Back to results
US 10,884,952 B2Granted
Enforcing memory operand types using protection keys
AssigneeIntel Corporation
InventorsMichael Lemay, David A Koufaty, Ravi Sahita
Life of this patent
Estimating the term…
Abstract
Enforcing memory operand types using protection keys is generally described herein. A processor system to provide sandbox execution support for protection key rights attacks includes a processor core to execute a task associated with an untrusted application and execute the task using a designated page of a memory; and a memory management unit to designate the page of the memory to support execution of the untrusted application.
Claims21
A processor system to provide sandbox execution support for protection key rights attacks, the processor system comprising:
- a processor core to execute a task associated with an untrusted application, the processor core to execute the task using a designated page of a memory;
- and
- a memory management unit, coupled to the processor core, the memory management unit to designate the page of the memory to support execution of the untrusted application, the memory management unit comprising:
- a storage unit to store a page table entry associated with a page of the memory, the page table entry including a protection key field that identifies a location of a protection key right (PKR) entry;
- and
- a PKR register including the PKR entry, the PKR entry including a set of bits;
- and
- wherein the memory management unit to, in response to a request to clear a bit of the set of bits of the PKR entry, deny the request to clear the bit of the set of bits of the PKR entry that exists in the PKR register based on comparison with a PKR update mask, the PKR update mask being a bit string that is aligned with the set of bits in the PKR entry and used to control updates of individual bits in the set of bits in the PKR entry;
- wherein, prior to a start of execution of the untrusted application, the processor core to execute trusted code included in the designated page of the memory to support execution of the untrusted application, wherein the trusted code includes a branch to an instruction of a trusted page of the memory to clear bits of a PKR entry associated with the designated page of the memory to support execution of the untrusted application, wherein the memory management unit to allow the bits of the PKR entry associated with the designated page of the memory to be cleared based on a set of bits in a PKR entry associated with the trusted page of the memory.
6 more elements
A method to provide sandbox execution support for protection key rights attacks, the method comprising:
- designating, by a memory management unit, a page of a memory to support execution of an untrusted application;
- executing, by a processor core, a task associated with the untrusted application using the designated page of the memory;
- storing a page table entry associated with a page of the memory, the page table entry including a protection key field that identifies a location of a protection key rights (PKR) entry, the PKR entry including a set of bits;
- and
- in response to a request to clear a bit of the set of bits of the PKR entry, denying the request to clear the bit of the set of bits of the PKR entry based on comparison with a PKR update mask, the PKR update mask being a bit string that is aligned with the set of bits in the PKR entry and used to control updates of individual bits in the set of bits in the PKR entry;
- wherein, prior to a start of execution of the untrusted application:
- executing trusted code included in the designated page of the memory to support execution of the untrusted application, wherein the trusted code includes a branch to an instruction of a trusted page of the memory to clear bits of a PKR entry associated with the designated page of the memory to support execution of the untrusted application;
- and
- allowing the bits of the PKR entry associated with the designated page of the memory to be cleared based on the set of bits in the PKR entry associated with the trusted page of the memory.
6 more elements
At least one non-transitory machine-readable medium including instructions to provide sandbox execution support for protection key rights attacks, which when executed on a machine cause the machine to perform the operations comprising:
- designating, by a memory management unit, a page of a memory to support execution of an untrusted application;
- executing, by a processor core, a task associated with the untrusted application using the designated page of the memory;
- storing a page table entry associated with a page of the memory, the page table entry including a protection key field that identifies a location of a protection key rights (PKR) entry, the PKR entry including a set of bits;
- and
- in response to a request to clear a bit of the set of bits of the PKR entry, denying the request to clear the bit of the set of bits of the PKR entry based on comparison with a PKR update mask, the PKR update mask being a bit string that is aligned with the set of bits in the PKR entry and used to control updates of individual bits in the set of bits in the PKR entry;
- wherein, prior to a start of execution of the untrusted application, the instructions, which when executed by the machine cause the machine to perform the operations comprising:
- executing trusted code included in the designated page of the memory to support execution of the untrusted application, wherein the trusted code includes a branch to an instruction of a trusted page of the memory to clear bits of a PKR entry associated with the designated page of the memory to support execution of the untrusted application;
- and
- allowing the bits of the PKR entry associated with the designated page of the memory to be cleared based on the set of bits in the PKR entry associated with the trusted page of the memory.
6 more elements
Dependencies are inferred from the claim text.