1. A superscalar microprocessor for processing instructions having a program order, the microprocessor comprising:
a fetch circuit configured to fetch instructions, including a conditional branch instruction, from an instruction store;
a branch detection circuit configured to detect the conditional branch instruction from among the fetched instructions;
a branch bias circuit configured to receive a branch bias signal indicating whether a conditional branch controlled by the conditional branch instruction is predicted to be taken or not taken;
a stream identifier circuit configured to associate a stream identifier with one or more of the fetched instructions, thereby identifying a first stream predicted by the branch bias signal;
a buffer circuit configured to receive and buffer the fetched instructions;
a decode circuit coupled to the buffer circuit and configured to make a group of buffered instructions concurrently available for execution as decoded instructions, wherein the available decoded instructions include a decoded instruction corresponding to the conditional branch instruction and a decoded instruction from the first stream; and
an execution circuit including a plurality of functional units configured to execute the available decoded instructions out of the program order, wherein execution of the conditional branch instruction determines whether the conditional branch is taken,
wherein the fetch circuit is further configured to cancel instructions from the first stream based on the stream identifier in the event that the branch bias signal incorrectly predicts whether the conditional branch is taken.
2. The superscalar microprocessor of claim 1, wherein the functional units concurrently execute a first decoded instruction and a second decoded instruction, wherein according to the program order the first decoded instruction corresponds to an instruction that is prior to the conditional branch instruction and the second decoded instruction corresponds to an instruction from the first stream that is subsequent to the conditional branch instruction.
3. The superscalar microprocessor of claim 1, wherein the stream identifier comprises a stream bit.
4. The superscalar microprocessor of claim 1, wherein the stream identifier indicates an occurrence of a control flow change associated with the conditional branch instruction.
5. The superscalar microprocessor of claim 1, wherein the stream identifier is associated with a predetermined number of the fetched instructions.
6. The superscalar microprocessor of claim 1, wherein the fetch circuit fetches one or more instructions of a second stream not predicted by the branch bias signal before the decoded conditional branch instruction is executed.
7. The superscalar microprocessor of claim 1, further comprising a register file including a plurality of entries configured to store data including result data generated by the plurality of functional units, wherein each of the plurality of entries is accessible by reference to a respective location in the register file.
8. The superscalar microprocessor of claim 1, further comprising an instruction retirement circuit configured to receive operation completion information from the plurality of functional units and to retire the executed instructions according to the program order.
9. The superscalar microprocessor of claim 8 wherein the fetch circuit fetches one or more instructions of a second stream not predicted by the branch bias signal before the conditional branch instruction is retired.
10. The superscalar microprocessor of claim 1, further comprising an instruction retirement circuit configured to receive result data from the plurality of functional units, the result data including branch result data associated with the conditional branch instruction, and to confirm the result data according to the program order.
11. The superscalar microprocessor of claim 10, wherein the fetch circuit fetches one or more instructions of a second stream not predicted by the branch bias signal before the branch result data is confirmed by the instruction retirement circuit.
12. The superscalar microprocessor of claim 1, wherein the buffer circuit is further configured to cancel instructions from the first stream based on the stream identifier in the event that the branch bias signal incorrectly predicts whether the conditional branch is taken.
13. The superscalar microprocessor of claim 1, wherein the decode circuit is further configured to concurrently decode a plurality of instructions including a first instruction and a second instruction, wherein the second instruction has a data dependency on the first instruction.
14. In a superscalar microprocessor, a method for processing instructions having a program order, the method comprising the steps of:
fetching instructions from an instruction store;
detecting a conditional branch instruction from among the plurality of fetched instructions;
receiving a branch bias signal associated with the conditional branch instruction, the branch bias signal indicating whether the conditional branch is predicted to be taken or not taken;
associating a stream identifier with one or more of the fetched instructions, thereby identifying a first stream predicted by the branch bias signal;
making a group of the fetched instructions concurrently available for execution, wherein the available instructions include the conditional branch instruction and an instruction from the first stream;
executing the available instructions out of the program order, wherein execution of the conditional branch instruction determines whether the conditional branch is taken;
determining, based on the execution of the conditional branch instruction, whether the branch bias signal correctly predicted whether the conditional branch is taken; and
in the event that the branch bias signal incorrectly predicted whether the conditional branch is taken, canceling instructions from the first stream based on the stream identifier.
15. The method of claim 14, wherein the executing step includes concurrently executing a first instruction and a second instruction, wherein according to the program order the first instruction is prior to the conditional branch instruction and the second instruction is an instruction from the first stream that is subsequent to the conditional branch instruction.
16. The method of claim 14, wherein the stream identifier comprises a stream bit.
17. The method of claim 14, wherein the stream identifier indicates an occurrence of a control flow change associated with the conditional branch instruction.
18. The method of claim 14, wherein the stream identifier is associated with a predetermined number of the plurality of instructions.
19. The method of claim 14, wherein the fetching step further includes fetching instructions from a second stream not predicted by the branch bias signal prior to execution of the conditional branch instruction.
20. The method of claim 14, further comprising the steps of:
receiving operation completion information generated during the step of executing; and
retiring the executed instructions according to the program order in response to the operation completion information,
wherein the step of fetching includes fetching instructions from a second stream not predicted by the branch bias signal prior to retiring the conditional branch instruction.
21. The method of claim 14, further comprising the steps of:
receiving operation completion information and result data generated during the step of executing, the result data including branch result data generated during execution of the conditional branch instruction; and
confirming the result data according to the program order and in response to the operation completion information,
wherein the step of fetching and buffering includes fetching instructions from a second stream not predicted by the branch bias signal prior to confirming the branch result data.
22. The method of claim 14 wherein making the group of fetched instructions concurrently available for execution includes concurrently decoding a first one and a second one of the group of the fetched instructions, wherein the second one of the instructions has a data dependency on the first one of the instructions.
23. A computer system, comprising:
a memory;
a superscalar microprocessor for processing instructions having a program order; and
a bus coupled between the memory and the microprocessor,
wherein the microprocessor includes:
a fetch circuit configured to fetch instructions, including a conditional branch instruction, from an instruction store;
a branch detection circuit configured to detect the conditional branch instruction from among the fetched instructions;
a branch bias circuit configured to receive a branch bias signal indicating whether a conditional branch controlled by the conditional branch instruction is predicted to be taken or not taken;
a stream identifier circuit configured to associate a stream identifier with one or more of the fetched instructions, thereby identifying a first stream predicted by the branch bias signal;
a buffer circuit configured to receive and buffer the fetched instructions;
a decode circuit coupled to the buffer circuit and configured to make a group of buffered instructions concurrently available for execution as decoded instructions, wherein the available decoded instructions include a decoded instruction corresponding to the conditional branch instruction and a decoded instruction from the first stream; and
an execution circuit including a plurality of functional units configured to execute the available decoded instructions out of the program order, wherein execution of the conditional branch instruction determines whether the conditional branch is taken,
wherein the fetch circuit is further configured to cancel instructions from the first stream based on the stream identifier in the event that the branch bias signal incorrectly predicts whether the conditional branch is taken.
24. The system of claim 23, wherein the functional units concurrently execute a first decoded instruction and a second decoded instruction, wherein according to the program order the first decoded instruction corresponds to an instruction that is prior to the conditional branch instruction and the second decoded instruction corresponds to an instruction from the first stream that is subsequent to the conditional branch instruction.
25. The system of claim 23, wherein the stream identifier comprises a stream bit.
26. The system of claim 23, wherein the stream identifier indicates an occurrence of a control flow change associated with the conditional branch instruction.
27. The system of claim 23, wherein the stream identifier is associated with a predetermined number of the fetched instructions.
28. The system of claim 23, wherein the fetch circuit fetches one or more instructions of a second stream not predicted by the branch bias signal before the decoded conditional branch instruction is executed.
29. The system of claim 23, wherein the microprocessor further includes a register file including a plurality of entries configured to store data including result data generated by the plurality of functional units, wherein each of the plurality of entries is accessible by reference to a respective location in the register file.
30. The system of claim 23, wherein the microprocessor further includes an instruction retirement circuit configured to receive operation completion information from the plurality of functional units and to retire the executed instructions according to the program order.
31. The system of claim 30, wherein the fetch circuit fetches one or more instructions of a second stream not predicted by the branch bias signal before the conditional branch instruction is retired.
32. The system of claim 23, wherein the microprocessor further includes an instruction retirement circuit configured to receive result data from the plurality of functional units, the result data including branch result data associated with the conditional branch instruction, and to confirm the result data according to the program order.
33. The system of claim 32, wherein the fetch circuit fetches one or more instructions of a second stream not predicted by the branch bias signal before the branch result data is confirmed by the instruction retirement circuit.
34. The system of claim 23, wherein the buffer circuit is further configured to cancel instructions from the first stream based on the stream identifier in the event that the branch bias signal incorrectly predicts whether the conditional branch is taken.
35. The system of claim 23, wherein the decode circuit is further configured to concurrently decode a plurality of instructions including a first instruction and a second instruction, wherein the second instructions has a data dependency on the first instruction.
The claims below are in addition to those above.
All refrences to claim(s) which appear below refer to the numbering after this setence.
1. A method for controlling access to a computing system resource, being accessed through a symbolic link file, with an externally stored resource comprising the steps of:
determining a system resource named in the symbolic link through which an access attempt is made;
searching a protected objects database for entries protecting said system resource and generating a list of said entries; and
generating an authorization decision for the access attempt based on security policies that govern all entries in the protected objects database that protect the system resource, the authorization decision being generated by retrieving a current entry from said generated database list; calling an access decision component of the externally stored resource to obtain an access decision for the access attempt based on the security policy that governs the current entry in the generated database list; determining whether the access decision component granted access; if the decision component granted access, determining whether more entries are in this database list;
and updating a current entry in said database list when more entries are in the list and returning to said current entry retrieving step.
2. The method as described in claim 1 wherein said control method grants access if said search does not find in the protected objects database, the system resource named in the symbolic link through which the access attempt is made.
3. The method as described in claim 1 further comprising the step of denying the access attempt when the decision component denies access based on the security policy for the current database entry.
4. The method as described in claim 1 further comprising the step of allowing the access attempt if no more entries are in the database list.
5. The method as described in claim 1 wherein said searching step comprises the steps of:
retrieving an entry from the protected objects database;
comparing the name of the database entry to the name of the system resource that is an object of the access attempt;
when there is a match between the database entry and the system resource name that is the object of the access attempt, determining whether the resource is named in a symbolic link that is listed in the protected object database; and
generating a list containing the exact found entry, when the entry is not named in a symbolic link listed in the protected object database.
6. The method as described in claim 1 wherein said searching step comprises the steps of:
retrieving an entry from the protected objects database;
comparing the name of the retrieved database entry to the name of the system resource that is the object of the access attempt;
when there is a match between the database entry and the name of the resource that is the object of the access attempt, determining whether the database entry is named in a symbolic link that is listed in the protected object database;
adding said entry to a list containing found entries, when the entry is named in a symbolic link listed in the protected object database;
determining whether there are more entries in the protected object database; and
updating a current database entry in said database when more entries are in the database and returning to said current entry retrieving step.
7. The method as described in claim 1 wherein said searching step comprises the steps of:
retrieving an entry from the protected objects database;
comparing the name of the retrieved database entry to the name of the system resource that is the object of the access attempt;
when there is a match between the database entry and the name of the resource that is the object of the access attempt, determining whether the database is named in a symbolic link that is listed in the protected object database;
adding said entry to a list containing found entries, when the entry is named in a symbolic link listed in the protected object database;
determining whether there are more entries in the protected object database; and
returning the list containing found entries, when there are no more entries.
8. The method as described in claim 1 further comprising before said retrieving step the step of generating a protected objects database.
9. The method as described in claim 8 comprising the steps of:
retrieving file attributes for a system resource file;
determining from said retrieved file attributes whether said resource file is a symbolic link file;
when resource file is a symbolic link, retrieving the name and attributes of the system resource named in the symbolic link; and
adding the symbolic link and system resource named in the symbolic link to the protected objects database.
10. The method as described in claim 8 comprising the steps of:
retrieving file attributes for a system resource file;
determining from said retrieved file attributes whether said resource file is a symbolic link file; and
terminating said method and processing the system resource file access attempt through other methods.
11. The method as described in claim 9 wherein said adding step comprises the steps of:
setting the system resource named in the symbolic link as the child of the symbolic link;
setting the symbolic link naming the resources as the parent of said resource; adding the symbolic link as an entry in the protected object database; and
adding the named resource as an entry in the protected objects database.
12. A method for controlling access to a computing system device being accessed through symbolic link, said access control being implemented through an externally stored resource and comprising the steps of:
monitoring the computing system for activities related to creating and accessing symbolic links that link to system resources;
generating an authorization decision governing a symbolic link creation attempt or a symbolic link access attempt based on security policies that govern all entries in the protected objects database that protect the system resource, the authorization decision being generated by retrieving a current entry from said generated database list; calling an access decision component of the externally stored resource to obtain an access decision for the access attempt based on the security policy that governs the current entry in the generated database list; determining whether the access decision component granted access; if the decision component granted access, determining whether more entries are in this database list; and updating a current entry in said database list when more entries are in the list and returning to said current entry retrieving step;
restricting the creation of symbolic link files based on the rules defined in the externally stored resource; and
restricting accesses to system resources that are linked to and accessed by a symbolic link.
13. A computer program product stored on a computer readable storage medium for controlling access to a computing system resource, being accessed through a symbolic link file, with an externally stored resource comprising:
instructions for determining a system resource named in the symbolic link through which the access attempt is made;
instructions for searching a protected objects database for entries protecting said system resources and generating a list of said entries; and
instructions for generating an authorization decision for the access attempt based on the security policies that govern all entries in the database protecting the system resource, the authorization decision being generated by instructions retrieving a current entry from said generated database list; instructions calling an access decision component of the externally stored resource to obtain an access decision for the access attempt based on the security policy that governs the current entry in the generated database list; instructions determining whether the access decision component granted access; if the decision component granted access, instructions determining whether more entries are in this database list; and instructions updating a current entry in said database list when more entries are in the list and returning to said current entry retrieving step.
14. The computer program product as described in claim 13 further comprising instructions for denying the access attempt when the decision component denies access based on the security policy for the current database entry.
15. The computer program product as described in claim 13 further comprising instructions for allowing the access attempt if no more entries in the database list.
16. The computer program product as described in claim 13 wherein said searching instructions comprise:
instructions for retrieving an entry from the protected objects database;
instructions for comparing the name of the database entry to the name of a system resource that is the object of the access attempt;
instructions for when there is a match between the database entry and the name of the resource that is the object of the access attempt, determining whether the system resource is named in a symbolic link that is listed in the protected object database; and
instructions for generating a list containing the exact found entry, when the entry is not named in a symbolic link listed in the protected object database.
17. The computer program product as described in claim 13 wherein said searching instructions comprise:
instructions for retrieving an entry from the protected objects database;
instructions for comparing the name of the database entry to the name of a system resource that is the object of the access attempt;
when there is a match between the database entry and the name of the resource that is the object of the access attempt, instructions for determining whether the database entry is named in a symbolic link that is listed in the protected object database;
instructions for adding said entry to a list containing found entries, when the entry is not named in a symbolic link listed in the protected object database;
instructions for determining whether there are more entries in the protected object database; and
instructions for updating a current database entry in said database when more entries are in the database and returning to said current entry retrieving step.
18. The computer program product as described in claim 13 wherein said searching instructions comprise:
instructions for retrieving an entry from a protected objects database;
instructions for comparing the name of the retrieved database entry to the name of a system resource that is the object of the access attempt;
when there is a match between the database entry and the name of the resource that is the object of the access attempt, instructions for determining whether the database is named in a symbolic link that is listed in the protected object database;
instructions for adding said entry to a list containing found entries, when the entry is not named in a symbolic link listed in the protected object database;
instructions for determining whether there are more entries in the protected object database; and
instructions for returning the list containing found entries.
19. The method as described in claim 18 further comprising before said retrieving instructions the instructions for generating a protected objects database.
20. A method for restricting the creation of a protected symbolic link that names a system resource comprising the steps of:
determining a system resource named in a proposed symbolic link;
searching a protected objects database for entries protecting said system resource named in the proposed symbolic link;
generating a list of file entries that contain the system resource named in a proposed symbolic link; and
generating an authorization decision for the access attempt based on security policies that govern all entries in the protected objects database that protect the system resource, the authorization decision being generated by retrieving a current entry from said generated database list; calling a creation decision component of the externally stored resource to obtain a decision for the symbolic link creation attempt based on the security policy that governs the current entry in the generated database list; determining whether the creation decision component allows creation of a symbolic link; if the decision component allowed creation, determining whether more entries are in this database list; updating a current entry in said database list when more entries are in the list and returning to said current entry retrieving step.
21. The method as described in claim 20 wherein said restriction method allows a creation attempt if said search does not find in a protected objects database, the resource named in the proposed symbolic link.
22. The method as described in claim 20 further comprising the step of denying the creation attempt when the decision component denies the creation attempt based on the security policies that govern all entries in the database protecting the system resource.
23. The method as described in claim 20 further comprising the step of allowing the symbolic link creation attempt if no more entries in the database list.
24. The method as described in claim 20 further comprising before said retrieving step the step of generating a protected objects database.