Supporting secure memory intent

Patent metadata

Field	Value
Publication number	US-10922241-B2
Application number	US-201916402442-A
Country	US
Kind code	B2
Filing date	May 3, 2019
Priority date	Jun 12, 2015
Publication date	Feb 16, 2021
Grant date	Feb 16, 2021

Abstract

A processor for supporting secure memory intent is disclosed. The processor of the disclosure includes a memory execution unit to access memory and a processor core coupled to the memory execution unit. The processor core is to receive a request to access a convertible page of the memory. In response to the request, the processor core to determine an intent for the convertible page in view of a page table entry (PTE) corresponding to the convertible page. The intent indicates whether the convertible page is to be accessed as at least one of a secure page or a non-secure page.

First claim

What is claimed is:

1. A system on a chip (SoC) comprising:
an interconnect;
a processor coupled with the interconnect, the processor including:
a shared cache; and
a plurality of cores, including a first core, coupled to the shared cache, the first core including a decode unit to decode instructions, including a given instruction received from a guest virtual machine and indicating a given virtual address;

at least one translation lookaside buffer (TLB) to store translations of virtual addresses to physical addresses;
a page miss handler to perform a page table walk in page tables to identify a page table entry to map the given virtual address to a corresponding physical address and having a security indicator bit corresponding to the physical address, the security indicator bit to either be set to one to indicate a page of a memory at the physical address is an encrypted page, or cleared to zero to indicate the page is an unencrypted page;
a plurality of memory controllers, including a first memory controller, coupled with the interconnect, the first memory controller to control access to the page of the memory;
a memory encryption engine to encrypt data stored to the page, and decrypt data read from the page, if the security indicator bit is set to one;
a register to indicate which bit of the page table entry is the security indicator bit, wherein the register is readable by software;
a plurality of bus controller units coupled with the interconnect, the plurality of bus controller units to control access to a bus; and
a system agent unit coupled with the interconnect, the system agent unit to regulate a power state of the plurality of cores.

2. The SoC of claim 1 , wherein the register is a read-only register.

3. The SoC of claim 1 , wherein which bit of the page table entry is the security indicator bit is model specific.

4. The SoC of claim 1 , wherein the register is a model specific register (MSR).

5. The SoC of claim 1 , wherein the security indicator bit is to be determined based on a combination of a bit in a guest page table and a bit in an extended page table.

6. The SoC of claim 1 , wherein the memory is to include a portion that is not allowed to be converted between being either one of an encrypted portion and an unencrypted portion.

7. The SoC of claim 1 , wherein the secure indicator bit is capable of being set to one and cleared to zero by a guest operating system of the guest virtual machine, which is to be managed by a virtual machine manager.

8. The SoC of claim 1 , wherein the memory encryption engine is not to encrypt data stored to the page, and is not to decrypt data read from the page, if the security indicator bit is cleared to zero.

9. The SoC of claim 1 , wherein the at least one TLB is to store security indicator bits corresponding to the physical addresses, the translations to be searched for a translation of the given virtual address to the physical address and the security indicator bit corresponding to the physical address.

10. The SoC of claim 1 , wherein the memory encryption engine is included in the first memory controller.

11. The SoC of claim 1 , further comprising an audio processor coupled with the interconnect.

12. The SoC of claim 1 , wherein the first core comprises a plurality of XMM registers.

13. A system comprising:
a system on a chip (SoC) comprising:
an interconnect;
a processor coupled with the interconnect, the processor including:
a shared cache; and
a plurality of cores, including a first core, coupled to the shared cache, the first core including a decode unit to decode instructions, including a given instruction received from a guest virtual machine and indicating a given virtual address;

at least one translation lookaside buffer (TLB) to store translations of virtual addresses to physical addresses;
a page miss handler to perform a page table walk in page tables to identify a page table entry to map the given virtual address to a corresponding physical address and having a security indicator bit corresponding to the physical address, the security indicator bit to either be set to one to indicate a page of a memory at the physical address is an encrypted page, or cleared to zero to indicate the page is an unencrypted page;
a plurality of memory controllers, including a first memory controller, coupled with the interconnect, the first memory controller to control access to the page of the memory;
a memory encryption engine to encrypt data stored to the page, and decrypt data read from the page, if the security indicator bit is set to one;
a register to indicate which bit of the page table entry is the security indicator bit, wherein the register is readable by software;
a plurality of bus controller units coupled with the interconnect, the plurality of bus controller units to control access to a bus; and
a system agent unit coupled with the interconnect, the system agent unit to regulate a power state of the plurality of cores; and

a system memory coupled with the SoC.

14. The system of claim 13 , wherein the register is a read-only register.

15. The system of claim 13 , wherein which bit of the page table entry is the security indicator bit is model specific.

16. The system of claim 13 , wherein the register is a model specific register (MSR).

17. The system of claim 13 , wherein the security indicator bit is to be determined based on a combination of a bit in a guest page table and a bit in an extended page table.

18. The system of claim 13 , wherein the memory is to include a portion that is not allowed to be converted between being either one of an encrypted portion and an unencrypted portion, wherein the secure indicator bit is capable of being set to one and cleared to zero by a guest operating system of the guest virtual machine, which is to be managed by a virtual machine manager, and wherein the memory encryption engine is not to encrypt data stored to the page, and is not to decrypt data read from the page, if the security indicator bit is cleared to zero.

19. The system of claim 13 , wherein the system memory comprises a dynamic random access memory (DRAM).

20. A method performed by a system on a chip (SoC), the method comprising:
transmitting data on an interconnect;
receiving data from the interconnect at a processor;
storing data in a shared cache of the processor;
accessing data from the shared cache with a plurality of cores of the processor that share the shared cache;
decoding instructions, including a given instruction received from a guest virtual machine and indicating a given virtual address, with a decode unit of a first core of the plurality of cores;
storing translations of virtual addresses to physical addresses in at least one translation lookaside buffer (TLB) of the first core;
performing a page table walk in page tables to identify a page table entry to map the given virtual address to a corresponding physical address and having a security indicator bit corresponding to the physical address, the security indicator bit to either be set to one to indicate a page of a memory at the physical address is an encrypted page, or cleared to zero to indicate the page is an unencrypted page;
controlling access to the page of the memory with a memory controller;
encrypting data stored to the page, and decrypting data read from the page, if the security indicator bit is set to one;
reading an indication of which bit of the page table entry is the security indicator bit from a register;
controlling acc

Assignees

• Intel Corp

Inventors

• Zmudzinski Krystof C
• Chhabra Siddhartha
• Savagaonkar Uday R
• Johnson Simon P
• Leslie-Hurd Rebekah M
• Mckeen Francis X
• Neiger Gilbert
• Makaram Raghunandan
• Rozas Carlos V
• Santoni Amy L
• Scarlata Vincent R
• Shanbhogue Vedvyas
• Alexandrovich Ilya
• Anati Ittai
• Smith Wesley H
• Goldsmith Michael

Classifications

• G06F12/109

  for multiple virtual address spaces, e.g. segmentation (G06F12/1036 takes precedence) · CPC title

• G06F2212/1016

  Performance improvement · CPC title

• G06F12/1009 Primary

  using page tables, e.g. page table structures · CPC title

• G06F2212/657

  Virtual address space management · CPC title

• G06F12/1441

  for a range · CPC title