MECHANISM TO HANDLE EVENTS IN A MACHINE WITH ISOLATED EXECUTION

• US 20100325445A1
• Filed: 08/26/2010
• Published: 12/23/2010
• Est. Priority Date: 09/28/2000
• Status: Active Grant

• Current Assignee: Benjamin Crawford Chaffin, Bryant Bigbee, Francis X. Mckeen, Lawrence O. Smith, Michael P. Cornaby
• Original Assignee: Benjamin Crawford Chaffin, Bryant Bigbee, Francis X. Mckeen, Lawrence O. Smith, Michael P. Cornaby
• Inventors: Chaffin, Benjamin Crawford, Cornaby, Michael P., Bigbee, Bryant, Smith, Lawrence O., McKeen, Francis X.
• Granted Patent: US 8,671,275 B2
• Time in Patent Office: Days
• US Class Current: 713/189
• CPC Class Codes: G06F 12/145 the protection being virtual, e.g. for virtual blocks or segments before a translation mechanism
• CPC Class Codes: G06F 12/1491 in a hierarchical protection system, e.g. privilege levels, memory rings
• CPC Class Codes: G06F 21/52 during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/74 operating in dual or compartmented mode, i.e. at least one secure mode

Abstract

A platform and method for secure handling of events in an isolated environment. A processor executing in isolated execution “IsoX” mode may leak data when an event occurs as a result of the event being handled in a traditional manner based on the exception vector. By defining a class of events to be handled in IsoX mode, and switching between a normal memory map and an IsoX memory map dynamically in response to receipt of an event of the class, data security may be maintained in the face of such events.

Claims

1. An apparatus comprising:

a cache memory;

a processor coupled with the cache memory, the processor comprising;

logic to cause the processor to enter a first mode in response to a first instruction, wherein the first mode is to be indicated by a first mode bit, and wherein the first mode corresponds to a different security level than a normal mode of the processor, and wherein in the first mode a first program is to control access to a secure portion of the cache memory using a translation look-aside buffer;

a flash interface to communicate with a flash memory;

a wireless interface to communicate with a wireless device;

a universal serial bus (USB) interface to communicate with a USB device; and

a keypad interface to communicate with a keypad.

2. The apparatus of claim 1, wherein in the first mode the first program is further to restrict access to a special-purpose control register.

3. The apparatus of claim 2, wherein the special-purpose control register is a virtual memory management descriptor.

4. The apparatus of claim 2, wherein the special-purpose control register is an interrupt vector table descriptor.

5. An apparatus comprising:

a cache memory;

a processor coupled with the cache memory, the processor comprising;

logic to cause a first class of events to be handled by a secure event handling resource and a second class of events to be handled by a normal event handling resource, wherein the secure event handling resource corresponds to a protected memory region and wherein the normal event handling resource corresponds to an unprotected memory region.

a flash interface to communicate with a flash memory;

a wireless interface to communicate with a wireless device;

a universal serial bus (USB) interface to communicate with a USB device; and

a keypad interface to communicate with a keypad.

6. The apparatus of claim 5, wherein the first class of events comprises at least one of a machine check exception event, a clock event, and a hardware interrupt event.

7. The apparatus of claim 5, wherein the secure event handling resource comprises logic to access a secure interrupt vector table.