Indicating a privilege level

Patent metadata

Field	Value
Publication number	US-10534739-B2
Application number	US-201415515743-A
Country	US
Kind code	B2
Filing date	Oct 31, 2014
Priority date	Oct 31, 2014
Publication date	Jan 14, 2020
Grant date	Jan 14, 2020

Abstract

A bus between a requester and a target component includes a portion dedicated to carry information indicating a privilege level, from among a plurality of privilege levels, of machine-readable instructions executed on the requester.

First claim

What is claimed is:

1. An electronic device comprising:
a requester comprising a hardware processor;
a first program executable at the requester;
a virtual machine comprising a second program executable at the requester;
a target component; and
a bus interconnecting the requester and the target component, wherein the bus comprises a first portion dedicated to carry information indicating a privilege level, from among a plurality of privilege levels, of a requester program that is one of the first program and second program, wherein the first program is associated with a first privilege level, and the second program is associated with a second privilege level different from the first privilege level, the requester program to initiate a request over the bus to the target component, and the requester to, in response to the request:
determine, by accessing a mapping structure that maps different programs to respective different privilege levels of the plurality of privilege levels, the privilege level for the requester program, and
responsive to the determining, set, in the first portion of the bus, the information indicating the privilege level,
wherein the requester is to set the first portion of the bus to a first value indicating the first privilege level in response to the first program initiating the request over the bus, and
wherein the requester is to set the first portion of the bus to a second value indicating the second privilege level in response to the second program in the virtual machine initiating the request over the bus.

2. The electronic device of claim 1 , wherein the bus comprises a second portion to carry an address of the request.

3. The electronic device of claim 1 , wherein the first portion of the bus comprises at least one lane settable to different values by the requester for indicating the respective different privilege levels of the plurality of privilege levels.

4. The electronic device of claim 1 , wherein the first portion of the bus comprises a plurality of lanes settable to different values by the requester for indicating the respective different privilege levels of the plurality of privilege levels.

5. The electronic device of claim 1 , further comprising a memory controller to set the information carried in the first portion of the bus.

6. The electronic device of claim 1 , wherein the bus comprises a memory bus or an input/output (I/O) bus.

7. The electronic device of claim 1 , wherein the target component is to apply an action based on the privilege level indicated by the information in the first portion, wherein the target component is to perform different actions responsive to the respective different privilege levels of the plurality of privilege levels.

8. A method comprising:
receiving, by a requester comprising a hardware processor, a request from requester program to access a target component, wherein a first program and a virtual machine comprising a second program are executable at the requester;
in response to the request, determining, by the requester by accessing a mapping structure that maps different programs to respective different privilege levels, a privilege level for the requester program, wherein the first program is associated with a first privilege level, and the second program in the virtual machine is associated with a second privilege level different from the first privilege level;
responsive to the determining, setting, in a first portion of a bus that interconnects the requester and the target component, information indicating the privilege level, the first portion of the bus dedicated to carry the information indicating the privilege level, wherein the requester sets the first portion of the bus to a first value indicating the first privilege level in response to the first program initiating the request over the bus, and wherein the requester sets the first portion of the bus to a second value indicating the second privilege level in response to the second program in the virtual machine initiating the request over the bus; and
sending the request and the information indicating the privilege level over the bus to the target component, the information indicating the privilege level included in the first portion of the bus.

9. The method of claim 8 , further comprising:
accessing, by the target component, policy information in response to the information indicating the privilege level to determine an action to apply; and
applying, by the target component, the action, wherein different actions are performed by the target component responsive to the respective different privilege levels.

10. The method of claim 8 , wherein the bus comprises a plurality of lanes, wherein the first portion comprises a first subset of the lanes dedicated to carrying the information indicating the privilege level, and wherein a second subset of the lanes carries an address.

11. A controller comprising:
an interface to receive information relating to execution of a requester program that issued a request, the requester program being one of a first program and a second program, the second program included in a virtual machine;
a bus interface to a bus; and
a processing circuit to:
determine, based on the information and by accessing a mapping structure that maps different programs to respective different privilege levels of a plurality of privilege levels, a privilege level of the requester program, wherein the first program is associated with a first privilege level, and the second program in the virtual machine is associated with a second privilege level different from the first privilege level; and
based on the determined privilege level, set a privilege information portion of a bus to a value selected from a plurality of values, the plurality of values corresponding to respective privilege levels of the different privilege levels, the value indicating the determined privilege level, and the privilege information portion of the bus comprising a dedicated subset of lanes of the bus, wherein the processing circuit is to set the privilege information portion of the bus to a first value indicating the first privilege level in response to the first program issuing the request, and wherein the processing circuit is to set the privilege information portion of the bus to a second value indicating the second privilege level in response to the second program in the virtual machine issuing the request.

12. The controller of claim 11 , wherein a second subset of the lanes comprises an address, and a third subset of the lanes comprises control information identifying a type of operation on the bus.

13. The electronic device of claim 5 , wherein the memory controller is part of the requester.

14. The electronic device of claim 1 , wherein the first portion of the bus is reserved for carrying information indicating privilege levels of the plurality of privilege levels, and is not for carrying other information.

15. The method of claim 8 , wherein the requester comprises a memory controller to set, in the first portion of the bus, the information indicating the privilege level.

Assignees

• Hewlett Packard Entpr Dev Lp

Inventors

• Villatel Maugan
• Plaquin David
• Dalton Chris I

Classifications

• G06F21/78

  to assure secure storage of data (address-based protection against unauthorised use of memory G06F12/14; record carriers for use with machines and with at least a part designed to carry digital markings G06K19/00) · CPC title

• G06F12/1491

  in a hierarchical protection system, e.g. privilege levels, memory rings · CPC title

• G06F13/40 Primary

  Bus structure {(for computer networks G06F15/163; for optical bus networks H04B10/25)} · CPC title

• G06F13/36

  for access to common bus or bus system · CPC title

• G06F21/6218

  to a system of files or objects, e.g. local or distributed file system or database · CPC title