Host-convertible secure enclaves in memory that leverage multi-key total memory encryption with integrity

A processor comprising:

• a cryptographic engine to control access, using a secure region key identifier (ID), to one or more memory range of memory allocable for flexible conversion to secure pages of architecturally protected memory regions;
• and
• a processor core coupled to the cryptographic engine, the processor core to:
• determine that a physical address associated with a request to access the memory corresponds to a non-secure page of the memory;
• determine that a first key ID, which is located within the physical address, matches the secure region key ID;
• and
• deny access to the non-secure page of the memory.

A system comprising:

• a cache and home agent (CHA) of a memory subsystem, the CHA to:
• set a mesh secure bit of a cache line in response to detection that a first key identifier (ID) in a physical address of the cache line matches a secure region key ID;
• and
• issue a write operation to memory for the cache line;
• and
• a cryptographic engine coupled to the CHA, wherein the cryptographic engine is to set a memory secure bit, which resides in metadata of the cache line in the memory, to a value of the mesh secure bit as part of completion of the write operation.

A method comprising:

• selecting, by a processor, an evicted page of memory to convert to a first secure page;
• and
• executing, by the processor, a secure region conversion instruction to initialize the evicted page as the first secure page by:
• writing content of the evicted page as zero values;
• calculating a message authentication code (MAC) value using a physical address of the evicted page, data to be stored to the first secure page, and a secure region key identifier (ID) corresponding to an architecturally protected memory region of the memory containing the first secure page;
• and
• storing the MAC value to the first secure page.