Systems, Apparatuses, and Methods for Platform Security

• US 20180004681A1
• Filed: 07/02/2016
• Published: 01/04/2018
• Est. Priority Date: 07/02/2016
• Status: Abandoned Application

• Current Assignee: Intel Corporation
• Original Assignee: Intel Corporation
• Inventors: Koufaty, David A.
• Application Number:
  US15/201,389
• Publication Number:
  US 20180004681A1
• Time in Patent Office: Days
• CPC Class Codes: G06F 12/1009 using page tables, e.g. page table structures
• CPC Class Codes: G06F 12/1027 using associative or pseudo-associative address translation means, e.g. translation look-aside buffer [TLB]
• CPC Class Codes: G06F 12/109 for multiple virtual address spaces, e.g. segmentation G06F12/1036 takes precedence
• CPC Class Codes: G06F 12/145 the protection being virtual, e.g. for virtual blocks or segments before a translation mechanism
• CPC Class Codes: G06F 2212/1016 Performance improvement
• CPC Class Codes: G06F 2212/1052 Security improvement
• CPC Class Codes: G06F 2212/651 Multi-level translation tables
• CPC Class Codes: G06F 2212/656 Address space sharing
• CPC Class Codes: G06F 2212/657 Virtual address space management

Abstract

Systems, methods, and apparatuses for platform security are described. For example, in an embodiment, an apparatus includes address translation circuitry to translation a virtual address to a physical address and to provide a first protection domain, at least one protection range register, the at least one protection range register to store a range of virtual addresses to protect as part of a protection domain, and comparison circuitry to compare the virtual address to the range of virtual addresses of the at least one protection range register and to output a second protection domain upon a match in of the virtual address and the range of virtual addresses of the at least one protection register.

Claims

1. An apparatus comprising:

address translation circuitry to translation a virtual address to a physical address and to provide a first protection domain;

at least one protection range register, the at least one protection range register to store a range of virtual addresses to protect as part of a protection domain;

comparison circuitry to compare the virtual address to the range of virtual addresses of the at least one protection range register and to output a second protection domain upon a match in of the virtual address and the range of virtual addresses of the at least one protection register; and

a selector circuit to select between the first and second protection domain.

2. The apparatus of claim 1, wherein the range of addresses is set by a base virtual address and a limit virtual address.

3. The apparatus of claim 1, wherein the selector circuit to select the first protection domain when there is no output of the second protection domain.

4. The apparatus of claim 1, wherein the selector circuit to select the second protection domain when there is an output of the second protection domain.

5. The apparatus of claim 1, wherein the at least one protection range register is a register pair and a first register of the register pair to store a base virtual address and a second register of the register pair to store a limit virtual address.

6. The apparatus of claim 5, wherein the first register of the pair of registers to store one of a valid bit and a protection domain.

7. The apparatus of claim 1, wherein the at least one protection range register to store a valid bit and a protection domain.

8. The apparatus of claim 1, wherein the first and second protection domains are indicated by 4-bit values.

9. The apparatus of claim 1, wherein address translation circuitry is a part of a translation lookaside buffer.

10. The apparatus of claim 9, wherein the first protection domain is indicated by a plurality of bits in a page table entry.

11. A method comprising:

receiving a virtual address at address translation circuitry to translation the virtual address to a physical address and to provide a first protection domain;

comparing the virtual address to a range of virtual addresses of at least one protection range register and to output a second protection domain upon a match in of the virtual address and the range of virtual addresses of the at least one protection register; and

selecting between the first and second protection domain.

12. The method of claim 11, wherein the range of addresses is set by a base virtual address and a limit virtual address.

13. The method of claim 11, wherein the first protection domain is selected when there is no output of the second protection domain.

14. The method of claim 11, wherein the second protection domain is selected when there is an output of the second protection domain.

15. The method of claim 11, wherein the at least one protection range register is a register pair and a first register of the register pair to store a base virtual address and a second register of the register pair to store a limit virtual address.

16. The method of claim 15, wherein the first register of the pair of registers to store one of a valid bit and a protection domain.

17. The method of claim 11, wherein the at least one protection range register to store a valid bit and a protection domain.

18. The method of claim 11, wherein the first and second protection domains are indicated by 4-bit values.

19. The method of claim 11, wherein address translation circuitry is a part of a translation lookaside buffer.

20. The method of claim 19, wherein the first protection domain is indicated by a plurality of bits in a page table entry.