Processor and method for clearing a translation lookaside buffer based on a specified key identification code

Abstract

A processor and method for clearing a translation lookaside buffer (TLB) using a specified key identification code. An instruction is provided in an instruction set architecture (ISA) that specifies a key identification code for clearing a TLB. The instruction is converted into at least one microinstruction. A specified key identification code is supplied to a control logic circuit of the TLB via a memory order buffer (MOB) in response to a clear microinstruction in the at least one microinstruction, causing the control logic circuit to clear entries in the TLB that match the specified key identification code.

Description

TECHNICAL FIELD

[0001] The present application relates to the management of a processor's Translation Lookaside Buffer (TLB). In particular, the present application relates to a processor and method for TLB flush with a specified key identification code. BACKGROUND

[0002] A Translation Lookaside Buffer (TLB), also known as a page table cache or address translation cache, is a cache used by a central processing unit to speed up access to system memory and improve the speed of virtual address (VA) to physical address (PA) translation. Each entry in the TLB stores a mapping of a virtual address (VA) to a physical address (PA); a virtual address (VA) is typically inputted and the search result is a physical address (PA). If the inputted virtual address (VA) exists in the TLB, the matching physical address (PA) can be used to access system memory, speeding up the access to system memory. If the inputted virtual address (VA) does not exist in the TLB, system resources must be spent on accessing the multi-level page table (i.e. table walk) stored in system memory and / or related cache structures, which takes a long time.

[0003] Such a TLB design can be applied to various types of system memory access processes; for example, instruction TLB (ITLB) and data TLB (DTLB).

[0004] In order to protect confidential and / or sensitive data, a transparent total memory encryption (TME) function using multiple keys to encrypt memory has appeared in the prior art, which realizes key-based management of memory. However, the existing TLB lacks a corresponding key-based management function, which causes the operating system (OS) to be unable to manage the TLB at the key level, and thus unable to flush only the TLB entries corresponding to a specified key. SUMMARY

[0005] In order to solve the above problems, the present application proposes a key-based management of a Translation Lookaside Buffer (TLB).

[0006] A processor implemented according to an embodiment of the present application includes a memory ordering buffer (MOB), a translation lookaside buffer (TLB), and a decoder. The memory ordering buffer (MOB) serves as a communication interface between the processor and a system memory. The translation lookaside buffer (TLB) caches a plurality of entries for the processor to search through the memory ordering buffer (MOB) for accessing the system memory. The decoder, in response to an instruction set architecture (ISA) instruction for translation lookaside buffer (TLB) flush with a specified key identification code, converts at least one microinstruction. According to a flush microinstruction in the at least one microinstruction, a specified key identification code is supplied to a control logic circuit of the translation lookaside buffer (TLB) through the memory ordering buffer (MOB) so that the control logic circuit flushes entries in the translation lookaside buffer (TLB) matching the specified key identification code.

[0007] In an embodiment, each entry of the translation lookaside buffer (TLB) carries information for matching a key identification code to determine whether the entry matches the specified key identification code.

[0008] The present application further discloses a method for translation lookaside buffer (TLB) flush with a specified key identification code, including: in response to an instruction set architecture (ISA) instruction for translation lookaside buffer (TLB) flush with a specified key identification code, converting at least one microinstruction; and according to a flush microinstruction in the at least one microinstruction, supplying a specified key identification code to a control logic circuit of a translation lookaside buffer (TLB) through a memory ordering buffer (MOB) so that the control logic circuit flushes entries in the translation lookaside buffer (TLB) matching the specified key identification code.

[0009] According to the present application, the translation lookaside buffer (TLB) is provided with a corresponding key-granularity management function. When the transparent full memory encryption function is enabled, the operating system can manage the translation lookaside buffer (TLB) in key granularity.

[0010] The following embodiments are described in detail with reference to the accompanying drawings. BRIEF DESCRIPTION OF DRAWINGS

[0011] Figure 1A Instruction architecture for instruction INVL_KEYID;

[0012] Figure 1B Block diagram illustrating a processor 100 and a system memory 102 connected to the processor 100 according to an embodiment of the present application;

[0013] Figures 2A-2D According to various embodiments of the present application, a translation lookaside buffer (TLB) entry architecture is illustrated;

[0014] Figures 3A-3C Figures illustrate how to handle the case when the mapping table 248 space is exhausted; Figure 2D TLB entries are written into the translation lookaside buffer table 118;

[0015] Figure 4 Fig. 2 is a block diagram illustrating a control logic circuit 302 of a translation lookaside buffer (TLB) 117, according to an embodiment of the present application; and

[0016] Figure 5 An instruction architecture for the instruction INVL_KEYID.

[0017]

Symbol Description

[0018] 100: Processor

[0019] 102: System memory

[0020] 104: Instruction cache

[0021] 106: Decoder

[0022] 108: Instruction buffer (XIB)

[0023] 110: Instruction translator (XLATE)

[0024] 112: Register alias table (RAT)

[0025] 114: Reservation station (RS)

[0026] 116: Memory order buffer (MOB)

[0027] 117: Translation lookaside buffer (TLB)

[0028] 118: Translation lookaside buffer table (TLB table)

[0029] 120: Clear unit

[0030] 122: Micro-operation code

[0031] 124: Operand indication

[0032] 126: Register

[0033] 128: Clear request

[0034] 130: Specified key identification (Key_ID_S)

[0035] 132: Clear command

[0036] 134: Key ID_S

[0037] 136: PCID

[0038] 138: VPID

[0039] 140: Key ID_S code

[0040] 192: opcode

[0041] 194: operand

[0042] 200, 214, 224, 236: TLB entry architecture

[0043] 202, 214, 226, 238, 2482: V

[0044] 204, 218, 228, 240: field, filled with PCID, VPID

[0045] 206, 220, 232, 244: field, filled with VA

[0046] 212, 222, 234, 246: field, filled with PA

[0047] 208, 210: high, low part of PA

[0048] 230, 2486: field, carries key ID

[0049] 242, 2484: field, carries Key ID code (KID)

[0050] 248: mapping table

[0051] 250: new TLB entry

[0052] 252, 254: arrow

[0053] 302: control logic circuit

[0054] 304: filling unit

[0055] 306: clearing unit

[0056] 308: conversion unit

[0057] 309: ID query unit

[0058] 310: index number

[0059] 312: Filling content

[0060] 314: Matching information

[0061] 316: Clear command

[0062] 318: Virtual address

[0063] 320: Flag

[0064] 322: Physical address

[0065] 402: Operation code (opcode)

[0066] 404, 406: Operands KID, KID1, KID2: Key identification code Key_ID, Key_IDa, Key_IDb, Key_IDc: Key identification code Key_ID_S: Specified key identification code NEW_INFO: New TLB entry information ENTRY1, ENTRY2, ENTRY3, ENTRY4: TLB table entry DETAILED DESCRIPTION

[0067] The following description sets forth numerous specific details to provide a thorough understanding of the application. The following description includes

[0068] Nowadays, computer systems are often designed with virtual machines (VM) to create multiple virtual machines on a single physical machine, each virtual machine containing at least one virtual processor (VP) and each virtual machine having its own operating system (OS) and applications. The virtual machines are separated from each other and do not interfere with each other. Each virtual machine has its own corresponding system memory space. In one embodiment, when transparent full memory encryption is enabled, the system memory accessed (read or written) by each virtual processor in a virtual machine can be protected with different keys, and the security between virtual processors is thus improved. Each key can be represented by a key identification (keyID). A key table can be included in the computer system to store the correspondence between keys and keyIDs. When encryption is performed, the key corresponding to the keyID can be obtained by querying the key table. In addition, the system memory used by each process (corresponding to the services and / or applications of the operating system) running in a single virtual processor can also be protected with separate keys, so that the security of each process running in a single virtual processor is greatly improved. For example, assume that a virtual machine VM0 contains a virtual processor with a VPID value of VP0, and the virtual processor VP0 contains two processes with PCID values of P0 and P1. The processes P0 and P1 can be protected with two keys 1 (corresponding to keyID 0) and 2 (corresponding to keyID 1), respectively, to improve the security of the processes P0 and P1 in the virtual processor VP0.

[0069] According to the partition encryption state of the system memory, the present application manages the translation lookaside buffer (TLB) of the processor in key identification code (key ID) granularity, i.e., in key granularity, and performs a specified key identification code (Key_ID_S) clearing of the translation lookaside buffer (TLB) different from other granularity clearing methods. The other granularity clearing methods include: completely clearing the entire translation lookaside buffer (TLB); or clearing in process context identification code (Process Context Identifier, PCID for short, used for identifying a process), virtual processor identification code (Virtual Processor Identifier, VPID for short, used for identifying a virtual processor), or extended page table pointer (Extended Page Table Pointer, EPTP for short) granularity. When the transparent full memory encryption function is enabled, the translation lookaside buffer (TLB) management technology in key identification code (key ID) granularity can achieve the purpose of clearing only the TLB entries matching the specified key identification code, and avoid clearing the TLB entries irrelevant to the specified key identification code.

[0070] In an embodiment, the present application discloses a processor for managing a translation lookaside buffer (TLB) in key identification code (key ID) granularity, wherein an instruction set architecture (ISA) instruction (hereinafter referred to as INVL_KEYID) is provided for clearing the translation lookaside buffer (TLB) in a specified key identification code (Key_ID_S), and the operand of the instruction INVL_KEYID includes the specified key identification code. The instruction set architecture supported by the processor is not limited, and can be x86 architecture, Advanced RISC Machine (ARM) architecture, MIPS (Microprocessor without Interlocked Pipeline Stages) instruction set architecture, RISC-V (RISC-Five) instruction set architecture, SPARC instruction set architecture, IBM Power instruction set architecture, or other.

[0071] Figure 1AFor the instruction architecture of the instruction INVL KEYID, in addition to the opcode 192 for identifying the instruction, there is an operand 194, which indicates a single specified key identification (KeyJD_S). The operand 194 can have various forms. The operand 194 can carry a register (reg) number, so that the specified key identification (KeyJD_S) is fetched from a register. The operand 194 can carry a register number or a system memory address, so that the specified key identification (KeyJD_S) is fetched from a register or system memory (r / m). The operand 194 can be an immediate number (imm 16), which is the specified key identification (KeyJD_S). In program writing, other instructions can be used to fill the register / system memory before the instruction INVL KEYID, so as to prepare the specified key identification (KeyJD_S), or the specified key identification (KeyJD_S) can be written into the instruction INVL KEYID as an immediate number, so that the instruction INVL KEYID fetches the specified key identification (KeyJD_S) through the operand 194.

[0072] In one implementation, the present application has a design corresponding to the instruction INVL KEYID in the microcode (ucode) of the processor, and can have corresponding modifications on the hardware of the processor.

[0073] Figure 1BFigure 1 is a block diagram illustrating a processor 100 and a system memory 102 coupled to the processor 100, in accordance with one embodiment of the present application. A sequence of instructions (including multiple instructions) is fetched from the system memory 102 into an instruction cache 104 and then decoded by a decoder 106. The decoder 106 includes an instruction buffer (XIB) 108 and an instruction translator (XLATE) 110. The instruction buffer (XIB) 108 recognizes and separates the instruction INVL KEYID as presented in this application, and the instruction translator (XLATE) 110 translates the instruction INVL KEYID into at least one microinstruction recognizable by the pipeline hardware, which drives subsequent hardware to perform a TLB flush of the specified Key ID (Key ID S) in a translation lookaside buffer (TLB) 117. In one embodiment, the instruction translator (XLATE) 110 translates the instruction INVL KEYID into at least one microinstruction recognizable by the pipeline hardware based on microcode (ucode) stored in a ucode memory. The at least one microinstruction is stored in a corresponding reservation station (RS) 114 by a register alias table (RAT) 112 and then applied. One of the microinstructions is a flush microinstruction that triggers a memory order buffer (MOB) 116 to drive the TLB 117 to perform a flush operation to flush TLB entries matching the specified Key ID (Key ID S). In one embodiment, the at least one microinstruction also includes microinstructions for exception checking (e.g., privilege level checking), memory address jumping (i.e., jumping to the next instruction of the instruction INVL KEYID), and the like.

[0074] The sequential memory buffer (MOB) 116 is generally used as a communication interface between the processor 100 and the system memory 102. This communication involves looking up a translation lookup buffer (TLB) 117 to translate a virtual address of system memory into a physical address. The translation lookup buffer table 118 in the translation lookup buffer 117 contains multiple TLB entries, each containing both a virtual address and a physical address. However, the translation lookup buffer table 118 has limited space, and when space is insufficient, some TLB entries need to be cleared. Additionally, when the system memory space corresponding to a key identification code is released, the TLB entry in the translation lookup buffer table 118 corresponding to that key identification code also needs to be cleared. This application relates to the flushing technique used for this flushing. Figure 1B Specifically, this application's microinstruction design describes how a clearing unit 120 clears the translation backup buffer table (TLB table) 118 by specifying the key identification code (Key_ID_S).

[0075] like Figure 1B As shown, via Reserved Station (RS) 114, the micro-opcode 122 of the clear microinstruction obtained from the instruction INVL_KEYID, and operands 124, are transferred to the Memory Sequential Buffer (MOB) 116. After identifying the micro-opcode 122, the specified key identification code (Key_ID_S) is obtained based on operands 124. In one embodiment, the specified key identification code (Key_ID_S) can be stored in a register 126, and operands 124 point to register 126. In another embodiment, the specified key identification code (Key_ID_S) can also be stored in system memory 102, in which case operands 124 point to system memory 102. In other embodiments, the specified key identification code (Key_ID_S) can also be stored in operands 124 as an immediate value. Then, the memory sequential buffer (MOB) 116 supplies a purge request 128 and the specified key identification code (Key_ID_S) 130 to the purge unit 120 of the translation back buffer 117. The purge unit 120 outputs a purge command 132 and the specified key identification code (Key_ID_S) 134 to the translation back buffer table (TLB table) 118 according to the purge request 128, so as to clear the TLB entry in the translation back buffer table (TLB table) 118 that matches the specified key identification code (Key_ID_S) 134.

[0076] The specified key identification code (Key_ID_S) 134 can take several values. One embodiment (hereinafter) Figure 2A The architecture), the high-order part of the physical address (PA) is used as the designated key identification code (Key_ID_S) 134 and passed to the translation backup buffer table (TLB table) for entry matching. One implementation (subsequent) Figure 2B In the architecture, the process context identifier (PCID) and / or virtual processor identifier (VPID) can be used as a key identifier (key ID). Then, a PCID and / or a VPID are passed as the specified key identifier (Key_ID_S) 134 to the translation lookup buffer table (TLB table) for entry matching. Two other implementations (subsequent) Figure 2C , 2D In the architecture, an independent key identification code (Key ID) is passed as the specified key identification code (Key_ID_S) 134 to the translation backup buffer table (TLB table) for entry matching judgment. Figure 2D In one implementation, the specified key identification code (Key_ID_S) is replaced by a key identification code (e.g., a short-bit-length code, or a one-hot code, which will be detailed later) to improve TLB entry matching efficiency. Furthermore, implementing the comparison logic for the key identification code reduces the number of logic gates used. The specified key identification code 140 obtained based on the specified key identification code (Key_ID_S) 134 is then used as input to the Translate Back Buffer Table (TLB table) 118 for entry matching. In another implementation, the virtual machine extension state also affects entry matching; the specified key identification code (Key_ID_S) 134, the PCID 136, and the VPID 138 may all need to be transmitted to the Translate Back Buffer Table (TLB table) 118, making the entry clearing of the specified key identification code (Key_ID_S) 134 more limited to PCID 136 and / or VPID 138.

[0077] After processing, the specified key identification code (Key_ID_S) 134 or specified key identification code 140 passed from the clearing unit 120 to the translation backup buffer table (TLB table) 118 can be regarded as specified matching information, so as to clear the TLB entries in the translation backup buffer table 118 that match the specified key identification code (Key_ID_S) 134. The specified key identification code 140 is obtained based on the specified key identification code (Key_ID_S) 134.

[0078] To implement the present application, the translation lookaside buffer (TLB) entry (i.e., TLB entry) architecture needs to be designed accordingly. For example, each TLB entry needs to contain key identification code matching information. The key identification code matching information can be implemented in various ways.

[0079] Figures 2A-2D According to various embodiments of the present application, a TLB entry architecture is illustrated.

[0080] Figure 2A A TLB entry architecture 200 is illustrated, which includes a valid bit (V) 202 to identify whether the TLB entry is valid (e.g., the valid bit (V) 202 value of 0 indicates that the TLB entry is invalid, and the valid bit (V) 202 value of 1 indicates that the TLB entry is valid), a field 204 to carry a process context identification code PCID and a virtual processor identification code VPID, a field 206 to carry a virtual address (VA), and a field 212 split into a high portion 208 and a low portion 210 to carry a physical address (PA). In one embodiment, the process context identification code PCID and the virtual processor identification code VPID in the TLB entry architecture 200 each occupies a field. In particular, the high portion 208 of the physical address (PA) carries a key identification code (key ID) of the corresponding memory space. The content of the high portion 208 of the physical address (PA) in the TLB entry architecture 200 can be used to compare with the specified key identification code (Key_ID_S) 134 to determine whether the corresponding TLB entry matches the specified key identification code (Key_ID_S) 134. For example, for a virtual address VA0 in the memory space of a process with a PCID value of P0 in a virtual processor with a VPID value of VP0 in a virtual machine VM0, if the corresponding physical address is PAH0 (physical address high portion) + PAL0 (physical address low portion), then as shown in Table 1, the corresponding valid TLB entry has a valid bit 202 value of 1, a field 204 (PCID / VPID) value of P0 / VP0, a field 206 (virtual address) value of VA0, a field 208 (physical address high portion as key ID) value of PAH0, and a field 210 (physical address low portion) value of PAL0. The specified key identification code (Key_ID_S) 134 is compared with the value PAH0 in the field 208. If they are the same, it indicates that the TLB entry matches the specified key identification code (Key_ID_S) 134, otherwise, it indicates that the TLB entry does not match the specified key identification code (Key_ID_S) 134.

[0081]

[0082] Table 1

[0083] Figure 2BFigure 1 illustrates a TLB entry architecture 214, which includes a valid bit (V) 216 to identify whether the TLB entry is valid (e.g., the valid bit (V) 216 value of 0 indicates that the TLB entry is invalid, and the valid bit (V) 216 value of 1 indicates that the TLB entry is valid), a field 218 to carry a process context identification (PCID) and a virtual processor identification (VPID), a field 220 to carry a virtual address (VA), and a field 222 to carry a physical address (PA). In one embodiment, the process context identification (PCID) and the virtual processor identification (VPID) each occupies one field in the TLB entry architecture 200. In particular, the process context identification (PCID) or the virtual processor identification (VPID) can be used as a key identification (key ID) corresponding to the physical address (PA) carried in the field 222. The specified match information passed from the clean unit 120 to the translation lookaside buffer table (TLB table) 118 can be the PCID 136 and / or the VPID 138. If the process context identification (PCID) and / or the virtual processor identification (VPID) carried in the field 218 of a TLB entry is equal to the PCID 136 and / or the VPID 138, then the TLB entry is determined to match the specified key identification (Key ID S). For example, for a virtual address VA0 in the memory space of a process with a PCID value of P0 in a virtual processor with a VPID value of VP0 in a virtual machine VM0, if the physical address corresponding to the virtual address VA0 is PA0, then as shown in Table 2, the valid bit 216 of the valid TLB entry has a value of 1, the field 218 (PCID / VPID as Key ID) has a value of P0 / VP0, the field 220 (virtual address) has a value of VA0, and the field 222 (physical address) has a value of PA0. The specified key identification (Key ID S) 134 is compared with the values of VP0 and / or P0 in the field 218. If the specified key identification (Key ID S) 134 is the same as the values of VP0 and / or P0 in the field 218, then the TLB entry matches the specified key identification (Key ID S) 134, otherwise, the TLB entry does not match the specified key identification (Key ID S) 134.

[0084]

[0085] Table 2

[0086] Figure 2CFigure 2 illustrates a TLB entry architecture 224, which includes a valid bit (V) 226 to identify whether the TLB entry is valid (e.g., the valid bit (V) 226 value of 0 indicates that the TLB entry is invalid, and the valid bit (V) 226 value of 1 indicates that the TLB entry is valid), a field 228 to carry a process context identification (PCID) and a virtual processor identification (VPID), a field 230 to carry a key identification (key ID), a field 232 to carry a virtual address (VA), and a field 234 to carry a physical address (PA). In one embodiment, the process context identification (PCID) and the virtual processor identification (VPID) each occupies one field in the TLB entry architecture 224. The key identification (key ID) in the field 230 of the TLB entry architecture 224 can be used to compare with the specified key identification (Key_ID_S) 134 to determine whether the TLB entry matches the specified key identification (Key_ID_S) 134. Since the key identification (key ID) is independent of other fields, the system memory 102 space can be partitioned in a more flexible manner for individual encryption. For example, for a virtual address VA0 in the address space of a process with a PCID value of P0 in a virtual processor with a VPID value of VP0 in a virtual machine VM0, if the corresponding physical address is PA0, and the corresponding key identification for the process P0 is KEYID0, then as shown in Table 3, the corresponding valid TLB entry has a valid bit 226 value of 1, a field 228 (PCID / VPID) value of P0 / VP0, a field 230 (key identification Key ID) value of KEYID0, a field 232 (virtual address) value of VA0, and a field 234 (physical address) value of PA0. The specified key identification (Key_ID_S) 134 is compared with the value KEYID0 in the field 230. If they are the same, it indicates that the TLB entry matches the specified key identification (Key_ID_S) 134, otherwise, it indicates that the TLB entry does not match the specified key identification (Key_ID_S) 134.

[0087]

[0088] Table 3

[0089] Figure 2DFigure 1 illustrates a TLB entry architecture 236, which includes a valid bit (V) 238 to identify whether the TLB entry is valid (e.g., the valid bit (V) 238 value of 0 indicates that the TLB entry is invalid, and the valid bit (V) 238 value of 1 indicates that the TLB entry is valid), a field 240 to carry a process context identification code PCID and a virtual processor identification code VPID, a field 242 to carry a key identification code code (KID), and the length of the key identification code code (KID) is shorter than the length of the specified key identification code (Key_ID_S), so that the length of the TLB entry can be reduced, the storage space can be saved, and the complexity of the hardware matching logic can be reduced. In an embodiment, the key identification code code (KID) is one-hot code (each one-hot code has only one bit of 1), such as using 0001, 0010, 0100, and 1000 to correspond to four different specified key identification codes, respectively. Using one-hot code makes the hardware implementation simpler and can improve the efficiency of the hardware comparison logic. The field 244 carries a virtual address (VA), and the field 246 carries a physical address (PA). In an embodiment, the process context identification code PCID and the virtual processor identification code VPID each occupy a field in the TLB entry architecture 200. The field 242 of the TLB entry architecture 236 specifically carries the key identification code code (KID), which can be used to compare with the key identification code code obtained according to the specified key identification code (Key_ID_S) 134 to determine whether a TLB entry matches the specified key identification code (Key_ID_S) 134. The present application uses the key identification code code (KID) to represent the key identification code (key ID) in the TLB entry, which can reduce the storage space occupied by the TLB entry and / or improve the efficiency of the hardware comparison logic of the translation lookaside buffer (TLB) 117.

[0090] As Figure 2DAs shown, the mapping table 248 includes a plurality of entries, each of which includes a valid bit field 2482, a key identification code field 2484, and a key identification field 2486, for storing a valid identification (V), a key identification code (KID), and a key identification (Key_ID). The valid bit field 2482 carries a valid identification for indicating whether the corresponding entry is valid or not. A valid identification of 0 indicates that the corresponding entry is in an idle state (i.e., invalid), and a valid identification of 1 indicates that the corresponding entry is in a use state (i.e., valid). The key identification code field 2484 carries a key identification code. In one embodiment, the processor 100 maintains only a fixed number of key identification codes, and each entry of the mapping table 248 corresponds to a key identification code (KID). For example, the key identification code KID1 is stored in entry 1 of the mapping table 248, the key identification code KID2 is stored in entry 2 of the mapping table 248, and so on. In one embodiment, the processor 100 maintains only 8 key identification codes. The key identification field carries a key identification paired with the key identification code in the corresponding entry. As the TLB entries are filled, a new key identification (Key_ID) is paired with a key identification code (KID), and the new key identification (Key_ID) is stored in the key identification field of the entry of the mapping table 248 corresponding to the key identification code (KID). For example, as shown, the key identifications Key_IDa and Key_IDb of the newly filled TLB entries are paired with the key identification codes KID1 and KID2, respectively, and recorded in the mapping table 248, and the valid identifications of the entries corresponding to the key identification codes KID1 and KID2 are both set to 1. By querying the mapping table 248 for a specified key identification code 140 matching a specified key identification (Key_ID_S), a matching TLB entry can be found from the translation lookaside buffer table (TLB table) 118 for purging. The maintenance of the mapping table 248 (including filling, updating, purging, and matching, etc.) can be implemented by the control logic of the translation lookaside buffer (TLB) 117. Figure 2D

[0091] ​Now, the matching process of the TLB entry is illustrated by taking an example of a virtual address VA0 in the address space of a process with PCID value P0 in a virtual processor with VPID value VP0 in a virtual machine VM0. If the physical address corresponding to the virtual address VA0 is PA0, and the key identification corresponding to the process P0 is Key_IDa, then as shown in Table 4, the value of the valid bit 238 of the corresponding valid TLB entry is 1, the value of the field 240 (PCID / VPID) is P0 / VP0, the value of the field 242 (key identification code KID) is KID1, the value of the field 244 (virtual address) is VA0, and the value of the field 246 (physical address) is PA0. The control logic circuit of the translation lookaside buffer (TLB) 117 queries the mapping table 248 according to the specified key identification (Key_ID_S) 134 to obtain the specified key identification code 140 (the value can be KID1, KID2, etc.), and then compares the obtained specified key identification code 140 with the value KID1 in the field 242. If they are the same, it means that the TLB entry matches the specified key identification (Key_ID_S) 134, otherwise, it means that it does not match. If the control logic circuit of the translation lookaside buffer (TLB) 117 does not obtain the specified key identification code 140 by querying the mapping table 248 according to the specified key identification (Key_ID_S) 134, it means that there is no TLB entry in the translation lookaside buffer table (TLB table) 118 that matches the specified key identification (Key_ID_S) 134.

[0092]

[0093] Table 4

[0094] The following will be described with reference to Figures 3A-3C illustrate how to write the TLB entry shown in Figure 2D Table 4 into the translation lookaside buffer table 118 when the mapping table 248 is full. As shown in Figure 3A Table 5, the mapping table 248 and Figure 2DThe mapping table 248 is the same as that in FIG. 2, and will not be described again. The translation lookaside buffer table 118 contains a plurality of TLB entries ENTRY1, ENTRY2, ENTRY3, ENTRY4, and so on. The TLB entries ENTRY2 and ENTRY4 match the key identification code KID2, corresponding to the entry in the mapping table 248 where the key identification code KID2 is located (as shown by the dashed arrow 252). There is a new TLB entry 250 to be written into the translation lookaside buffer table 118, and at this time the space of the mapping table 248 has been used up (i.e. the valid flags of all entries are 1). As shown, the new TLB entry 250 contains the key identification code Key_IDc and new TLB entry information NEW_INFO. The steps of writing the new TLB entry 250 into the translation lookaside buffer table 118 will be described below.

[0095] First, the control logic circuit of the translation lookaside buffer 117 selects the entry in the mapping table 248 that is not frequently used - the entry corresponding to the key identification code KID2 (as shown by the dashed arrow 251), and pairs the key identification code Key_IDc with the key identification code KID2. In one embodiment, the control logic circuit of the translation lookaside buffer 117 uses the Least Frequently Used (LFU) strategy to select the entry in the mapping table 248 that is not frequently used. In another embodiment, the control logic circuit of the translation lookaside buffer 117 uses the Least Recently Used (LRU) strategy to select the entry in the mapping table 248 that is not frequently used.

[0096] Then, referring to Figure 3B , the control logic circuit of the translation lookaside buffer 117 invalidates the entries ENTRY1, ENTRY2 in the translation lookaside buffer table 118 that match the key identification code KID2 (as shown by the dashed arrow 253), and invalidates the entry in the mapping table 248 where the key identification code KID2 is located. Specifically, the control logic circuit of the translation lookaside buffer 117 sets the valid bits 238 of the entries ENTRY1, ENTRY2 that match the key identification code KID2 to 0, and sets the valid bit 2482 of the entry in the mapping table 248 where the key identification code KID2 is located to 0.

[0097] Finally, referring to Figure 3CThe control logic circuit of the translation lookaside buffer (TLB) 117 writes the key identification code Key_IDc into the key identification code field 2486 of the entry of the key identification code KID2 in the mapping table 248, and writes the new TLB entry information NEW_INFO into the TLB entry ENTRY2, and sets the valid bit 238 of the ENTRY2 to 1, the key identification code code 242 to KID2 (as shown by the dashed arrow 254), and sets the valid bit 2482 of the entry of the key identification code KID2 in the mapping table 248 to 1.

[0098] Figure 4 A block diagram illustrates a control logic circuit 302 of a translation lookaside buffer (TLB) 117 according to an embodiment of the present application. The control logic circuit 302 includes a replace unit 304, a flush unit 306, and an address translation unit 308. The replace unit 304 is responsible for the replacement of TLB entries. Specifically, the memory order buffer (MOB) 116 provides a replace request, an index of a TLB entry to be replaced, and a replacement content to the replace unit 304; then the replace unit 304 outputs a replace command, the index of the TLB entry to be replaced 310, and the replacement content 312 to the translation lookaside buffer table (TLB table) 118. The replace unit 304 can maintain the mapping table 248 and the TLB table 118 as described above. The flush unit 306 can include the functions of the flush unit 120 as described above, and can be compatible with other conventional flush techniques of different granularities. The memory order buffer 116 can execute a flush microinstruction obtained by translating the instruction INVL_KEYID to drive the flush unit 306, and the flush unit 306 provides a mapping information 314 and a flush command 316 to the TLB table 118. The flush command 316 specifies the flush granularity as key ID, full TLB, PCID, VPID, or EPTP, and the mapping information 314 specifies the flush range corresponding to the granularity. Figure 1B The functions of the flush unit 120 as described above are used for the flush of the matching information, and can be compatible with other conventional flush techniques of different granularities. The memory order buffer 116 can execute a flush microinstruction obtained by translating the instruction INVL_KEYID to drive the flush unit 306, and the flush unit 306 provides a mapping information 314 and a flush command 316 to the TLB table 118. The flush command 316 specifies the flush granularity as key ID, full TLB, PCID, VPID, or EPTP, and the mapping information 314 specifies the flush range corresponding to the granularity.

[0099] The translation unit 308 is configured to look up the TLB table 118 under the driving of the MOB 116 to convert the virtual address (VA) 318 into a physical address (PA) 322. Specifically, according to the virtual address (VA) 318 provided by the translation unit 308, the TLB table 118 returns a flag 320 to the translation unit 308 to indicate whether there is a hit. If there is a hit, the TLB table 118 further returns the physical address (PA) 322 to the translation unit 308. In one embodiment, the MOB 116 transmits the key ID (not shown in the figure) and the virtual address (VA) 318 to the translation unit 308 at the same time, so that the translation unit 308 converts the virtual address (VA) 318 matching the key ID into the physical address (PA) 322.

[0100] In summary, the control logic circuit 302 implements the filling, conversion and multi-granularity clearing of the TLB table 118.

[0101] The instruction INVL KEYID has an implementation in which one operand is used to specify the key ID (Key ID S). The system can have more parameters (operands) in other implementations. The following will be described in detail in combination with Figure 5 .

[0102] Figure 5 One instruction architecture of the instruction INVL KEYID uses two operands 404, 406 to specify two parameters, which can be stored in two registers respectively. In another implementation, one of the two operands 404, 406 is stored in a register and the other is stored in a memory. In programming, other instructions can be used to fill the registers / memory before the instruction INVL KEYID to prepare the operands 404, 406.

[0103] In one implementation, the operand 404 is a type identifier, which determines how to interpret the operand 406. Figure 1B The processor 100 shown can use a prefetch instruction (PREFETCH) to load data that can be used into a cache. The prefetch instruction includes a type identifier, which can have a value of T0 (first type) or T1 (second type). The operand 404 refers to the type identifier of the prefetch instruction. When the operand 404 is a first value (such as T0), the operand 406 needs to be interpreted as a virtual address (VA); Figure 4The control logic 302 shown obtains the key identification (key ID) corresponding to the virtual address (VA) as the specified key identification (Key_ID_S). In one embodiment, the control logic 302 further includes an identification query unit 309. At least one microinstruction translated by the instruction INVL_KEYID further includes a query microinstruction that operates the memory order buffer 116 to drive the identification query unit 309 to query the key identification (key ID) from the translation lookaside buffer (TLB) 118 according to the virtual address (VA) in the operand of the query microinstruction. For example, if the TLB entry in the TLB 118 is the structure shown in Figure 4 , the queried key identification is the value in field 208 of the TLB entry matching the virtual address; if the TLB entry in the TLB 118 is the structure shown in Figure 2A , the queried key identification is the value in field 218 of the TLB entry matching the virtual address; if the TLB entry in the TLB 118 is the structure shown in Figure 4 , the queried key identification is the value in field 230 of the TLB entry matching the virtual address; if the TLB entry in the TLB 118 is the structure shown in Figure 2B , the queried key identification is the key identification corresponding to the key identification code (KID) in field 242 of the TLB entry matching the virtual address (using the key identification code (KID) to look up the mapping table 248). When the operand 404 is a second value (such as Tl), the operand 406 is directly interpreted as the specified key identification (Key_ID_S). Figure 4 Figure 2C Figure 4 Figure 2D

[0104] ​​​​After the Key_ID_S is determined, the micro-instructions decoded by the instruction INVL_KEYID can provide different clearing schemes according to the system status. For example, the micro-instructions can include judging whether the virtual machine extension is enabled, and the state of the virtual machine extension when the virtual machine extension is enabled, and clearing the Key_ID_S in the translation lookaside buffer according to the judging result. If the virtual machine extension is not enabled (VMX off), or the virtual machine extension is enabled and the virtual machine extension is in the host state, the virtual processor identification code VPID and the process context identification code PCID are not considered, and the Key_ID_S is cleared in the entire translation lookaside buffer (TLB). If the virtual machine extension is enabled and the virtual machine extension is in the guest state, and the virtual processor identification code is not enabled (VPID off), the process context identification code PCID is not considered, and the Key_ID_S is cleared in all TLB entries related to the virtual machine in the translation lookaside buffer (TLB). For other conditions, the Key_ID_S is cleared in the TLB entries related to the current virtual processor identification code VPID in the translation lookaside buffer (TLB).

[0105] Any technology capable of clearing the translation lookaside buffer (TLB) with the key identification code (key ID) as the granularity belongs to the scope of protection of the present application.

[0106] According to the technology of the present application, the translation lookaside buffer (TLB) has the corresponding management function with the key as the granularity; when the transparent full memory encryption function is enabled, the operating system can manage the translation lookaside buffer (TLB) with the key (i.e. the key identification code) as the granularity.

[0107] Although the present application has been disclosed with the preferred embodiments as above, it is not intended to limit the present application, and any person skilled in the art can make some changes and modifications without departing from the spirit and scope of the present application, so the protection scope of the present application is defined by the claims.

Claims

1. A processor for TLB flush according to a specified key identification code, comprising: a memory order buffer as a communication interface between the processor and a system memory; a translation lookaside buffer (TLB) to cache a plurality of entries for the processor to search through the memory order buffer to access the system memory; and a decoder to convert at least one microinstruction in response to an instruction set architecture (ISA) instruction for TLB flush according to a specified key identification code; wherein according to a flush microinstruction in the at least one microinstruction, the specified key identification code is supplied to a control logic circuit of the TLB through the memory order buffer to cause the control logic circuit to flush entries in the TLB that match the specified key identification code. Each entry of the TLB carries information for key identification code matching to determine whether the entry matches the specified key identification code.

2. The processor for translation lookaside buffer flush according to a specified key identification code as recited in claim 1, wherein, Each entry carries a physical address including a high order portion and a low order portion, the high order portion being a key identification code corresponding to the physical address, i.e. serving as the information for key identification code matching.

3. The processor for clearing the translation backup buffer according to a specified key identification code as described in claim 2, wherein, Each entry carries a process context identification code serving as the information for key identification code matching, the process context identification code being a key identification code.

4. The processor for clearing the translation backup buffer according to a specified key identification code as described in claim 2, wherein, Each entry carries a virtual processor identification code serving as the information for key identification code matching, the virtual processor identification code being a key identification code.

5. The processor for clearing the translation backup buffer according to a specified key identification code as described in claim 2, wherein, Each entry carries a physical address and a key identification code, the key identification code carried by each entry serving as the information for key identification code matching.

6. The processor for clearing the translation backup buffer according to a specified key identification code as described in claim 2, wherein, Each entry carries a key identification code code serving as the information for key identification code matching, the key identification code code representing a key identification code of a longer bit length with a shorter bit length.

7. The processor for clearing the translation backup buffer according to a specified key identification code as described in claim 2, wherein, 8. The processor for TLB flush according to a specified key identification code as claimed in claim 7, wherein: the control logic circuit includes a fill unit to pair a key identification code code to a key identification code corresponding to each entry of the TLB to form a mapping table when filling each entry of the TLB; the control logic circuit includes a flush unit to query the mapping table according to the specified key identification code to obtain a specified key identification code code according to an indication of the flush microinstruction; and the flush unit provides the specified key identification code code and a flush command to the TLB table to flush entries matching the specified key identification code code. The control logic circuit includes a flush unit to receive the flush microinstruction and the specified key identification code to output a flush command and specified matching information associated with the specified key identification code to the TLB table.

10. The processor for TLB flush according to a specified key identification code as claimed in claim 1, wherein:

9. The processor for clearing the translation backup buffer according to a specified key identification code as described in claim 1, wherein, the instruction is identified by an opcode; the instruction uses a first operand and a second operand, both stored in a register of the processor or one stored in a register of the processor and the other stored in the system memory. ​ ​ The first operand is a first value, the second operand is interpreted as a virtual address, and the microinstruction is configured to obtain the specified key identification code from the virtual address; and The first operand is a second value, and the second operand is interpreted as the specified key identification code.

11. The processor of claim 1, wherein: the microinstruction is further configured to determine whether a virtual machine extension is enabled, determine a state of the virtual machine extension when the virtual machine extension is enabled, and clear the translation lookaside buffer in accordance with the specified key identification code based on the determination.

12. The processor of claim 11, wherein: when the virtual machine extension is not enabled or when the virtual machine extension is enabled and the virtual machine extension is in a host state, the processor clears the entire translation lookaside buffer in accordance with the specified key identification code without regard to a virtual processor identification code and a process context identification code.

13. The processor of claim 11, wherein: when the virtual machine extension is enabled and the virtual machine extension is in a virtual machine state and a virtual processor identification code is not enabled, the processor clears all entries in the translation lookaside buffer that are associated with the virtual machine in accordance with the specified key identification code without regard to a process context identification code.

14. The processor of claim 11, wherein: when neither a first condition nor a second condition is true, the processor clears entries in the translation lookaside buffer that are associated with a current virtual processor identification code in accordance with the specified key identification code; the first condition is that the virtual machine extension is not enabled or that the virtual machine extension is enabled and the virtual machine extension is in a host state; and the second condition is that the virtual machine extension is enabled and the virtual machine extension is in a virtual machine state and a virtual processor identification code is not enabled.

15. A method of clearing a translation lookaside buffer in accordance with a specified key identification code, comprising: in response to an instruction set architecture instruction to clear the translation lookaside buffer in accordance with the specified key identification code, generating at least one microinstruction; and in accordance with a clear microinstruction in the at least one microinstruction, supplying the specified key identification code to control logic of the translation lookaside buffer via a memory order buffer, causing the control logic to clear entries in the translation lookaside buffer that match the specified key identification code.

16. The method of claim 15, further comprising: causing each entry in the translation lookaside buffer to store key identification code matching information to determine whether the entry matches the specified key identification code. each entry stores a physical address, the physical address including a high order portion and a low order portion, the high order portion being a key identification code corresponding to the physical address, the key identification code being used as the key identification code matching information. ​ ​ ​ ​ ​ ​ ​ ​ ​ 17. The method for clearing a translation lookaside buffer after a specified key recognition code is translated according to claim 16, wherein, ​ 18. The method for translation lookaside buffer flush according to a specified key identification code of claim 16, wherein, Each entry carries a process context identification code as the key identification code matching information.

19. The method for translation lookaside buffer flush according to a specified key identification code of claim 16, wherein, Each entry carries a virtual processor identification code as the key identification code matching information.

20. The method for translation lookaside buffer flush according to a specified key identification code as recited in claim 16, wherein, Each entry carries a physical address and a key identification code, the key identification code carried by each entry being used as the key identification code matching information.

21. The method for translation lookaside buffer flush according to a specified key identification code of claim 16, wherein, Each entry carries a key identification code code, which is used as the key identification code matching information, the key identification code code representing a key identification code of a longer bit length in a shorter bit length.

22. The method of claim 21, further comprising: pairing a key identification code code for each key identification code corresponding to each entry of the translation lookaside buffer to form a mapping table when filling in each entry of the translation lookaside buffer; according to the instruction of the clearing microinstruction, querying the mapping table according to the specified key identification code to obtain a specified key identification code code; and providing the specified key identification code code and a clearing command to the translation lookaside buffer to clear entries matching the specified key identification code code.

23. The method of claim 15, wherein: the instruction is identified by an opcode; the instruction uses a first operand and a second operand; when the first operand is a first value, the second operand is interpreted as a virtual address, and the microinstruction obtains the specified key identification code according to the virtual address; and when the first operand is a second value, the second operand is interpreted as the specified key identification code.

24. The method of claim 15, wherein: the microinstruction further interprets whether a virtual machine extension is enabled and a state of the virtual machine extension when the virtual machine extension is enabled, and performs the clearing of the translation lookaside buffer corresponding to the specified key identification code according to the interpretation result.

25. The method of claim 24, wherein: if the virtual machine extension is not enabled or the virtual machine extension is enabled and the virtual machine extension is in a host state, the clearing of the translation lookaside buffer corresponding to the specified key identification code is performed without considering a virtual processor identification code and a process context identification code.

26. The method of claim 24, wherein: if the virtual machine extension is enabled and the virtual machine extension is in a virtual machine state, and a virtual processor identification code is not enabled, the clearing of the translation lookaside buffer corresponding to the specified key identification code is performed without considering a process context identification code for entries involved by all virtual machines in the translation lookaside buffer.

27. The method of claim 24, wherein: if neither a first condition nor a second condition is true, the clearing of the translation lookaside buffer corresponding to the specified key identification code is performed for entries involved by a current virtual processor identification code in the translation lookaside buffer. Under the first condition, the virtual machine extension is not enabled, or the virtual machine extension is enabled and the virtual machine extension is in a host state; and Under the second condition, the virtual machine extension is enabled and the virtual machine extension is in a virtual machine state, while the virtual processor identification code is not enabled.

Images