Cryptographic protection of information in a processing system
AssigneeAdvanced Micro Devices, Inc.
InventorsDavid A. Kaplan, Thomas Roy Woller, Ronald Perez
Life of this patent
Estimating the term…
Abstract
A processor employs a hardware encryption module in the processor's memory access path to cryptographically isolate secure information. In some embodiments, the encryption module is located at a memory controller (e.g. northbridge) of the processor, and each memory access provided to the memory controller indicates whether the access is a secure memory access, indicating the data associated with the memory access is designated for cryptographic protection, or a non-secure memory access. For secure memory accesses, the encryption module performs encryption (for write accesses) or decryption (for read accesses) of the data associated with the memory access.
Claims17
A method comprising:
- generating, at a first processor core, a first memory access request comprising a virtual address identifying first requested information;
- in response to identifying, at a translation lookaside buffer (TLB), based on the virtual address and a virtual machine (VM) tag value associated with the first memory access request, that the TLB includes an entry for the virtual address and the VM tag value, sending a system physical address corresponding to the virtual address, the VM tag value, and an indication of whether the first requested information is designated for cryptographic protection to a cache controller for a cache;
- and
- in response to identifying, at the cache controller, that the cache includes an entry corresponding to the VM tag value, the system physical address, and the indication of whether the first requested information is designated for cryptographic protection, indicating a cache hit and satisfying the memory access request at the cache.
A method, comprising:
- in response to receiving, at a memory controller of a processor, a first memory access request from a first virtual machine:
- identifying a first key assigned to the first virtual machine;
- encrypting, at the memory controller, first information associated with the first memory access request based on the first key;
- in response to receiving, at a cache of the processor, a second memory access request, the second memory access request comprising a virtual address identifying the first information and in response to identifying, at a translation lookaside buffer (TLB), based on the virtual address and associated with the second memory access request, that the TLB includes an entry for the virtual address and the virtual machine tag value, sending a system physical address corresponding to the virtual address, the virtual machine tag value, and an indication that the first information is designated for cryptographic protection to a cache controller for a cache;
- and
- in response to identifying at the cache controller, that the cache includes an entry corresponding to the virtual machine tag value, the system physical address, and the indication that the first information is designated for cryptographic protection, providing access to the encrypted first information by indicating a cache hit and satisfying the second memory access request at the cache.
A processor, comprising:
- a processor core to generate a first memory access request comprising a virtual address identifying first requested information;
- a translation lookaside buffer (TLB) to identify, based on the virtual address and a virtual machine (VM) tag value associated with the first memory access request, that the TLB includes an entry for the virtual address and the VM tag value;
- and
- a cache controller for a cache to receive from the TLB a system physical address corresponding to the virtual address, the VM tag value, and an indication of whether the first requested information is designated for cryptographic protection and to indicate a cache hit and satisfy the memory access request at the cache in response to identifying that the cache includes an entry corresponding to the VM tag value, the system physical address, and the indication of whether the first requested information is designated for cryptographic protection.
Dependencies are inferred from the claim text.