Microprocessor that facilitates task switching between encrypted and unencrypted programs

• US 8,886,960 B2
• Filed: 10/29/2013
• Issued: 11/11/2014
• Est. Priority Date: 05/25/2010
• Status: Active Grant

• Current Assignee: VIA Technologies Incorporated (VIA Technologies)
• Original Assignee: VIA Technologies Incorporated (VIA Technologies)
• Inventors: Henry, G. Glenn, Parks, Terry, Bean, Brent, Crispin, Thomas A.
• Primary Examiner(s): Rahman, Mahfuzur
• Application Number:
  US14/066,485
• Publication Number:
  US 20140195823A1
• Time in Patent Office: 378 Days
• Field of Search: 713/190
• US Class Current: 713/190
• CPC Class Codes: G06F 12/0875 with dedicated cache, e.g. instruction or stack
• CPC Class Codes: G06F 21/52 during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
• CPC Class Codes: G06F 21/54 by adding security routines or objects to programs
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/71 to assure secure computing or processing of information
• CPC Class Codes: G06F 21/72 in cryptographic circuits
• CPC Class Codes: G06F 2212/402 Encrypted data
• CPC Class Codes: G06F 2212/452 Instruction code
• CPC Class Codes: G06F 2221/2107 File encryption
• CPC Class Codes: G06F 9/30003 Arrangements for executing specific machine instructions
• CPC Class Codes: G06F 9/30058 Conditional branch instructions
• CPC Class Codes: G06F 9/30079 Pipeline control instructions, e.g. multicycle NOP
• CPC Class Codes: G06F 9/30178 of compressed or encrypted instructions
• CPC Class Codes: G06F 9/30189 according to execution mode, e.g. mode flag
• CPC Class Codes: H04L 2209/12 Details relating to cryptographic hardware or logic circuitry
• CPC Class Codes: H04L 2209/20 Manipulating the length of blocks of bits, e.g. padding or block truncation
• CPC Class Codes: H04L 9/0618 Block ciphers, i.e. encrypting groups of characters of a plain text message using fixed encryption transformation
• CPC Class Codes: H04L 9/0827 involving distinctive intermediate devices or communication paths network architectures or network communication protocols using different networks H04L63/18
• CPC Class Codes: H04L 9/0861 Generation of secret information including derivation or calculation of cryptographic keys or passwords
• CPC Class Codes: H04L 9/0891 Revocation or update of secret information, e.g. encryption key update or rekeying
• CPC Class Codes: H04L 9/0894 : Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage

Abstract

A microprocessor includes an architected register having a bit. The microprocessor sets the bit. The microprocessor also includes a fetch unit that fetches encrypted instructions from an instruction cache and decrypts them prior to executing them, in response to the microprocessor setting the bit. The microprocessor saves the value of the bit to a stack in memory and then clears the bit, in response to receiving an interrupt. The fetch unit fetches unencrypted instructions from the instruction cache and executes them without decrypting them, after the microprocessor clears the bit. The microprocessor restores the saved value from the stack in memory to the bit in the architected register, in response to executing a return from interrupt instruction. The fetch unit resumes fetching and decrypting the encrypted instructions, in response to determining that the restored value of the bit is set.

Claims

1. A microprocessor, comprising:

an architected register, having a bit, wherein the microprocessor is configured to set the bit; and

a fetch unit, configured to fetch encrypted instructions from an instruction cache and decrypt them prior to executing them, in response to the microprocessor setting the bit;

wherein the microprocessor is configured to save the value of the bit to a stack in memory and then clear the bit, in response to receiving an interrupt;

wherein the fetch unit is configured to fetch unencrypted instructions from the instruction cache and execute them without decrypting them, after the microprocessor clears the bit;

wherein the microprocessor is configured to restore the saved value from the stack in memory to the bit in the architected register, in response to executing a return from interrupt instruction; and

wherein the fetch unit is configured to resume fetching and decrypting the encrypted instructions, in response to determining that the restored value of the bit is set; and

wherein the architected register further has index bits that specify a location of storage space in the microprocessor for holding decryption keys used by the fetch unit to decrypt the encrypted instructions.

2. The microprocessor of claim 1, wherein the bit in the architected register is a reserved bit in an x86 architecture EFLAGS register.

3. The microprocessor of claim 1, further comprising:

wherein to decrypt the encrypted instructions the fetch unit is configured to perform a Boolean exclusive-OR (XOR) operation of the encrypted instructions with a decryption key, if the bit is set;

wherein the fetch unit is configured to perform a Boolean exclusive-OR (XOR) operation of the unencrypted instructions with zeroes, if the bit is clear.

4. The microprocessor of claim 1, wherein the microprocessor is configured to execute system software that receives a request to run a first program comprising encrypted instructions and, if a second program comprising encrypted instructions is already running on the microprocessor, waits to run the first encrypted program until the second encrypted program completes.

5. The microprocessor of claim 1, wherein the microprocessor is configured to flush all instruction bytes fetched from the instruction cache in buffers waiting to be decrypted, in response to executing the return from interrupt instruction.

6. The microprocessor of claim 1, wherein the microprocessor is configured to save the value of the index bits to the stack in memory, in response to receiving the interrupt, and to restore the saved value of the index bits from the stack in memory to the index bits in the architected register, in response to executing the return from interrupt instruction.

7. The microprocessor of claim 6, wherein the microprocessor is configured to load the decryption keys from the location of the storage space specified by the restored value of the index bits, prior to the fetch unit resuming decrypting the encrypted instructions.

8. The microprocessor of claim 1, wherein the index bits are populated by system software executing on the microprocessor prior to resuming decrypting the encrypted instructions.

9. A method for operating a microprocessor having an instruction cache and an architected register, the method comprising:

setting a bit in the architected register and then fetching encrypted instructions from the instruction cache and decrypting them prior to executing them;

saving the value of the bit in the architected register and then clearing the bit, in response to receiving an interrupt;

fetching unencrypted instructions from the instruction cache and executing them without decrypting them, after said clearing the bit;

restoring the saved value to the bit in the architected register, in response to executing a return from interrupt instruction; and

resuming said fetching and decrypting and executing the encrypted instructions, in response to determining that the restored value of the bit is set; and

wherein the architected register further has index bits that specify a location of storage space in the microprocessor for holding decryption keys used to decrypt the encrypted instructions.

10. The method of claim 9, wherein the bit in the architected register is a reserved bit in the x86 architecture EFLAGS register.

11. The method of claim 10, further comprising:

wherein said decrypting the encrypted instructions comprises performing a Boolean exclusive-OR (XOR) operation of the encrypted instructions with a decryption key if the bit is set; and

wherein said without decrypting the unencrypted instructions comprises performing a Boolean exclusive-OR (XOR) operation of the unencrypted instructions with zeroes if the bit is clear.

12. The method of claim 11, further comprising:

receiving a request to run a first program comprising encrypted instructions; and

if a second program comprising encrypted instructions is already running on the microprocessor, waiting to run the first encrypted program until the second encrypted program completes.

13. The method of claim 9, further comprising:

flushing all instruction bytes fetched from the instruction cache in buffers waiting to be decrypted, in response to said executing the return from interrupt instruction.

14. The method of claim 9, further comprising:

saving the value of the index bits to the stack in memory, in response to said receiving the interrupt; and

restoring the saved value of the index bits from the stack in memory to the index bits in the architected register, in response to said executing the return from interrupt instruction.

15. The method of claim 14, further comprising:

loading the decryption keys from the location of the storage space specified by the restored value of the index bits, prior to said resuming decrypting the encrypted instructions.

16. The method of claim 9, wherein the index bits are populated by system software executing on the microprocessor prior to said resuming decrypting the encrypted instructions.

17. A computer program product encoded in at least one non-transitory computer usable medium for use with a computing device, the computer program product comprising:

computer usable program code embodied in said medium, for specifying a microprocessor, the computer usable program code comprising;

first program code for specifying an architected register, having a bit, wherein the microprocessor is configured to set the bit; and

second program code for specifying a fetch unit, configured to fetch encrypted instructions from an instruction cache and decrypt them prior to executing them, in response to the microprocessor setting the bit;

wherein the microprocessor is configured to save the value of the bit to a stack in memory and then clear the bit, in response to receiving an interrupt;

wherein the fetch unit is configured to fetch unencrypted instructions from the instruction cache and execute them without decrypting them, after the microprocessor clears the bit;

wherein the microprocessor is configured to restore the saved value from the stack in memory to the bit in the architected register, in response to executing a return from interrupt instruction; and

wherein the fetch unit is configured to resume fetching and decrypting the encrypted instructions, in response to determining that the restored value of the bit is set; and

wherein the architected register further has index bits that specify a location of storage space in the microprocessor for holding decryption keys used by the fetch unit to decrypt the encrypted instructions.

18. The computer program product of claim 17, wherein the at least one non-transitory computer usable medium is selected from the set of a disk, tape, or other magnetic, optical, or electronic storage medium.