Intel Corporation

Scott Constable

David M Durham

Kshitij Arun Doshi

Carlos V Rozas

Francis X Mckeen

Michael Lemay

Bin Xing

Krystof C Zmudzinski

Alaa R Alameldeen

Mona Vij

Anna Trikalinou

Mark Shanahan

Francis McKeen

Meltem Ozsoy

Fangfei Liu

Matthew Fernandez

Michael Steiner

Thomas Unterluggauer

Yuan Xiao

Peiming Liu

Systems, methods, and apparatuses for implementing capability-based indirect prefetching are described. In certain examples, a hardware processor comprises an execution circuit to execute an instruction that generates a memory access request for an element in memory via a first capability; a capability management circuit to check the first capability for the memory access request, the first capability comprising an address field of the element in the memory, a validity field, and a bounds field that is to indicate a lower bound and an upper bound of a first object to which the first capability authorizes access; a cache; and a prefetch circuit to: prefetch an additional element of the first object from the memory based on the first capability, determine if the additional element is a second capability comprising an address field of a second element in the memory, a validity field, and a bounds field that is to indicate a lower bound and an upper bound of a second object to which the second capability authorizes access, and prefetch the second element from the memory to the cache based on the additional element being the second capability.

Circuitry and methods for informing indirect prefetches using capabilities

In one embodiment, an apparatus comprises a processing circuitry to detect an occurrence of at least one of a single-stepping event or a zero-stepping event in an execution thread on an architecturally protected enclave and in response to the occurrence, implement at least one mitigation process to inhibit further occurrences of the at least one of a single-stepping event or a zero-stepping event in the architecturally protected enclave.

Techniques and technologies to address malicious single-stepping and zero-stepping of trusted execution environments

Systems, apparatuses and methods provide for technology that determines that first data associated with a first security domain is to be stored in a first permutated cache set, where the first permuted cache set is identified based on a permutation function that permutes at least one of a plurality of first cache indexes. The technology further determines that second data associated with a second security domain is to be stored in a second permutated cache set, where the second permuted cache set is identified based on the permutation function. The second permutated cache set may intersect the first permutated cache set at one data cache line to cause an eviction of first data associated with the first security domain from the one data cache line and bypass eviction of data associated with the first security domain from at least one other data cache line of the first permuted cache set.

Cache set permutations based on Galois Field operations

The technology includes allocating an object in a memory and setting an ownership identifier (ID) in the allocated object, the allocated object being associated with a first variable in a program and setting a matching ownership ID in a pointer to the allocated object. When the allocated object is accessed during execution of the program by a processor, an exception is generated when the ownership ID in the allocated object does not match the ownership ID in the pointer, and execution of the program is continued when the ownership ID in the allocated object does match the ownership ID in the pointer.

Cryptographic enforcement of borrow checking

Techniques and mechanisms for a victim cache to operate in conjunction with a skewed cache to help mitigate the risk of a side-channel attack. In an embodiment, a first line is evicted from a skewed cache, and moved to a victim cache, based on a message indicating that a second line is to be stored to the skewed cache. Subsequently, a request to access the first line results in a search of both the victim cache and sets of the skewed cache which have been mapped to an address corresponding to the first line. Based on the search, the first line is evicted from the victim cache, and reinserted in the skewed cache. In another embodiment, reinsertion of the first line in the skewed cache includes the first line and a third line being swapped between the skewed cache and the victim cache.

Device, method and system to supplement a skewed cache with a victim cache

Growing community of inventors

Portland, OR, United States of America

Scott Constable