Supervisor mode execution protection

Patent metadata

Field	Value
Publication number	US-9323533-B2
Application number	US-201113997857-A
Country	US
Kind code	B2
Filing date	Dec 29, 2011
Priority date	Dec 29, 2011
Publication date	Apr 26, 2016
Grant date	Apr 26, 2016

Abstract

Apparatuses and methods for supervisor mode execution protection are disclosed. In one embodiment, a processor includes an interface to access a memory, execution hardware, and control logic. A region in the memory is user memory. The execution hardware is to execute an instruction. The control logic is to prevent the execution hardware from executing the instruction when the instruction is stored in user memory and the processor is in supervisor mode.

First claim

What is claimed is:

1. A processor comprising:
an interface to access a memory, wherein a region in the memory is user memory;
execution hardware to execute an instruction;
control logic to prevent the execution hardware from executing the instruction when the instruction is stored in user memory and the processor is in supervisor mode;
a paging unit, wherein the paging unit is to translate a linear address to a physical address using a page table hierarchy, and the region may be designated as user memory by a flag at any level in the page table hierarchy;
and wherein the execution unit is also to execute a processor identification instruction by returning an indication that the processor includes control logic to prevent the processor from executing from user memory when the processor is in supervisor mode.

2. The processor of claim 1 , further comprising instruction hardware to fetch the instruction, wherein the control logic is to prevent the execution hardware from executing the instruction by preventing the instruction hardware from fetching the instruction from user memory when the processor is in supervisor mode.

3. The processor of claim 1 , wherein the processor is in supervisor mode when executing software in a privilege level higher than a lowest privilege level.

4. The processor of claim 1 , further comprising processing storage including a programmable storage location to enable the control logic to prevent the processor from executing from user memory when the processor is in supervisor mode.

5. A method comprising:
attempting, by software running on a processor in supervisor mode, to execute an instruction;
preventing the processor from executing the instruction when the instruction is stored in user memory;
a paging unit, wherein the paging unit is to translate a linear address to a physical address using a page table hierarchy, and the region may be designated as user memory by a flag at any level in the page table hierarchy;
and wherein the execution unit is also to execute a processor identification instruction by returning an indication that the processor includes control logic to prevent the processor from executing from user memory when the processor is in supervisor mode.

6. The method of claim 5 , wherein attempting includes attempting to fetch the instruction from memory, and preventing includes preventing fetching the instruction from user memory.

7. The method of claim 5 , wherein preventing includes causing a fault.

8. The method of claim 5 , further comprising executing a processor identification instruction to determine that the processor supports preventing execution from user memory when in supervisor mode.

9. The method of claim 5 , further comprising writing to a control register to enable prevention of execution from user mode when the processor is in supervisor mode.

10. The method of claim 5 , further comprising attempting, by the processor running in user mode, to execute the instruction.

11. The method of claim 10 , further comprising allowing the processor running in user mode to execute the instruction.

12. The method of claim 10 , wherein attempting, by the processor running in user mode, to execute the instruction includes attempting, by the processor running in user mode, to fetch the instruction.

13. The method of claim 11 , wherein allowing the processor running in user mode to execute the instruction includes allowing the processor running in user mode to fetch the instruction.

14. A system comprising:
a memory, including a region of user memory; and
a processor coupled to the memory, including execution hardware to execute an instruction,
control logic to prevent the execution hardware from executing the instruction when the instruction is stored in user memory and the processor is in supervisor mode;
a paging unit, wherein the paging unit is to translate a linear address to a physical address using a page table hierarchy, and the region may be designated as user memory by a flag at any level in the page table hierarchy;
and wherein the execution unit is also to execute a processor identification instruction by returning an indication that the processor includes control logic to prevent the processor from executing from user memory when the processor is in supervisor mode.

15. The system of claim 14 , wherein the processor also includes instruction hardware to fetch the instruction, wherein the control logic is to prevent the execution hardware from executing the instruction by preventing the instruction hardware from fetching the instruction from user memory when the processor is in supervisor mode.

16. The system of claim 14 , wherein the processor is in supervisor mode when executing software in a privilege level higher than a lowest privilege level.

17. The system of claim 14 , wherein the memory is accessible as a plurality of pages, and user memory includes a subset of the plurality of pages.

Assignees

• Ven Adriaan Van De
• Patel Baiju V
• Mallick Asit K
• Neiger Gilbert
• Coke James S
• Dixon Martin G
• Brandt Jason W
• Intel Corp

Inventors

• Ven Adriaan Van De
• Patel Baiju V
• Mallick Asit K
• Neiger Gilbert
• Coke James S
• Dixon Martin G
• Brandt Jason W

Classifications

• G06F12/0292 Primary

  using tables or multilevel address translation means (G06F12/023 takes precedence; address translation in virtual memory systems G06F12/10) · CPC title

• G06F12/1491

  in a hierarchical protection system, e.g. privilege levels, memory rings · CPC title

• G06F9/30189 Primary

  according to execution mode, e.g. mode flag · CPC title

• G06F12/1009

  using page tables, e.g. page table structures · CPC title

• G06F9/30043

  LOAD or STORE instructions; Clear instruction · CPC title