Ultra-secure accelerators

A computer system, comprising:

• a multi-core processor, including:
• a plurality of processor cores;
• a plurality of processor registers;
• an interconnect fabric, communicatively coupled to each processor core;
• a memory controller, communicatively coupled to the interconnect fabric and having one or more memory channels;
• and
• an input-output (IO) interface, communicatively coupled to the interconnect fabric;
• system memory comprising one or more memory devices, each communicatively coupled to at least one memory channel of the memory controller;
• and
• a shared virtual memory (SVM)-capable accelerator having one or more functional units, either embedded on the processor or communicatively coupled to the processor via the IO interface;
• wherein the system is configured to,
• enqueue, via execution of an execution thread on one of the plurality of processor cores, a record including a wrapping key and referencing a request descriptor for an accelerator or a request descriptor for an accelerator including a wrapping key, the request descriptor defining a job to be performed by the accelerator and including information associated with one or more buffers in the system memory to be accessed by the accelerator as part of the job and including a key;
• and
• process the job, wherein the accelerator,
• generates a decryption key using the wrapping key to unwrap the key in the request descriptor;
• decrypts encrypted data read from the one or more buffers in the system memory using the decryption key to produce decrypted data;
• and
• processes the decrypted data to perform one or more functions specified by the job.

A System on a Chip (SoC) processor comprising:

• a plurality of processor cores;
• a plurality of processor registers;
• an interconnect fabric, communicatively coupled to each processor core;
• a memory controller, communicatively coupled to the interconnect fabric and having one or more memory channels;
• one or more accelerators, communicatively coupled to the interconnect fabric, each accelerator having one or more functional units;
• and
• at least one request descriptor queue;
• wherein the processor is configured to be installed in a computer system including system memory comprising one or more memory devices coupled to the one or more memory channels when the processor is installed in the computer system, the computer system employing a shared virtual memory (SVM) architecture, and wherein each of at least a portion of the processor cores has an instruction set architecture (ISA) including an enqueue (ENQ) instruction that, upon execution, causes the processor to:
• enqueue a record in a request descriptor queue including a wrapping key and referencing an address of a request descriptor, the request descriptor defining a job to be performed by an accelerator among the one or more accelerators and including information associated with one or more buffers in the system memory to be accessed by the accelerator as part of the job and including a wrapped key;
• and
• wherein the accelerator is configured to,
• read the request descriptor referenced in the record from system memory;
• access the wrapping key from the accelerator portal;
• generate a decryption key using the wrapping key to unwrap the wrapped key in the request descriptor;
• decrypt encrypted data read from the one or more buffers in the system memory using the decryption key to produce decrypted data;
• and
• process the decrypted data to perform one of more functions specified by the job.