# US 2014/0195823 A1 · Microprocessor that facilitates task switching between encrypted and unencrypted programs > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2014/0195823 A1 - Document ID: US20140195823A1 - Status: Published application - Kind: A1 - Application number: 14/066,485 - Filed: 2013-10-29 - Published: 2014-07-10 - Earliest claimed: 2010-05-25 - Assignees: VIA Technologies, Inc. - Applicants: VIA Technologies, Inc. - Inventors: G. Glenn Henry; Terry Parks; Brent Bean; Thomas A. Crispin - Web page: https://patentgrep.com/patent/US20140195823A1 ## CPC - H04L 9/0827: {involving distinctive intermediate devices or communication paths (network architectures or network communication protocols using different networks H04L63/18)} - G06F 9/30003: {Arrangements for executing specific machine instructions} - G06F 9/30058: {Conditional branch instructions} - G06F 9/30079: {Pipeline control instructions, e.g. multicycle NOP} - G06F 9/30178: {of compressed or encrypted instructions} - G06F 9/30189: {according to execution mode, e.g. mode flag} - G06F 12/0875: with dedicated cache, e.g. instruction or stack - G06F 21/52: during program execution, e.g. stack integrity {; Preventing unwanted data erasure; Buffer overflow} - G06F 21/54: by adding security routines or objects to programs - G06F 21/602: {Providing cryptographic facilities or services} - G06F 21/71: to assure secure computing or processing of information - G06F 21/72: in cryptographic circuits - H04L 9/0618: {Block ciphers, i.e. encrypting groups of characters of a plain text message using fixed encryption transformation} - H04L 9/0861: {Generation of secret information including derivation or calculation of cryptographic keys or passwords} - H04L 9/0891: {Revocation or update of secret information, e.g. encryption key update or rekeying} - H04L 9/0894: {Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage} - G06F 2212/402: Encrypted data - G06F 2212/452: Instruction code - G06F 2221/2107: File encryption - H04L 2209/12: Details relating to cryptographic hardware or logic circuitry - H04L 2209/20: Manipulating the length of blocks of bits, e.g. padding or block truncation - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A microprocessor includes an architected register having a bit. The microprocessor sets the bit. The microprocessor also includes a fetch unit that fetches encrypted instructions from an instruction cache and decrypts them prior to executing them, in response to the microprocessor setting the bit. The microprocessor saves the value of the bit to a stack in memory and then clears the bit, in response to receiving an interrupt. The fetch unit fetches unencrypted instructions from the instruction cache and executes them without decrypting them, after the microprocessor clears the bit. The microprocessor restores the saved value from the stack in memory to the bit in the architected register, in response to executing a return from interrupt instruction. The fetch unit resumes fetching and decrypting the encrypted instructions, in response to determining that the restored value of the bit is set. ## Claims ### Claim 1 A microprocessor, comprising: an architected register, having a bit, wherein the microprocessor is configured to set the bit; and a fetch unit, configured to fetch encrypted instructions from an instruction cache and decrypt them prior to executing them, in response to the microprocessor setting the bit; wherein the microprocessor is configured to save the value of the bit to a stack in memory and then clear the bit, in response to receiving an interrupt; wherein the fetch unit is configured to fetch unencrypted instructions from the instruction cache and execute them without decrypting them, after the microprocessor clears the bit; wherein the microprocessor is configured to restore the saved value from the stack in memory to the bit in the architected register, in response to executing a return from interrupt instruction; and wherein the fetch unit is configured to resume fetching and decrypting the encrypted instructions, in response to determining that the restored value of the bit is set. ### Claim 2 (depends on 1) The microprocessor of claim 1, wherein the bit in the architected register is a reserved bit in an x86 architecture EFLAGS register. ### Claim 3 (depends on 1) The microprocessor of claim 1, further comprising: wherein to decrypt the encrypted instructions the fetch unit is configured to perform a Boolean exclusive-OR (XOR) operation of the encrypted instructions with a decryption key, if the bit is set; wherein the fetch unit is configured to perform a Boolean exclusive-OR (XOR) operation of the unencrypted instructions with zeroes, if the bit is clear. ### Claim 4 (depends on 1) The microprocessor of claim 1, wherein the microprocessor is configured to execute system software that receives a request to run a first program comprising encrypted instructions and, if a second program comprising encrypted instructions is already running on the microprocessor, waits to run the first encrypted program until the second encrypted program completes. ### Claim 5 (depends on 1) The microprocessor of claim 1, wherein the microprocessor is configured to flush all instruction bytes fetched from the instruction cache in buffers waiting to be decrypted, in response to executing the return from interrupt instruction. ### Claim 6 (depends on 1) The microprocessor of claim 1, wherein the architected register further has index bits that specify a location of storage space in the microprocessor for holding decryption keys used by the fetch unit to decrypt the encrypted instructions. ### Claim 7 (depends on 6) The microprocessor of claim 6, wherein the microprocessor is configured to save the value of the index bits to the stack in memory, in response to receiving the interrupt, and to restore the saved value of the index bits from the stack in memory to the index bits in the architected register, in response to executing the return from interrupt instruction. ### Claim 8 (depends on 7) The microprocessor of claim 7, wherein the microprocessor is configured to load the decryption keys from the location of the storage space specified by the restored value of the index bits, prior to the fetch unit resuming decrypting the encrypted instructions. ### Claim 9 (depends on 6) The microprocessor of claim 6, wherein the index bits are populated by system software executing on the microprocessor prior to resuming decrypting the encrypted instructions. ### Claim 10 A method for operating a microprocessor having an instruction cache and an architected register, the method comprising: setting a bit in the architected register and then fetching encrypted instructions from the instruction cache and decrypting them prior to executing them; saving the value of the bit in the architected register and then clearing the bit, in response to receiving an interrupt; fetching unencrypted instructions from the instruction cache and executing them without decrypting them, after said clearing the bit; restoring the saved value to the bit in the architected register, in response to executing a return from interrupt instruction; and resuming said fetching and decrypting and executing the encrypted instructions, in response to determining that the restored value of the bit is set. ### Claim 11 (depends on 10) The method of claim 10, wherein the bit in the architected register is a reserved bit in the x86 architecture EFLAGS register. ### Claim 12 (depends on 11) The method of claim 11, further comprising: wherein said decrypting the encrypted instructions comprises performing a Boolean exclusive-OR (XOR) operation of the encrypted instructions with a decryption key if the bit is set; and wherein said without decrypting the unencrypted instructions comprises performing a Boolean exclusive-OR (XOR) operation of the unencrypted instructions with zeroes if the bit is clear. ### Claim 13 (depends on 12) The method of claim 12, further comprising: receiving a request to run a first program comprising encrypted instructions; and if a second program comprising encrypted instructions is already running on the microprocessor, waiting to run the first encrypted program until the second encrypted program completes. ### Claim 14 (depends on 10) The method of claim 10, further comprising: flushing all instruction bytes fetched from the instruction cache in buffers waiting to be decrypted, in response to said executing the return from interrupt instruction. ### Claim 15 (depends on 10) The method of claim 10, wherein the architected register further has index bits that specify a location of storage space in the microprocessor for holding decryption keys used to decrypt the encrypted instructions. ### Claim 16 (depends on 15) The method of claim 15, further comprising: saving the value of the index bits to the stack in memory, in response to said receiving the interrupt; and restoring the saved value of the index bits from the stack in memory to the index bits in the architected register, in response to said executing the return from interrupt instruction. ### Claim 17 (depends on 16) The method of claim 16, further comprising: loading the decryption keys from the location of the storage space specified by the restored value of the index bits, prior to said resuming decrypting the encrypted instructions. ### Claim 18 (depends on 15) The method of claim 15, wherein the index bits are populated by system software executing on the microprocessor prior to said resuming decrypting the encrypted instructions. ### Claim 19 A computer program product encoded in at least one non-transitory computer usable medium for use with a computing device, the computer program product comprising: computer usable program code embodied in said medium, for specifying a microprocessor, the computer usable program code comprising: first program code for specifying an architected register, having a bit, wherein the microprocessor is configured to set the bit; and second program code for specifying a fetch unit, configured to fetch encrypted instructions from an instruction cache and decrypt them prior to executing them, in response to the microprocessor setting the bit; wherein the microprocessor is configured to save the value of the bit to a stack in memory and then clear the bit, in response to receiving an interrupt; wherein the fetch unit is configured to fetch unencrypted instructions from the instruction cache and execute them without decrypting them, after the microprocessor clears the bit; wherein the microprocessor is configured to restore the saved value from the stack in memory to the bit in the architected register, in response to executing a return from interrupt instruction; and wherein the fetch unit is configured to resume fetching and decrypting the encrypted instructions, in response to determining that the restored value of the bit is set. ### Claim 20 (depends on 19) The computer program product of claim 19, wherein the at least one non-transitory computer usable medium is selected from the set of a disk, tape, or other magnetic, optical, or electronic storage medium.