Processors, methods, systems, and instructions to support live migration of protected containers

Patent metadata

Field	Value
Publication number	US-11782849-B2
Application number	US-202117367349-A
Country	US
Kind code	B2
Filing date	Jul 3, 2021
Priority date	Jun 26, 2015
Publication date	Oct 10, 2023
Grant date	Oct 10, 2023

Abstract

A processor includes a decode unit to decode an instruction that is to indicate a page of a protected container memory, and a storage location outside of the protected container memory. An execution unit, in response to the instruction, is to ensure that there are no writable references to the page of the protected container memory while it has a write protected state. The execution unit is to encrypt a copy of the page of the protected container memory. The execution unit is to store the encrypted copy of the page to the storage location outside of the protected container memory, after it has been ensured that there are no writable references. The execution unit is to leave the page of the protected container memory in the write protected state, which is also valid and readable, after the encrypted copy has been stored to the storage location.

First claim

What is claimed is:

1. An apparatus including at least one chip, the apparatus comprising:
decode circuitry to decode an instruction;
circuitry, based on the instruction, to access a control structure, the control structure to store a plurality of cryptographic keys capable of being migrated from a source computer system to a destination computer system;
cryptographic circuitry, based on the instruction, to:
decrypt a copy of data with a first cryptographic key, the data to be within an encrypted portion of a virtual machine, wherein the apparatus is to protect the data within the encrypted portion of the virtual machine from being disclosed to a virtual machine monitor; and
generate encrypted data, based on the decrypted copy of the data, with a second, different cryptographic key; and

a memory controller, based on the instruction, to store the encrypted data generated by the cryptographic circuitry to a memory location outside of the encrypted portion of the virtual machine,
wherein the apparatus is to leave the data within the encrypted portion of the virtual machine valid and readable, after the encrypted data has been stored to the memory location outside of the encrypted portion of the virtual machine.

2. The apparatus of claim 1 , wherein the decode circuitry is to decode the instruction that is to implicitly indicate a register, the register to store instruction specification information for the instruction.

3. The apparatus of claim 1 , wherein the memory controller, based on the instruction, is to store the encrypted data generated by the cryptographic circuitry to the memory location outside of the encrypted portion of the virtual machine, as part of a migration of the virtual machine from the source computer system to the destination computer system.

4. The apparatus of claim 1 , wherein the second cryptographic key is one of the plurality of cryptographic keys capable of being migrated from the source computer system to the destination computer system.

5. An apparatus including at least one chip, the apparatus comprising:
a decode unit to decode an instruction;
a circuit to access a control structure in response to the instruction, the control structure to store a second cryptographic key capable of being migrated from a source computer system to a destination computer system;
a cryptographic circuitry, in response to the instruction, to:
decrypt a copy of data with a first cryptographic key, the data to be within an encrypted portion of a virtual machine, wherein the apparatus is to protect the data within the encrypted portion of the virtual machine from being disclosed to a virtual machine monitor; and
generate encrypted data based on the decrypted copy of the data with the second cryptographic key; and

a memory controller, in response to the instruction, to store the encrypted data generated by the cryptographic circuitry to a memory location outside of the encrypted portion of the virtual machine,
wherein the apparatus is to leave the data within the encrypted portion of the virtual machine valid and readable after the encrypted data has been stored to the memory location outside of the encrypted portion of the virtual machine.

6. The apparatus of claim 5 , wherein the decode unit is to decode the instruction that is to implicitly indicate a register, the register to store instruction specification information for the instruction.

7. The apparatus of claim 5 , wherein the apparatus is to perform message authentication code computations based on the copy of the data in response to the instruction.

8. The apparatus of claim 5 , wherein the memory controller, in response to the instruction, is to store the encrypted data generated by the cryptographic circuitry to the memory location outside of the encrypted portion of the virtual machine, as part of a migration of the virtual machine from the source computer system to the destination computer system.

Assignees

• Intel Corp

Inventors

• Rozas Carlos V
• Vij Mona
• Leslie-Hurd Rebekah M
• Zmudzinski Krystof C
• Chakrabarti Somnath
• Mckeen Francis X
• Scarlata Vincent R
• Johnson Simon P
• Alexandrovich Ilya
• Neiger Gilbert
• Shanbhogue Vedvyas
• Anati Ittai

Classifications

• G06F21/53

  by executing in a restricted environment, e.g. sandbox or secure virtual machine · CPC title

• G06F12/1408 Primary

  by using cryptography (for digital transmission H04L9/00) · CPC title

• G06F9/30145

  Instruction analysis, e.g. decoding, instruction word fields · CPC title

• G06F21/602 Primary

  Providing cryptographic facilities or services · CPC title

• G06F8/41

  Compilation · CPC title