Advanced Micro Devices Corporation

Globalfoundries Inc.

Rodney W Schmidt

Geoffrey S Strongin

Brian C Barnes

David W Smith

Terry Lynn Cole

Michael Barclay

Douglas D Gephardt

Mark Douglas Hummel

Benjamin Charles Serebrin

David S Christie

David A Kaplan

Rupaka Mahalingaiah

James R MacDonald

Michael T Wisor

Qadeer Ahmad Qureshi

Joseph A Bailey

Andy Lambrecht

Dan S Mudgett

Norman M Hack

David G Kyle

Steve Ennis

In an embodiment, a device interrupt manager may be configured to receive an interrupt from a device that is assigned to a guest. The device interrupt manager may be configured to transmit an operation targeted to a memory location in a system memory to record the interrupt for a virtual processor within the guest, wherein the interrupt is to be delivered to the targeted virtual processor. In an embodiment, a virtual machine manager may be configured to detect that an interrupt has been recorded by the device interrupt manager for a virtual processor that is not currently executing. The virtual machine manager may be configured to schedule the virtual processor for execution on a hardware processor, or may prioritize the virtual processor for scheduling, in response to the interrupt.

Interrupt virtualization

A memory, system, and method for providing security for data stored within a memory and arranged within a plurality of memory regions. The method includes receiving an address within a selected memory region and using the address to access an encryption indicator. The encryption indicator indicates whether data stored in the selected memory page are encrypted. The method also includes receiving a block of data from the selected memory region and the encryption indicator and decrypting the block of data dependent upon the encryption indicator.

System and method providing region-granular, hardware-controlled memory encryption

A memory management unit (MMU) is disclosed for managing a memory storing data arranged within a plurality of memory pages. The MMU includes a security check unit (SCU) receiving a linear address generated during execution of a current instruction. The linear address has a corresponding physical address residing within a selected memory page. The SCU uses the linear address to access one or more security attribute data structures located in the memory to obtain a security attribute of the selected memory page. The SCU compares a numerical value conveyed by a security attribute of the current instruction to a numerical value conveyed by the security attribute of the selected memory page, and produces an output signal dependent upon a result of the comparison. The MMU accesses the selected memory page dependent upon the output signal.

Memory management system and method providing linear address based memory access security

A method and apparatus for restricting the execution of security sensitive instructions. A first security identification (ID) is associated with each of a plurality of instructions or a set of instructions that are to be executed by a processor. Software code running on the processor requests to execute at least one of the plurality of instructions or set of instructions. The processor obtains a second security ID associated with the software code running thereon and compares the second security ID with the first security ID. The processor executes the requested instruction or set of instructions providing that the second security ID matches the first security ID.

Method and apparatus for restricted execution of security sensitive instructions

A method and an apparatus for performing an I/O device access using targeted security. A software object is executed. A security level for the software object is established. A multi-table input/output (I/O) space access is performed using at least one of the security levels. The function of the object is executed.

Method and apparatus for multi-table accessing of input/output devices using target security

A system, computer program product and method for automatically restoring logon connectivity in a broadband network system. Upon establishing a connection between a client and Internet gateway (INTERNET GATEWAY), the status of the connection, i.e., connected or disconnected, may be checked by issuing a request to an INTERNET GATEWAY utilizing a protocol that is normally blocked when the client is disconnected. By issuing a request utilizing a protocol that is normally blocked when the client is disconnected, the status of the connection may be determined by whether the request may be serviced. If the request cannot be serviced, then a subsequent connection may be established automatically by terminating the logon procedure associated with the preceding connection, e.g., initial connection, and executing the logon procedure associated with the subsequent connection.

Determining logon status in a broadband network system and automatically restoring logon connectivity

A method and an apparatus for performing a virtual address based memory access. A software object is executed. A security level for the software object is established. A virtual address based memory access is performed using at least one of the security levels. The function of the object is executed based upon the virtual address based memory access.

Method and apparatus for linear address based page level security scheme to determine current security context

The present invention provides a method and apparatus for securing portions of a memory. The method includes identifying information for protection and indicating at least one physical address of a memory that houses the information as at least one of read and write disabled. The method includes receiving a request from a program to access the information. The method further includes accessing the information in response to determining that the program has the authority to access the information. The apparatus includes a memory comprising a privileged code. The privileged code is capable of receiving a request to protect selected information and indicating at least one physical address of a memory housing the information as at least one of read and write disabled. The privileged code is capable of receiving a request from a program to access the information. The privileged code is further capable of accessing the information in response to determining that the program has the authority to access the information.

Method and apparatus for securing portions of memory

A method and apparatus for controlling access to segments of memory having security data stored therein is provided. A security check unit maintains information for a plurality of segments of memory regarding whether each of these plurality of segments has secure data stored therein. A hint directory maintains information regarding whether any of a plurality of these segments has secure data stored therein. The hint directory is capable of bypassing the security check unit when it receives an address that falls within a plurality of the segments that have been indicated as being free from secure data. When the hint directory determines that a received address falls within one of a plurality of segments that contain secure data, then the address is passed to the security check unit for a closer examination.

Method and apparatus for improved security in a data processor

A method and apparatus for selectively executing an I/O instruction. The method includes creating an I/O permission bitmap in a memory and receiving an I/O port number and a security context identification (SCID) value. The method also includes using the SCID value and the I/O port number to access the I/O permission bitmap stored to obtain a permission bit corresponding to the I/O port and executing the I/O instruction dependent upon a value of the permission bit corresponding to the I/O port. The I/O permission bitmap includes a plurality of permission bits. Each of the permission bits corresponds to a different one of a plurality of I/O ports. Each of the permission bits has a value indicating whether access to the corresponding I/O port is allowed. The I/O port number indicates the I/O port referenced by the I/O instruction. The SCID value indicates a security context level of a memory location including the I/O instruction.

Input/output permission bitmaps for compartmentalized security

A method and system for handling a security exception. The method includes creating a security exception stack frame in secure memory at a base address. The method also includes writing a faulting code sequence address and one or more register values into the security exception stack frame, and executing a plurality of security exception instructions.

Secure execution mode exceptions

A host bridge is described including a memory controller and a security check unit. The memory controller is adapted for coupling to a memory storing data arranged within a multiple memory pages. The memory controller receives memory access signals (e.g., during a memory access), and responds to the memory access signals by accessing the memory. The security check unit receives the memory access signals, wherein the memory access signals convey a physical address within a target memory page. The security check unit uses the physical address to access one or more security attribute data structures located in the memory to obtain a security attribute of the target memory page. The security check unit provides the memory access signals to the memory controller dependent upon the security attribute of the target memory page. A computer system is described including a memory storing data arranged within a multiple memory pages, a device operably coupled to the memory and configurable to produce memory access signals, the above described host bridge. The computer system may have, for example, a central processing unit (CPU) including a memory management unit (MMU) operably coupled to the memory and configured to manage the memory. The memory management unit (MMU) may manage the memory such that the memory stores the data arranged within the multiple memory pages. A method is disclosed for providing access security for a memory used to store data arranged within a multiple memory pages.

System and method for handling device accesses to a memory providing increased memory access security

A communications system includes a physical layer hardware unit and a processing unit. The physical layer hardware unit is adapted to communicate data over a communications channel in accordance with assigned transmission parameters. The physical layer hardware unit is adapted to receive an incoming signal over the communications channel and sample the incoming signal to generate a digital received signal. The processing unit is adapted to execute a software driver including program instructions adapted to extract control codes from the digital received signal, generate an authentication code, and transfer the control codes and the authentication code to the physical layer hardware unit. The physical layer hardware unit is adapted to signal a security violation in response to the control codes being inconsistent with the authentication code. A method for identifying security violations in a transceiver includes receiving digital data over a communications channel; extracting control codes from the digital received signal; generating an authentication code; transferring the control codes and the authentication code to a physical layer hardware unit of the transceiver; configuring assigned transmission parameters of the physical layer hardware unit based on the control codes; and signaling a security violation in response to the control codes being inconsistent with the authentication code.

Software modem with hidden authentication commands

A system apparatus and method for providing access security for a subject device. The apparatus includes a security check unit (SCU) configured to be coupled to a transmission medium. The SCU is configured to monitor signals on the transmission medium and to detect an attempt by a first device coupled to the transmission medium to access a second device coupled to the transmission medium based upon the signals. The SCU is also configured to determine an identity of the first device based upon the signals and to control access to the second device by the first device dependent upon the identity of the first device. The method includes monitoring signals and detecting an attempt by an additional device to access the subject device based upon the signals. The method also includes using the signals to determine an identity of the additional device and controlling access to the subject device dependent upon the identity of the additional device.

Growing community of inventors

Dripping Springs, TX, United States of America

Rodney W Schmidt