Processor and isolated memory protection method

Abstract

A processor and a method for protecting isolated memory are provided. The processor has a trusted core, a general core, and a last level cache shared by the trusted core and the general core. The trusted core has the permission to access an isolated memory on a system memory. The general core is prohibited from accessing the isolated memory. A cache within the general core and the last level cache form a multi-level cache architecture. The general core generates a memory access request. The multi-level cache architecture determines whether the memory access request hits the isolated memory. If the memory access request hits the isolated memory, the memory access request is excluded.

Description

Technical Field

[0001] This invention relates to trusted computing, and more particularly to access control of isolated memory in trusted computing. Background Technology

[0002] Trusted computing enhances computer system security through hardware partitioning. For example, a computer system's system memory can be divided into isolated memory areas, allowing only authorized trusted kernels to access it.

[0003] How to implement access control over isolated memory is an important issue in trusted computing. Summary of the Invention

[0004] A processor implemented according to one embodiment of this application has a trusted core, a general core, and a last-level cache shared by the trusted core and the general core. The general core is prohibited from accessing the isolated memory. The in-core cache of the general core and the last-level cache form a multi-level cache architecture. The general core generates a memory access request, and the multi-level cache architecture determines whether the memory access request hits the isolated memory. If it does, the memory access request is excluded.

[0005] This application further proposes a method for protecting isolated memory, including: enabling the processor to provide a trusted core with the authority to access isolated memory on the system memory, and prohibiting the processor's general cores from accessing the isolated memory, wherein the processor includes a last-level cache shared by the trusted core and the general core, and the in-core cache of the general core and the last-level cache form a multi-level cache architecture; the general core generates a memory access request; and the multi-level cache architecture determines whether the memory access request hits the isolated memory, and if it does, excludes the memory access request.

[0006] According to the technology of this application, access control of isolated memory can be implemented inside the processor core, which can improve the efficiency of the processor core in access control of isolated memory.

[0007] The following detailed description of the invention is illustrated with specific examples and accompanying drawings. Attached Figure Description

[0008] Figure 1 Illustrated explanation of the concept of isolated memory;

[0009] Figure 2 According to one embodiment of this application, a processor 200 is provided, which has a single general core 202 and a trusted core 204;

[0010] Figure 3 Using a flowchart as an example, this illustrates how a typical core 202 executes the instruction MOV AX,

[1000] ;

[0011] Figure 4 The diagram illustrates the registers used in one embodiment of this application to implement the isolated memory setting 240;

[0012] Figure 5 This is a flowchart illustrating a startup program for a processor 200 according to one embodiment of this application;

[0013] Figure 6A This is a block diagram illustrating the architecture of a data cache 236 (a level 1 cache) according to one embodiment of this application. The same design can be used for an instruction cache 216, which is also a level 1 cache.

[0014] Figure 6B This is a block diagram illustrating the architecture of a second-level cache 238 according to one embodiment of this application. A similar design can be used for the last-level cache 206;

[0015] Figure 7 This is one implementation of hit logic 602;

[0016] Figure 8 According to another embodiment of this application, a processor 800 is provided, which has a plurality of general cores 802_1...802_N and a trusted core 804;

[0017] Figure 9 This is a flowchart illustrating a startup procedure for a processor 800 according to one embodiment of this application.

[0018] [Symbol Explanation]

[0019] 100: Computer System

[0020] 102, 202, 802_1…802_N: General-purpose cores

[0021] 104, 204, 804: Trusted Cores

[0022] 106, 210, 810: System memory

[0023] 108: Trusted Basic Input / Output System

[0024] 110: Trusted Firmware

[0025] 112: Main Operating System

[0026] 114: Trusted Operating System

[0027] 116: Isolated Memory

[0028] 118: Shared Memory

[0029] 120: Storage space for other cores

[0030] 122. PhysBase: Isolated Memory Base Address

[0031] 124. PhysMask: Isolation memory size

[0032] 200, 800: Processor

[0033] 206. LLC: Lowest level cache

[0034] 208, 808: Chipset

[0035] 214, 814: Isolated memory

[0036] 216: Instruction Cache

[0037] 218: Instruction Fetch Unit

[0038] 220: Branch Predictor

[0039] 222: Decoder

[0040] 224: Register Alias ​​Table

[0041] 226: Reserved Station

[0042] 228: Execution Unit

[0043] 230. MSR: Special Module Register

[0044] 232: Memory sorting cache

[0045] 234: Reorder Cache

[0046] 236: Data Cache

[0047] 238. L2: Level 2 Cache

[0048] 240, 252, 852: Isolated memory settings

[0049] 242, 244, 246, and 248: Monitors

[0050] 602: Hit Logic

[0051] 604: Monitoring Register

[0052] 606: Hit handling logic

[0053] 608: Address Output Logic

[0054] 610: Prefetch address calculation logic

[0055] 702, 704: AND gates

[0056] 706: XOR gate

[0057] 708: Inverter

[0058] Base_reg: Base address register

[0059] Ctrl_reg: Control Register

[0060] Mask_reg: Size register

[0061] EAX: Register

[0062] L: Lockout indicator

[0063] L1: Level 1 cache

[0064] MP: Enabled indicator

[0065] S302…S308, S502…S510, S902…S910: Steps

[0066] Q, G, and P: Three symbols used for interrupt design

[0067] V: Valid identifier Detailed Implementation

[0068] The following description illustrates various embodiments of the present invention. This description introduces the basic concepts of the invention and is not intended to limit its scope. The actual scope of the invention should be defined by the claims.

[0069] Figure 1This diagram illustrates the concept of isolated memory. A computer system 100 with trusted computing capabilities includes a normal core 102, a trusted core 104, and system memory (such as dynamic random access memory DRAM, etc.) 106, and is correspondingly designed with a trusted basic input / output system (trusted BIOS) 108 and trusted firmware 110. The normal core 102 runs a host operating system 112. The trusted core 104 runs a trusted operating system 114. The system memory 106 is partitioned, including isolated memory 116, shared memory 118, and corresponding storage space 120 for other cores. As shown in the diagram, the isolated content of isolated memory 116 is only accessible to the trusted operating system 114, and access by the host operating system 112 is specifically prohibited. This application uses registers (e.g., special module registers MSR) to identify isolated memory 116, enabling the processor to identify and prohibit unauthorized access to isolated content. As shown in the figure, the computer system 100 stores the isolated memory base address 122 and the isolated memory size 124 in a register, enabling the general core 102 to identify and prohibit access to the isolated content during the cache matching stage. Furthermore, the processor of this application can generate an interrupt report for unauthorized access during the cache matching stage.

[0070] The 102 core is not limited to a single core; there can be multiple cores. The following first describes the processor architecture of a single 102 core.

[0071] Figure 2 This application discloses a processor 200 according to one embodiment, comprising a single general core 202 and a trusted core 204. In one embodiment, the trusted core 204 and the general core 202 have the same structure (i.e., isomorphic). The processor 200 employs a multi-level cache architecture, wherein the last-level cache (LLC) 206 is shared by the general core 202 and the trusted core 204. The processor 200 is coupled to a chipset 208 to connect to a system memory 210 and one or more external devices 212. The system memory 210 is connected to... Figure 1 As shown, the partitioning plan stipulates that the isolated content of isolated memory 214 can only be accessed by the trusted core 204, and not by the general core 202. External devices 212 can be hard drives (solid-state drives or mechanical hard drives), keyboards, mice, monitors, network cards, etc. This application has a special design for the general core 202, which is described below.

[0072] The instruction cache 216 operates under the control of the fetch unit 218 and the branch predictor 220, fetching instructions from system memory 210 and caching them. The decoder 222 decodes the instructions from the instruction cache 216 into micro-instructions, which are then sent to the execution units 228 for computation via the register alias table (RAT) 224 and the reservation station (RS) 226. These computations involve access to various memory locations. The memory order buffer (MOB) 232 facilitates communication between the general core 202 and various memory locations, operating through a re-order buffer (ROB) 234 connected to the reservation station (RS) 226 and the register alias table (RAT) 224. The memory sorted cache (MOB) 232 further provides a data cache 236, which, together with the instruction cache 216, constitutes the Level 1 cache (L1 cache). This L1 cache, a Level 2 cache 238, and the lowest level cache (LLC) 206 implement a multi-level cache architecture. The contents of system memory 210 (which may be instructions or data) can be cached in this multi-level cache architecture, accelerating the operation of processor 200. However, such a multi-level cache architecture may cache isolated content in isolated memory 214, leading to the problem of isolated content exposure. The proposed solution in this application can shield the general core 202 from accessing isolated content during the cache matching stage.

[0073] like Figure 2 As shown, the model-specific registers (MSR) 230 contain isolated memory settings 240, the contents of which include... Figure 1The isolated memory base address 122 and the isolated memory size 124 indicate the isolated memory 214 of the system memory 210. The first-level cache (including instruction cache 216 and data cache 236), the second-level cache 238, and the last-level cache 206 have monitors 242, 244, 246, and 248, respectively. Based on the isolated memory settings 240 carried in the special module register (MSR) 230, they monitor whether the general core 202 requests access to the isolated memory 214, and promptly exclude or even trigger an interrupt routine. Whether an interrupt routine is started and the type of interrupt routine can also be edited in the isolated memory settings 240 of the special module register (MSR) 230.

[0074] Chipset 208 has an isolated memory setting 252. In another embodiment, the isolated memory setting 252 is set in the uncore (not shown) region of processor 200. During initialization, processor 200 first fills in the isolated memory setting 252 to indicate the isolated memory 214 of system memory 210 and the interrupt mode, and then fills in the isolated memory setting 240 of special module register (MSR) 230 accordingly. This will be discussed later in conjunction with... Figure 5 and Figure 9 The processor initialization process is described in detail.

[0075] Figure 3 The flowchart illustrates how a typical core 202 executes the instruction MOV AX,

[1000] , where the instruction MOVAX,

[1000] is located in system memory 210 and can be one of the instructions contained in the program or process being executed by the typical core 202.

[0076] In step S302, the instruction cache 216 receives an instruction memory access request for the instruction MOV from either the instruction fetch unit 218 or the branch predictor 220. Specifically, when the general core needs to execute the instruction MOV, the instruction fetch unit 218 can generate an instruction memory access request based on the instruction pointer (IP) stored in the instruction pointer register (not shown in the figure) of the general core 202. Alternatively, the branch predictor 220 can generate an instruction memory access request based on the prediction of the branch instruction. This instruction memory access request contains the memory address of the instruction MOV. Then, the instruction fetch unit 218 or the branch predictor 220 sends the generated instruction memory access request to the instruction cache 216.

[0077] In step S304, the monitor 242 in the instruction cache 216 determines whether the instruction MOV is located in the isolated memory 214 of the system memory 210. If yes, the process proceeds to step S306, prohibiting the retrieval of the instruction MOV, and deciding whether to interrupt based on the exception settings, reporting an illegal access to this isolated memory. If no, the process proceeds to step S308, retrieving the instruction MOV. How the monitor 242 determines whether the instruction MOV is in isolated memory 214, and how to report an interrupt when the instruction MOV is in isolated memory 214, will be discussed later. Figure 4 , Figure 6A , Figure 7 Detailed explanation. Step S308 is described below.

[0078] In step S308, if the instruction MOV is already cached in instruction cache 216, then step S308 retrieves the instruction MOV from instruction cache 216. Alternatively, if the instruction MOV is not yet cached in instruction cache 216, then instruction cache 216 sends the instruction read request to the second-level cache 238. If the instruction MOV is not yet cached in the second-level cache 238, then the second-level cache 238 sends the instruction read request to the lowest-level cache 206. If the instruction MOV is not yet cached in the lowest-level cache 206, then step S308 retrieves the instruction MOV from system memory 210 and caches it sequentially in the lowest-level cache 206, the second-level cache 238, and the instruction cache 216. During the MOV instruction fetching process, instruction cache 216, L2 cache 238, and last-level cache 206 all generate multiple prefetch addresses. Monitors 242, 246, and 248 determine whether the prefetch address is located in isolated memory 214. If the prefetch address is not located in isolated memory 214, the data at the prefetch address in system memory 210 is prefetched into instruction cache 216, L2 cache 238, and last-level cache 206 to improve the processing efficiency of processor 200. This will be discussed in conjunction with... Figure 6A , 6B Section 7 details the processing of instruction cache 216, level 2 cache 238, and level 3 cache 206. Step S310 is described below.

[0079] In step S310, the instruction MOV AX,

[1000] is decoded into a microinstruction by decoder 222, and then sent to memory sorting cache (MOB) 232 via register alias table (RAT) 224 and reservation station (RS) 226. In step S312, memory sorting cache (MOB) 232 generates a data memory access request (e.g., access address 1000) and submits it to the multi-level cache architecture consisting of data, second, and last-level caches 236, 238, and 206. In step S314, monitors 244, 246, and 248 in the multi-level cache architecture determine whether the access address 1000 and the associated prefetch address fall into the isolated memory 214 of system memory 210. If so, the process proceeds to step S316, prohibiting the data memory access request, and determining whether to interrupt based on exception settings, reporting the illegal access to this isolated memory. If not, the process proceeds to step S318, allowing data to be retrieved from the multi-level cache architecture or system memory 220, completing the instruction MOV AX,

[1000] . The following will combine... Figure 6A , 6B Section 7 details the processing of the data cache 236, the second-level cache 238, and the last-level cache 206.

[0080] Depend on Figure 3 As shown in the processing flow, during the execution of the MOV instruction, core 202 generally first reads the instruction MOV AX from the multi-level cache architecture consisting of instruction cache 216, level 2 cache 238, and last-level cache 206 according to the instruction memory access request,

[1000] and then reads the operand of the instruction MOV (access address 1000) from the multi-level cache architecture consisting of data cache 236, level 2 cache 238, and last-level cache 206 according to the data memory access request. In the multi-level cache architecture, it is determined whether the instruction or data memory access request hits the isolated memory 214 (i.e., whether the instruction or data is located in the isolated memory 214) according to the isolation memory setting 240. If it hits (i.e., the instruction or data is located in the isolated memory 214), the instruction or data memory access request is excluded, and an interrupt can be reported.

[0081] In one implementation, the trusted core 204 has the same structure as the general core 202 (i.e., the trusted core 204 and the general core 202 are isomorphic). The trusted core 204 can access all system memory, including isolated memory 214. Specifically, a request sent by the trusted core 204 to the last-level cache 206 carries a flag; when the last-level cache 206 recognizes this flag, it knows that the request is from the trusted core 204, and the monitor 248 does not need to monitor whether it is accessing isolated memory 214.

[0082] Figure 4The diagram illustrates the registers used in implementing the isolated memory setting 240 according to one embodiment of this application.

[0083] This application reads the relevant settings for isolated memory 214 using the instruction CPUID, stores them in register EAX, and makes a bit (also called a bit, such as bit [7]) in register EAX indicate whether processor 200 supports isolated memory protection. In particular, isolated memory 214 can be distributed in multiple intervals, and multiple bits (also called bits, such as bits [6:0]) in register EAX are used to indicate the total amount of these intervals.

[0084] like Figure 4 As shown, the special module register (MSR) 230 contains a control register Ctrl_reg, which uses a bit (also called a bit, such as bit[1]) as the enable flag MP to indicate whether the isolated memory protection function is enabled.

[0085] For each isolated memory region, the Special Module Register (MSR) 230 also provides a base address register Base_reg and a size register Mask_reg, which respectively indicate an isolated memory base address PhysBase (as mentioned above). Figure 1 (labeled 122), and an isolated memory size PhysMask (mentioned above) Figure 1 (Number 124).

[0086] To prevent hackers from arbitrarily modifying the register contents, the control register Ctrl_reg, the base address register Base_reg, and the size register Mask_reg are all locked with a single bit (also called a bit, e.g., bit [0]). Once the control register Ctrl_reg, the base address register Base_reg, and the size register Mask_reg are edited, the lock flag L changes from 0 to 1 (i.e., is set), and no further modification of the control register Ctrl_reg, the base address register Base_reg, and the size register Mask_reg is allowed. The size register Mask_reg is also valid with a single bit (also called a bit,) V, indicating that it is valid for the registers Base_reg and Mask_reg, and that the marked range is indeed isolated memory 214.

[0087] The Mask_reg register has an interrupt design, using three bits (Q, G, and P) as indicators. If Q is 1, even if an illegal access to isolated memory 214 occurs, no interrupt needs to be reported; instead, execution continues with the instruction following the one accessing isolated memory 214. If Q is 0 and G is 1, the illegal access to isolated memory 214 is reported using the traditional interrupt #GP (general-protection exception). If both Q and G are 0 and P is 1, the illegal access to isolated memory 214 is reported using a newly defined interrupt. Taking the x86 processor as an example, defining a new interrupt requires defining a new interrupt vector number and a corresponding interrupt handler. For example, a vector number is selected from interrupt vectors 13H-1FH (reserved) or 20H-FFH (freely usable) as the new interrupt vector number, and a corresponding interrupt handler is written for it.

[0088] Figure 5 This is a flowchart illustrating a startup procedure for a processor 200 according to one embodiment of this application.

[0089] Please refer to Figure 2 and Figure 5 In step S502, the system starts and selects a core as the trusted core 204. In step S504, the trusted core 204 starts and verifies the trusted firmware and trusted basic input / output system (e.g., signature authentication); during this period, the general core 202 is in a sleep state, waiting for an initialization interrupt INIT. After the trusted core 204 completes the verification, it sends the initialization interrupt INIT to the general core and enters a sleep state. In step S506, upon receiving the initialization interrupt INIT, the general core 202 wakes up, executes basic input / output code, initializes the system memory 210, and writes the base address and size of the isolated memory 214 into the isolated memory setting 252. In step S508, the general core 202 and the trusted core 204 initialize themselves, reading the base address and size of the isolated memory 214 from the isolated memory setting 252 to fill the base address register Base_reg and size register Mask_reg of the special module register (MSR) 230, where a lock flag L is set as the isolated memory setting 240. In step S510, monitors 242, 244, 246, and 248 begin operation to prevent general core 202 from accessing isolated memory 214. The specific exclusion process has been described above. Figure 3 Since a description has already been provided, I will not repeat it here.

[0090] The following is combined with Figure 6A , 6B 7, for Figure 2The first-level cache (including instruction cache 216 and data cache 236), the second-level cache 238, and the last-level cache 206 are described in detail.

[0091] Figure 6A The diagram illustrates the architecture of a data cache 236 (a level 1 cache) according to one embodiment of this application. The same design can be used for the instruction cache 216, which is also a level 1 cache.

[0092] The data cache 236's monitor 244 includes a hit logic 602. Besides the monitor 244, the data cache 236 also includes a monitor register 604, hit processing logic 606, address output logic 608, and prefetch address calculation logic 610. The monitor register 604 stores the base address and size loaded in the isolated memory setting 240, which is used as a comparison reference by the hit logic 602. The hit processing logic 606 is based on the interrupt settings (such as those loaded in the isolated memory setting 240)... Figure 4 The flags Q, G, and P in the Mask_reg register determine whether to report an interrupt when isolated memory 214 is hit. If flag Q is 1, even if an illegal access to isolated memory 214 occurs, no interrupt needs to be reported; instead, execution continues with instructions following the instruction that accessed isolated memory 214. If flag Q is 0 and flag G is 1, the illegal access to isolated memory 214 is reported using the traditional interrupt #GP (general-protection exception). If both flags Q and G are 0 and flag P is 1, the illegal access to isolated memory 214 is reported using a newly defined interrupt. See the previous description of the interrupt design for the Mask_reg size register for details.

[0093] like Figure 6AAs shown, the access address (i.e., the address of the data that core 202 wants to access in system memory 210) must be compared by monitor 244 using hit logic 602. If the isolated memory 214 is hit, monitor 244 sets a hit flag and kills the request accordingly. The hit flag is also used to trigger the hit processing logic 606. The hit processing logic 606 will provide or not provide a specific type of interrupt report (such as a traditional interrupt or a newly defined interrupt) to the reorder cache (ROB) 234 according to the interrupt setting (marked G, Q, P), and then the reorder cache (ROB) 234 will trigger the corresponding interrupt handler. While monitor 244 is determining whether the access address hits the isolated memory 214, data cache 236 also checks whether the access target has already been cached by itself. If the access address does not hit the isolated memory 214, and the access target is already cached in the data cache 236, then the cached content is retrieved to respond to the data memory access request; otherwise, the access address is sent to the second-level cache 238 by the address output logic 608.

[0094] In particular, the data cache 236 also features a prefetch design. The access address is converted into a prefetch address by the prefetch address calculation logic 610. The prefetch address also needs to be compared by the hit logic 602 to exclude unauthorized accesses. If the prefetch address hits isolated memory 214, the hit handling logic 606 does not need to be activated. An interrupt report can be generated only when isolated memory 214 is targeted by the kernel (the original target of the instruction). If the prefetch address does not hit isolated memory 214, the prefetch address is sent to the second-level cache 238 by the address output logic 608.

[0095] Figure 6B This is a block diagram illustrating one embodiment of the present application. Figure 2 The architecture of the second-level cache is 238. A similar design can be used for the last-level cache, 206.

[0096] Compared to Figure 6A , Figure 6BHit handling logic 606 is not used. Since the access address of the in-core memory access request involving isolated memory 214 has already been excluded from the first-level cache 236, subsequent cache levels (second-level cache 238, last-level cache 206) do not need to process it with the monitor, nor do they need to waste hardware on interrupt reporting. Subsequent cache levels only need to calculate the prefetch address of the received access address by the prefetch address calculation logic, and the monitor checks whether the calculated prefetch address hits isolated memory 214. If it hits, the data corresponding to the prefetch address is not cached; if it misses and the data corresponding to the prefetch address has not yet been cached, it is cached (i.e., it is read from system memory 210 into the second-level cache 238 and the last-level cache 206). In particular, the modules of different cache levels (including the monitoring register, monitor, hit logic, and prefetch address calculation logic) can be slightly adjusted to adapt to the cache level design.

[0097] Figure 7 This is one implementation of the hit logic 602. It includes two AND gates 702 and 704, an XOR gate 706, and an inverter 708. The access address (or prefetch address) and the size of the isolated memory are processed by AND gate 702 and used as one input to XOR gate 706. The size of the isolated memory and its base address are processed by AND gate 704 and used as the other input to XOR gate 706. The output of XOR gate 706 is processed by inverter 708 to generate a hit flag. If the access / prefetch address falls into isolated memory 214, the XOR result is 0, and the hit flag is 1. Otherwise, the XOR result is 1, and the hit flag is 0.

[0098] In one implementation, the base address of the isolated memory 214 is, for example, 000200H (12 least significant bits truncated), with a size of FFFE00, corresponding to an address range of 200000H to 3FFFFFH. If the access address is 200010H, then...

[0099] NOT((200010H AND FFFE00000H)XOR

[0100] (000200000H AND FFFE00000H))

[0101] =NOT(200000H XOR 200000H)

[0102] =NOT(0)

[0103] =1

[0104] A hit flag of 1 indicates that the access address 200010H has fallen into the isolated memory range 200000H to 3FFFFFH, where NOT represents logical NOT, AND represents logical AND, and XOR represents logical XOR.

[0105] Figure 8 According to another embodiment of this application, a processor 800 is provided, which includes a plurality of general cores 802_1…802_N and a trusted core 804. The architecture of the general cores 802_1…802_N is the same as... Figure 2 The general-purpose core 202. All general-purpose cores 802_1…802_N have their special module registers (MSRs) containing isolated memory settings (including the base address and size of the isolated memory, and the interrupt mode for unauthorized access). The architecture of the chipset 808 is the same. Figure 2 The chipset 208. In another embodiment, the isolated memory setting 852 is configured in the uncore (not shown) space of the processor 800. The multi-level caches L1 (Level 1 cache, including data cache and instruction cache), L2 (Level 2 cache), and LLC (Level 1 cache) are all equipped with monitors. Figure 6A , Figure 6B The design ensures that any unauthorized access to isolated memory 814 by general cores 802_1…802_N will be blocked by monitors in the caches at each level. In one embodiment, trusted core 804 and general cores 802_1…802_N have the same structure (i.e., isomorphic).

[0106] Figure 9 This is a flowchart illustrating one embodiment of the present application. Figure 8 A startup program for the 800 processor.

[0107] Please refer to Figure 8 and Figure 9In step S902, the system starts and selects one core as the trusted core 804. In step S904, the trusted core 804 starts and verifies the trusted firmware and trusted basic input / output system (e.g., signature authentication). During this period, all general cores 802_1…802_N are in a sleep state, with the bootstrap core waiting for the initialization interrupt INIT and the other general cores waiting for the startup interrupt startupIPI. After the trusted core 804 completes the verification, it sends the initialization interrupt INIT to the bootstrap core and enters a sleep state (hlt sleep). The bootstrap core, or boot strap processor (BSP), is one of the general cores 802_1…802_N. In step S906, upon receiving the initialization interrupt INIT, the bootstrap core wakes up, executes the basic input / output code, initializes the system memory 810, and writes the base address and size of the isolated memory 814 to the isolated memory setting 852. Then, the bootstrap core wakes up the other general cores (the wake-up method can be by sending a startup interrupt startupIPI to the other general cores). In step S908, the trusted core 804 and the general cores 802_1…802_N (including the bootstrap core) are initialized respectively. The isolation memory setting 852 is read out and filled into the special module register (MSR) of the general cores 802_1…802_N. The lock-up flag L of the control register Ctrl_reg, the base address register Base_reg, and the size register Mask_reg is set (see the previous section for details). Figure 4 (Description of the process). In step S910, the monitors in each level of the cache begin to run, excluding general cores 802_1…802_N from accessing isolated memory 814.

[0108] and Figure 5 The above applies to architectures containing only one general-purpose core (such as...) Figure 2 The processing flow of the architecture shown is different. Figure 9 The described processing flow is applicable to architectures containing multiple general-purpose cores (such as...) Figure 8 The architecture shown allows architectures containing multiple general-purpose cores to effectively prevent unauthorized access to isolated memory.

[0109] According to the technology of this application, access control of isolated memory can be implemented inside the processor core, which can improve the efficiency of the processor core in access control of isolated memory.

[0110] Although the present invention has been disclosed above with reference to preferred embodiments, it is not intended to limit the present invention. Those skilled in the art can make some modifications and refinements without departing from the spirit and scope of the present invention. Therefore, the scope of protection of the present invention shall be determined by the scope defined in the appended claims.

Claims

1. A processor, comprising: A trusted kernel has permission to access isolated memory on the system's memory. Normal kernels are prohibited from accessing this isolated memory; The lowest-level cache is shared by the trusted core and the general core. in: The kernel cache of the general core and the last-level cache form a multi-level cache architecture; and The general core generates a memory access request. The multi-level cache architecture determines whether the memory access request hits the isolated memory. If it does, the memory access request is excluded.

2. The processor of claim 1, wherein: This multi-level caching architecture also triggers an interrupt procedure when the memory access request hits the isolated memory; and This multi-level cache architecture does not trigger the interrupt procedure when its prefetch address hits the isolated memory.

3. The processor of claim 1, wherein: The general core records the base address and size of the isolated memory using a set of special module registers, which are then compared by the multi-level cache architecture to determine whether the memory access request hits the isolated memory.

4. The processor of claim 3, wherein: The general core also enables or disables interrupt routines through this set of special module registers, and sets the type of the interrupt routine.

5. The processor of claim 3, wherein, This general kernel instruction provides the following special module registers: The control register indicates whether the isolated memory protection function is enabled. The base address register records the base address of the isolated memory; as well as The size register records the size of the isolated memory; Each of the control register, the base address register, and the size register has a lock-up flag. Once the control register, the base address register, and the size register are edited, their respective lock-up flags are set, and no further modifications to the control register, the base address register, and the size register are allowed.

6. The processor of claim 5, wherein: The size register also uses its first bit to indicate whether an interrupt routine has been entered, and its second and third bits to distinguish the type of interrupt routine; and The third bit of the size register indicates the new type of the interrupt routine, wherein the processor is an x86 architecture, and the new type is defined by either a reserved or a custom field in the x86 architecture interrupt vector table.

7. The processor of claim 3, wherein: If there are multiple isolated memory ranges, then the special module registers are multiple pairs of registers that record the base address and size of different ranges in the isolated memory.

8. The processor of claim 1, wherein: The kernel cache of this general core includes a level 1 cache; The first-level cache includes a first-level monitor; The first-level monitor includes the first-level hit logic; The first-level hit logic determines whether the memory access request hits the isolated memory in order to set the first-level hit flag; With the first-level hit flag set, the memory access request is excluded; If the first-level hit flag is not set, it is determined whether the cache content corresponding to the memory access request has already been cached in the first-level cache, so that the cached content can be used to respond to the memory access request, or the memory access request can be delivered to the next level cache.

9. The processor of claim 8, wherein, The first-level hit logic includes: The first AND gate receives the first-level access address of the first-level cache and the size of the isolated memory; The second AND gate receives the size and base address of the isolated memory; An XOR gate receives the output of the first AND gate and the output of the second AND gate; and An inverter receives the output of the XOR gate to generate the first-stage hit flag.

10. The processor of claim 8, wherein: The general core also uses a set of special module registers to start or disable interrupt routines and to set the type of the interrupt routine; This first-level cache also includes hit handling logic; The start or stop status of the interrupt routine, as well as the type of the interrupt routine, are retrieved from the special module registers and then passed to the hit handling logic for reference. With the first-level hit flag set, if the interrupt routine is enabled, the hit handling logic provides an interrupt report to the reordering cache of the general core, depending on the type of the interrupt routine.

11. The processor of claim 10, wherein: The first-level cache also includes first-level prefetch address calculation logic, which generates a first-level prefetch address based on the first-level access address input to the first-level cache, inputs it to the first-level monitor, and runs the first-level hit logic; If the first-level hit flag is set by the first-level hit logic for the first-level prefetch address, then the hit processing logic does not operate.

12. The processor of claim 11, wherein, The first-level cache is either the data cache or the instruction cache of the general core.

13. The processor of claim 11, wherein: The first-level cache is coupled to the last-level cache via the second-level cache; The second-level cache includes a second-level monitor and second-level cache comparison logic, and the second-level monitor includes second-level hit logic; The second-level cache determines whether the cache content corresponding to the memory access request has already been cached in the second-level cache, so as to respond to the memory access request with the cached content, or to deliver the memory access request to the last-level cache.

14. The processor of claim 13, wherein: The second-level cache also includes second-level prefetch address calculation logic, which generates a second-level prefetch address based on the first-level prefetch address, inputs it into the second-level monitor, and runs the second-level hit logic.

15. The processor of claim 14, wherein: The last-level cache includes a last-level monitor and last-level cache comparison logic. The last-level monitor includes last-level hit logic. The lowest-level cache determines whether the cache content corresponding to the memory access request is already cached in the lowest-level cache, and responds to the memory access request with the cached content, or delivers the memory access request to the system memory; and The access request issued by the trusted core carries a flag that prevents the last-level monitor from monitoring whether the access request issued by the trusted core hits the isolated memory.

16. The processor of claim 15, wherein: The last-level cache also includes the last-level prefetch address calculation logic, which generates the last-level prefetch address based on the second-level prefetch address, inputs it into the last-level monitor, and runs the last-level hit logic.

17. The processor of claim 1, further comprising: The general kernel is isomorphic to the trusted kernel.

18. A method for protecting isolated memory, comprising: The processor provides a trusted core with access to isolated memory on system memory, while prohibiting the processor's general cores from accessing this isolated memory. The processor includes a last-level cache shared by the trusted core and the general core, and the general core's in-core cache and the last-level cache form a multi-level cache architecture. For memory access requests generated by a regular core, the multi-level cache architecture determines whether the memory access request hits the isolated memory. If it does, the memory access request is excluded.

19. The method for protecting isolated memory as described in claim 18, further comprising: The general core uses a set of special module registers to record the base address and size of the isolated memory, which are then compared by the multi-level cache architecture to determine whether the memory access request hits the isolated memory.

20. The method for protecting isolated memory as described in claim 19, further comprising: When the system starts up, the trusted core is selected and the trusted firmware and trusted basic input / output system are verified by the trusted core. During this period, the general core is in a dormant state, waiting for the initialization interrupt. After the trusted core completes the verification, it sends the initialization interrupt to the general core and enters a sleep state. Upon receiving the initialization interrupt, the general core wakes up, executes the basic input / output system code, initializes the system memory, and writes the base address and size of the isolated memory into the registers on the chipset. The general core initializes itself, reads the base address and size of the isolated memory from the registers on the chipset, fills it into the special module registers, and sets the lock-up flag accordingly; and The multi-level cache architecture determines whether the isolated memory has been hit based on the base address and size of the isolated memory stored in the special module registers.

21. The method for protecting isolated memory as described in claim 19, wherein, The processor also includes other general cores that are isomorphic to this general core.

22. The method for protecting isolated memory as described in claim 21, further comprising: When the system starts up, the trusted core is selected and used to verify the trusted firmware and the trusted basic input / output system. During this period, the other general cores are in a dormant state, waiting for the startup interrupt. After the trusted core completes the verification, it sends an initialization interrupt to the bootstrap core and enters a sleep state. The bootstrap core is one of the other general cores. Upon receiving the initialization interrupt, the bootstrap core wakes up, executes basic input / output system code, initializes the system memory, and writes the base address and size of the isolated memory into the registers on the chipset. The bootstrap core wakes up the other general cores to initialize itself, reads the base address and size of the isolated memory from the registers on the chipset, fills it into the special module registers of each general core, and sets the lock-up flag accordingly; and The multi-level cache architecture determines whether the isolated memory has been hit based on the base address and size of the isolated memory stored in the special module registers.

23. The method for protecting isolated memory as described in claim 18, further comprising: When the memory access request hits the isolated memory, the multi-level cache architecture triggers an interrupt routine; and This multi-level cache architecture does not trigger the interrupt procedure when its prefetch address hits the isolated memory.

24. The method for protecting isolated memory as described in claim 23, further comprising: The interrupt routine is triggered in the first level cache of the kernel cache of the general core; The first-level cache is either the data cache or the instruction cache of the general core.

Images