Abstract: The described embodiments include a computing device with two or more translation lookaside buffers (TLB). During operation, the computing device updates an entry in the TLB based on a virtual address to physical address translation and metadata from a page table entry that were acquired during a page table walk. The computing device then computes, based on a lease length expression, a lease length for the entry in the TLB. Next, the computing device sets, for the entry in the TLB, a lease value to the lease length, wherein the lease value represents a time until a lease for the entry in the TLB expires, wherein the entry in the TLB is invalid when the associated lease has expired. The computing device then uses the lease value to control operations that are allowed to be performed using information from the entry in the TLB.

Abstract: The described embodiments include a computing device with two or more translation lookaside buffers (TLB) that performs operations for handling entries in the TLBs. During operation, the computing device maintains lease values for entries in the TLBs, the lease values representing times until leases for the entries expire, wherein a given entry in the TLB is invalid when the associated lease has expired. The computing device uses the lease value to control operations that are allowed to be performed using information from the entries in the TLBs. In addition, the computing device maintains, in a page table, longest lease values for page table entries indicating when corresponding longest leases for entries in TLBs expire. The longest lease values are used to determine when and if a TLB shootdown is to be performed.

Abstract: The described embodiments include a computing device with two or more translation lookaside buffers (TLB) that performs operations for handling entries in the TLBs. During operation, the computing device maintains lease values for entries in the TLBs, the lease values representing times until leases for the entries expire, wherein a given entry in the TLB is invalid when the associated lease has expired. The computing device uses the lease value to control operations that are allowed to be performed using information from the entries in the TLBs. In addition, the computing device maintains, in a page table, longest lease values for page table entries indicating when corresponding longest leases for entries in TLBs expire. The longest lease values are used to determine when and if a TLB shootdown is to be performed.

Abstract: The described embodiments include a computing device with two or more translation lookaside buffers (TLB). During operation, the computing device updates an entry in the TLB based on a virtual address to physical address translation and metadata from a page table entry that were acquired during a page table walk. The computing device then computes, based on a lease length expression, a lease length for the entry in the TLB. Next, the computing device sets, for the entry in the TLB, a lease value to the lease length, wherein the lease value represents a time until a lease for the entry in the TLB expires, wherein the entry in the TLB is invalid when the associated lease has expired. The computing device then uses the lease value to control operations that are allowed to be performed using information from the entry in the TLB.

Abstract: In one embodiment, a processor is configured to operate in a first mode in which privilege level protection is disabled and paging is enabled. In another embodiment, a method is contemplated including intercepting a write to a control register by a guest executing in a processor; determining that the write attempts to establish a first mode in the processor in which privilege level protection is disabled and paging is disabled; and causing the guest to execute in a second mode in which privilege level protection is disabled and paging is enabled instead of the first mode. A computer accessible medium comprising instruction implementing at least a portion of the method is also described.

Abstract: The initialization of a computer system including a secure execution mode-capable processor includes storing a secure operating system code segment loader to a plurality of locations corresponding to a particular range of addresses within a system memory. The method also includes executing a security initialization instruction. Executing the security initialization instruction may cause several operations to be performed including transmitting a start transaction including a base address of the particular range of addresses. In addition, executing the security instruction may also cause another operation to be performed including retrieving the secure operating system code segment loader from the system memory and transmitting the secure operating system code segment loader for validation as a plurality of data transactions.

Abstract: A computer system includes a processor which may initialize a secure execution mode by executing a security initialization instruction. Further, the processor may operate in the secure execution mode by executing a secure operating system code segment. The computer system also includes an input/output (I/O) interface coupled to the processor via an I/O link. The I/O interface may receive transactions performed as a result of the execution of the security initialization instruction. The transactions include at least a portion of the secure operating system code segment. The I/O interface may also determine whether the processor is a source of the transactions. The computer system further includes a security services processor coupled to the I/O interface via a peripheral bus. The I/O interface may convey the transactions to the security services processor dependent upon determining that the processor is the source of the transactions.

Abstract: A method for controlling operation of a secure execution mode-capable processor includes receiving access requests to a plurality of addressable locations within a system memory. The method may further include preventing the access requests from completing in response to determining that the secure execution mode-capable processor is operating in a secure execution mode.

Abstract: In one embodiment, a register in a processor is programmable with an intercept indication indicative of whether or not an event that would cause a transition by the processor to a first mode is to be intercepted during execution of a guest. Responsive to the intercept indication and further responsive to detecting the event, execution circuitry in the processor is configured to exit the guest. In another embodiment, a method comprises: detecting an event that would cause a processor to transition to a first mode, wherein first code is to be executed in the first mode; and causing the first code to be executed in a guest responsive to the detecting. In still another embodiment, a computer accessible medium comprising instructions which when executed in response to detecting the event, cause the first code to be executed in a guest.

Abstract: A method of controlling access to a control register of a microprocessor. The method of controlling access to a control register of a processor having a normal execution mode and a secure execution mode may include storing state and mode information in the control register, allowing a software invoked write access to modify the state and mode information within the control register during the normal execution mode and selectively inhibiting the software invoked write access during the secure execution mode.

Abstract: A processor supports a mode in which the default operand size is 32 bits, but which supports operand size overrides to 64 bits. Furthermore, the default operand size may automatically be overridden to 64 bits for instructions having an implicit stack pointer reference and for near branch instructions. The overriding of the default operand size may occur without requiring an operand size override encoding in these instructions. In one embodiment, the instruction set specifying the instructions may be a variable byte length instruction set (e.g. x86), and the operand size override encoding may be a prefix byte which increases the instruction length.

Abstract: A method is provided for controlling interrupts in a secure execution mode-capable processor. The method includes detecting an interrupt and performing a predetermined routine in response to detecting the interrupt. The method further includes performing a second routine prior to performing the predetermined routine in response to detecting the interrupt depending upon whether the processor is operating in a secure execution mode.

Abstract: In one embodiment, a processing node includes a plurality of processor cores and a reconfigurable interconnect. The processing node also includes a controller configured to schedule transactions received from each processor core. The interconnect may be coupled to convey between a first processor core and the controller, transactions that each include a first corresponding indicator that indicates the source of the transaction. The interconnect may also be coupled to convey transactions between a second processor core and the controller, transactions that each include a second corresponding indicator that indicates the source of the transaction. When operating in a first mode, the interconnect is configurable to cause the first indicator to indicate that the corresponding transactions were conveyed from the second processor core and to cause the second indicator to indicate that the corresponding transactions were conveyed from the first processor core.

Abstract: A system is configured to selectively block peripheral accesses to system memory. The system includes a secure execution mode (SEM)-capable processor configured to operate in a trusted execution mode. The system also includes a system memory including a plurality of addressable locations. The system further includes a memory controller that may determine a source of an access request to one or more of the plurality of locations of the system memory. The memory controller may further allow the access request to proceed in response to determining that the source of the access request is the SEM-capable processor.

Abstract: Controlling access to a control register of a microprocessor. A method of controlling access to a control register such as CR3, for example, of a processor having a normal execution mode and a secure execution mode may include storing address translation table information in the control register, allowing a software invoked write access to modify the address translation table information during the normal execution mode and selectively inhibiting the software invoked write during the secure execution mode.

Abstract: A method of controlling a secure execution mode-capable processor includes allowing a plurality of interrupts to interrupt the secure execution mode-capable processor when the secure execution mode-capable processor is operating in a non-secure execution mode. The method also includes disabling the plurality of interrupts from interrupting the secure execution mode-capable processor when the secure execution mode-capable processor is operating in a secure execution mode.

Abstract: A processor supports a processing mode in which the address size is greater than 32 bits and the operand size may be 32 or 64 bits. The address size may be nominally indicated as 64 bits, although various embodiments of the processor may implement any address size which exceeds 32 bits, up to and including 64 bits, in the processing mode. The processing mode may be established by placing an enable indication in a control register into an enabled state and by setting a first operating mode indication and a second operating mode indication in a segment descriptor to predefined states. Other combinations of the first operating mode indication and the second operating mode indication may be used to provide compatibility modes for 32 bit and 16 bit processing compatible with the x86 processor architecture (with the enable indication remaining in the enabled state).

Abstract: A processor executes a system call instruction. The processor includes at least two registers in which target addresses may be stored, and selects the target address from one of the registers responsive to the operating mode. Different target addresses may be programmed into the registers, and thus the operating mode of the code sequence may be indicated by which target address is selected.

Abstract: A method of controlling access to an address translation data structure of a computer system. The computer system includes a processor having a normal execution mode and a secure execution mode. The method includes executing code and generating a linear address. During translation of the linear address into a physical address, the method also includes generating a read-only page fault exception during the normal execution mode in response to detecting a software invoked write access to an address translation data structure having a read/write attribute set to be read-only. The method further includes selectively generating either the read-only page fault exception or a security exception during the secure execution mode in response to detecting the software invoked write access.

Abstract: A processor generates a mode indication based on two or more other indications. The mode indication is indicative of whether or not a particular mode is active in the processor. Each indication is stored in a storage location which is addressable via a different instruction. In one embodiment, a long mode in which a 64 bit operating mode is selectable in addition to 32 bit and 16 bit modes may be activated via a long mode active indication. The long mode active indication may be generated by the processor, and may indicate that long mode is active if paging is enabled and a long mode enable indication indicates that long mode is enabled. In this manner, long mode may be activated after paging is enabled (with a set of long mode page tables indicated by the page table base address).