virtual memory mappings and cache line granularity aliasing, any page in memory may contain a different set of aliases at the cache line level and be non-deterministic to an adversary.

Convolutional memory integrity

A technique to enable secure application and data integrity within a computer system. In one embodiment, one or more secure enclaves are established in which an application and data may be stored and executed.

Method and apparatus to provide secure application execution

Virtual machine manager for address mapping and translation protection

A processor comprises a register to store a first reference to a context data structure specifying a virtual machine context, the context data structure comprising a second reference to a target array and an execution unit comprising a logic circuit to execute a virtual machine (VM) based on the virtual machine context, wherein the VM comprises a guest operating system (OS) associated with a page table comprising a first memory address mapping between a guest virtual address (GVA) space and a guest physical address (GPA) space, receive a request by the guest OS to switch from the first memory address mapping to a second memory address mapping, the request comprising an index value and a first root value, retrieve an entry, identified by the index value, from the target array, the entry comprising a second root value, and responsive to determining that the first root value matches the second root value, cause a switch from the first memory address mapping to the second memory address mapping.

Method to manage guest address space trusted by virtual machine monitor

A method for managing a smart card system includes testing a smart card reader for trustworthiness. An indication of the trustworthiness is provided via a smart card.

Method and apparatus for establishing trust in smart card readers

One embodiment provides an apparatus. The apparatus includes an input output memory management unit (I/O MMU), a non-secure operating system (OS) driver, a secure OS driver and a virtual machine monitor (VMM). The I/OMMU is to couple an I/O Controller to a memory. The I/O Controller is coupled to a secure device and a non-secure device and has one I/O Controller identifier. The non-secure OS driver is associated with the non-secure device. The secure OS driver is associated with the secure device. The VMM is to allocate a secure address space to a secure OS and a non-secure address space to a non-secure OS. The secure address space is non-overlapping with the non-secure address space.

System and method for coupling a host device to secure and non-secure devices

A set of default registers of a processor are expanded into metadata registers on the processor of a computer system. The default registers having stored thereon data, while metadata which is related to the data is stored separately on the metadata registers.

Managing and implementing metadata in central processing unit using register extensions

Improving security of a processing system may be accomplished by at least one of executing and accessing a suspect file in a sandbox virtual machine.

Method of improving computer security through sandboxing

A method, apparatus and system for improving security on a virtual machines host is described. A shared file system on the host may include annotations usable by a service module to access files across VMs and to enforce security policies. The service module may additionally enable a unified user interface to improve usability of the host.

Method, apparatus and system for improving security in a virtual machine host

Growing community of inventors

Hillsboro, OR, United States of America

Joseph Frank Cihula