Microcode patch loading method of processor and processor

Abstract

The application provides a microcode patch loading method of a processor, comprising: a processor core sending an interrupt request to a security module; the security module obtaining and authenticating a to-be-loaded microcode patch in response to the interrupt request; if the authentication is successful, obtaining a microcode patch plaintext from the to-be-loaded microcode patch, encrypting the microcode patch plaintext by using a first random key to obtain a first microcode patch ciphertext, writing the first microcode patch ciphertext into a memory through a memory controller, configuring the first random key to the processor core, and sending an interrupt response message to the processor core; the processor core receiving the interrupt response message, obtaining the first microcode patch ciphertext if the feedback authentication is successful, and decrypting the first microcode patch ciphertext by using the first random key to obtain the microcode patch plaintext; performing integrity check on the microcode patch plaintext, and loading the microcode patch plaintext if the check is successful. The application can safely load the microcode patch.

Description

Technical Field

[0001] This invention relates to the field of processor technology, and in particular to a microcode patch loading method for a processor and a processor thereof. Background Technology

[0002] Microcode, also known as microinstructions, is a series of relatively simple instructions broken down from complex instructions within a Complex Instruction Set Computing (CSIC) architecture. Given the size and complexity of microcode, it may contain errors. Therefore, modern processors support fixing microcode errors through software-based microcode patches. Microcode patches are released by processor manufacturers in the form of firmware.

[0003] Because malicious microcode patches can tamper with the processor's lowest-level instruction behavior, a secure authentication process before a microcode patch is loaded is crucial. Current security authentication processes lack effective protection against plaintext microcode patches. This is detrimental to system security. Summary of the Invention

[0004] In view of this, the present invention provides a microcode patch loading method for a processor, which can safely load microcode patches.

[0005] In a first aspect, the present invention provides a microcode patch loading method for a processor, the processor including a processor core, a security module, and a memory controller, the microcode patch loading method comprising:

[0006] The processor kernel initiates the microcode patch loading process and sends an interrupt request to the security module;

[0007] In response to the interrupt request, the security module performs the following operations: acquires and authenticates the microcode patch to be loaded; if authentication is successful, obtains the plaintext microcode patch from the microcode patch to be loaded, encrypts the plaintext microcode patch using a first random key to obtain a first ciphertext microcode patch, writes the first ciphertext microcode patch into memory through the memory controller, configures the first random key to the processor core, and sends an interrupt response message to the processor core to indicate successful authentication; if authentication fails, it sends an interrupt response message to the processor core to indicate authentication failure.

[0008] The processor core receives an interrupt response message. If the authentication is successful, the processor core obtains the first microcode patch ciphertext through the memory controller and decrypts the first microcode patch ciphertext using the first random key to obtain the microcode patch plaintext.

[0009] The processor kernel performs an integrity check on the plaintext microcode patch. If the check is successful, the processor kernel loads the plaintext microcode patch.

[0010] Optionally, the plaintext of the microcode patch includes a patch header, patch content, and a summary of the patch header and patch content as a whole.

[0011] Optionally, the security module uses the first random key to encrypt the plaintext of the microcode patch to obtain the ciphertext of the first microcode patch, including:

[0012] The security module uses the first random key to encrypt the patch content and digest of the plaintext microcode patch, and then concatenates the patch header of the plaintext microcode patch to obtain the ciphertext of the first microcode patch.

[0013] Optionally, the processor core performs integrity verification on the plaintext of the microcode patch, including:

[0014] The digest algorithm calculates the digest of the patch header and patch content of the microcode patch plaintext and compares it with the digest contained in the microcode patch plaintext. If the digests match, the verification passes; otherwise, the verification fails.

[0015] Optionally, the security module writes the first microcode patch ciphertext into memory via the memory controller, including:

[0016] The security module sends the first microcode patch ciphertext to the memory controller, and the memory controller uses a second random key to encrypt the first microcode patch ciphertext to obtain the second microcode patch ciphertext, and writes the second microcode patch ciphertext into memory;

[0017] The processor core obtains the first microcode patch ciphertext through the memory controller, including:

[0018] The memory controller retrieves the second microcode patch ciphertext from memory, decrypts the second microcode patch ciphertext using the second random key to obtain the first microcode patch ciphertext, and sends the first microcode patch ciphertext to the processor core.

[0019] Optionally, if the processor includes multiple processor cores, each processor core sends an interrupt request to the security module;

[0020] In response to the first received interrupt request, the security module performs the following operations: acquires and authenticates the microcode patch to be loaded; if authentication is successful, obtains the plaintext microcode patch from the microcode patch to be loaded, encrypts the plaintext microcode patch using a first random key to obtain the first ciphertext microcode patch, writes the first ciphertext microcode patch into memory, configures the first random key to each of the processor cores, and sends an interrupt response message to the processor core that issued the first interrupt request to indicate successful authentication. In response to subsequent interrupt requests, the security module performs the following operations: checks whether the microcode patch version number has been updated; if the microcode patch version number has not been updated, directly sends an interrupt response message to the processor core that issued the subsequent interrupt requests to indicate successful authentication.

[0021] Optionally, the microcode patch loading method further includes:

[0022] Before the processor core initiates the microcode patch loading process, the processor core retrieves the microcode patch to be loaded from the disk or network, and then writes the microcode patch to be loaded to a specified location in memory;

[0023] The processor core writes the physical address at the specified location into a processor-specific register used to control microcode patch loading, thereby triggering the processor core to start the microcode patch loading process and send an interrupt request to the security module.

[0024] Optionally, the interrupt request includes the physical address of the specified location, and the security module obtains and authenticates the microcode patch to be loaded by:

[0025] The security module retrieves the microcode patch to be loaded from a specified location in memory based on the physical address contained in the interrupt request.

[0026] The microcode patch to be loaded is decrypted and its signature verified.

[0027] Secondly, the present invention provides a microcode patch loading method for a processor, the processor including a processor core, a security module, and a memory controller, the microcode patch loading method comprising:

[0028] The processor kernel initiates the microcode patch loading process and sends an interrupt request to the security module;

[0029] In response to the interrupt request, the security module performs the following operations: acquires and authenticates the microcode patch to be loaded; if authentication is successful, obtains the plaintext microcode patch from the microcode patch to be loaded, writes the ciphertext of the third microcode patch into memory through the memory controller (the ciphertext of the third microcode patch is obtained by the memory controller encrypting the plaintext microcode patch using a third random key), and sends an interrupt response message to the processor kernel to indicate successful authentication; if authentication fails, it sends an interrupt response message to the processor kernel to indicate authentication failure.

[0030] The processor core receives an interrupt response message. If the authentication is successful, the processor core obtains the plaintext microcode patch through the memory controller. The plaintext microcode patch is obtained by the memory controller obtaining the ciphertext of the third microcode patch from memory and decrypting the ciphertext of the third microcode patch using the third random key.

[0031] The processor kernel performs an integrity check on the plaintext microcode patch. If the check is successful, the processor kernel loads the plaintext microcode patch.

[0032] Optionally, if the processor includes multiple processor cores, each processor core sends an interrupt request to the security module;

[0033] In response to the first received interrupt request, the security module performs the following operations: acquires and authenticates the microcode patch to be loaded; if authentication is successful, obtains the plaintext microcode patch from the microcode patch to be loaded; writes the ciphertext of the third microcode patch into memory through the memory controller, the ciphertext of the third microcode patch being obtained by the memory controller encrypting the plaintext microcode patch using a third random key; and sends an interrupt response message to the processor core that issued the first interrupt request to indicate successful authentication. In response to subsequent interrupt requests, the security module performs the following operations: checks whether the microcode patch version number has been updated; if the microcode patch version number has not been updated, directly sends an interrupt response message to the processor core that issued the subsequent interrupt requests to indicate successful authentication.

[0034] Thirdly, the present invention provides a processor, comprising: a security module, a processor core, and a memory controller;

[0035] The security module includes:

[0036] The first cryptographic algorithm module is used to authenticate the microcode patch to be loaded during the microcode patch loading process. After successful authentication, the plaintext of the microcode patch is obtained, and the first random key is generated.

[0037] The first encryption module is used to encrypt the plaintext of the microcode patch using the first random key to obtain the ciphertext of the first microcode patch, and write the ciphertext of the first microcode patch into memory through the memory controller;

[0038] A key configuration module is used to configure the first random key into the processor core;

[0039] The processor core includes:

[0040] A key register is used to store the first random key;

[0041] The first decryption module is used to obtain the first microcode patch ciphertext through the memory controller, and use the first random key to decrypt the first microcode patch ciphertext to obtain the microcode patch plaintext, so as to further load the microcode patch plaintext.

[0042] Optionally, the memory controller includes:

[0043] The second encryption module is used to encrypt the first microcode patch ciphertext using a second random key to obtain a second microcode patch ciphertext, and then write the second microcode patch ciphertext into memory.

[0044] The second decryption module is used to decrypt the second microcode patch ciphertext using the second random key to obtain the first microcode patch ciphertext, and then send the first microcode patch ciphertext to the processor core.

[0045] The second random key is generated by the security module and configured into the second encryption module and the second decryption module.

[0046] Fourthly, the present invention provides a processor, comprising: a security module, a processor core, and a memory controller.

[0047] The security module includes:

[0048] The second cryptographic algorithm module is used to authenticate the microcode patch to be loaded during the microcode patch loading process. After successful authentication, the plaintext of the microcode patch is obtained, and the ciphertext of the third microcode patch is written into memory through the memory controller.

[0049] The processor core includes:

[0050] The acquisition module is used to acquire the plaintext of the microcode patch through the memory controller, so as to further load the plaintext of the microcode patch;

[0051] The memory controller includes:

[0052] The third encryption module is used to encrypt the plaintext of the microcode patch using a third random key to obtain the ciphertext of the third microcode patch, and then write the ciphertext of the third microcode patch into memory.

[0053] The third decryption module is used to decrypt the third microcode patch ciphertext using the third random key to obtain the microcode patch plaintext, and then send the microcode patch plaintext to the processor core.

[0054] The third random key is generated by the security module and configured into the third encryption module and the third decryption module.

[0055] The microcode patch loading method provided by this invention authenticates the microcode patch to be loaded through a security module, ensuring the legitimacy of the microcode patch and guaranteeing that it is indeed released by the processor manufacturer. Furthermore, the plaintext microcode patch is encrypted using a random key and then written to memory. The processor kernel then retrieves the ciphertext microcode patch from memory, decrypts it using the random key, obtains the plaintext microcode patch, and verifies its integrity. The entire process utilizes a random key encryption / decryption mechanism, eliminating the risk of key leakage and effectively resisting physical attacks that could tamper with memory data, thus ensuring the secure loading of the microcode patch. Attached Figure Description

[0056] Figure 1 This is a flowchart illustrating a microcode patch loading method for a processor according to an embodiment of the present invention.

[0057] Figure 2 This is a schematic diagram illustrating how a security module of an embodiment of the present invention handles multiple processor core interrupt requests;

[0058] Figure 3 This is a schematic diagram of a microcode patch format according to an embodiment of the present invention;

[0059] Figure 4 This is a flowchart illustrating a microcode patch loading method for a processor according to another embodiment of the present invention.

[0060] Figure 5 This is a schematic diagram of a microcode patch format according to another embodiment of the present invention;

[0061] Figure 6 This is a schematic diagram of the processor structure in one embodiment of the present invention. Figure 1 ;

[0062] Figure 7 This is a schematic diagram of the processor structure in one embodiment of the present invention. Figure 2 ;

[0063] Figure 8 This is a schematic diagram of the processor structure in one embodiment of the present invention. Figure 3 . Detailed Implementation

[0064] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0065] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate for the embodiments of this application described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0066] The following detailed description of some embodiments of the present invention is provided in conjunction with the accompanying drawings. Unless otherwise specified, the following embodiments and features can be combined with each other.

[0067] First, it should be noted that the system boot process for the entire processor system is as follows: the processor boots first, followed by the BIOS / OS. Therefore, the entire boot process is divided into the processor boot phase and the BIOS / OS boot phase. In the initial stage of system boot, the processor core is in a reset state, meaning the microcode has not yet begun execution. The processor's security module (also known as the security processor) starts first, performs relevant operations, and then releases the processor core's reset, allowing the processor core to begin working. After the processor boot phase, the BIOS / OS boot phase begins. This application primarily addresses how to securely load microcode patches during the BIOS / OS boot phase.

[0068] One embodiment of the present invention provides a microcode patch loading method for a processor, the processor including a processor core, a security module, and a memory controller, see reference. Figure 1 The microcode patch loading method includes the following steps:

[0069] S1001, the processor core initiates the microcode patch loading process and sends an interrupt request to the security module to notify the security module to authenticate the microcode patch to be loaded stored in memory;

[0070] S1002, in response to the interrupt request, the security module performs the following operations: obtains and authenticates the microcode patch to be loaded; if authentication is successful, obtains the plaintext microcode patch from the microcode patch to be loaded, encrypts the plaintext microcode patch using the first random key to obtain the ciphertext first microcode patch, writes the ciphertext first microcode patch into memory through the memory controller, configures the first random key to the processor core, and sends an interrupt response message to the processor core to indicate successful authentication; if authentication fails, it sends an interrupt response message to the processor core to indicate authentication failure.

[0071] S1003, the processor core receives the interrupt response message. If the authentication is successful, the processor core obtains the first microcode patch ciphertext through the memory controller and decrypts the first microcode patch ciphertext using the first random key to obtain the microcode patch plaintext.

[0072] S1004: The processor kernel performs an integrity check on the plaintext microcode patch. If the check is successful, the processor kernel loads the plaintext microcode patch.

[0073] In one embodiment, if the processor includes multiple processor cores, each processor core sends an interrupt request to the security module, see reference. Figure 2 , Figure 2 This illustrates a scenario where a security module responds to interrupts from multiple processor cores. Upon receiving the first interrupt request, the security module performs the following operations: It acquires and authenticates the microcode patch to be loaded. If authentication is successful, it obtains the plaintext microcode patch from the patch to be loaded, encrypts the plaintext using a first random key to obtain the ciphertext, writes the ciphertext to memory via the memory controller, configures the first random key to each processor core, and sends an interrupt response message to the processor core that issued the first interrupt request to indicate successful authentication. In response to subsequent interrupt requests, the module performs the following operations: It checks if the microcode patch version number has been updated. If the version number has not been updated, it directly sends an interrupt response message to the processor core that issued the subsequent interrupt requests to indicate successful authentication. If the version number has been updated, it is considered a new round of microcode patch loading, and the validity of the microcode patch needs to be re-authenticated. In reality, since the microcode patches to be loaded from multiple processor cores are the same, there will be no microcode patch version update. In other words, the security module directly indicates successful authentication in response to subsequent interrupt requests.

[0074] The following discussion will focus on steps S1001 to S1004.

[0075] In one embodiment, the following steps may be included before performing step S1001:

[0076] The processor core retrieves the microcode patch to be loaded from the disk or network, and then writes the patch to a specified location in memory, assuming that the physical address of that location is PA. The microcode patch to be loaded is a microcode patch released by the processor manufacturer and cryptographically signed using the chip root key.

[0077] The processor core writes the physical address PA at a specified location into a processor-specific register used to control microcode patch loading, thereby triggering the processor core to start the microcode patch loading process and send an interrupt request to the security module.

[0078] It should be noted that there are many processor-specific registers (MSRs) with different functional characteristics on the processor core. In addition to the MSR used to control the loading of microcode patches, there is also an MSR used to represent the microcode patch version number. The microcode patch version number can be updated by writing the microcode patch version number into the MSR used to represent the microcode patch version number.

[0079] The above steps are implemented by the processor core executing the BIOS / OS system program.

[0080] Further, in one embodiment, before sending an interrupt request to the security module in step S1001, the following steps can be added: The processor kernel obtains the physical address PA of the microcode patch to be loaded in memory from the MSR used to control microcode patch loading, then obtains the version number of the microcode patch to be loaded from the PA, and determines whether the microcode patch to be loaded is a newer version than the microcode patches already loaded by the processor kernel based on the version number. If it is not a newer version, the microcode patch loading process is directly terminated, and the microcode patch to be loaded is not loaded; if it is a newer version, the step of sending an interrupt request to the security module continues. The interrupt request includes information about the physical address PA. After sending the interrupt request, the processor kernel waits for the security module to respond to the interrupt.

[0081] In step S1002, the security module, in response to the interrupt request, may obtain and authenticate the microcode patch to be loaded, including:

[0082] First, the security module retrieves the microcode patch to be loaded from a specified location in memory based on the physical address contained in the interrupt request. It then copies the microcode patch to be loaded from the specified location in memory to its internal secure storage area. Next, the security module authenticates the legitimacy of the microcode patch to be loaded. The authentication process includes decrypting and verifying the signature of the microcode patch to be loaded using the chip root key.

[0083] The security module writes the first microcode patch ciphertext into a dedicated memory region on memory corresponding to the processor core via the memory controller. This dedicated memory region is accessible only to the processor core's microcode and the security module.

[0084] In one embodiment, the plaintext of the microcode patch includes a patch header, patch content, and a summary of the patch header and patch content as a whole.

[0085] The security module uses a first random key to encrypt the plaintext microcode patch to obtain the ciphertext of the first microcode patch, which includes:

[0086] The security module uses the first random key to encrypt the patch content and digest of the plaintext microcode patch, and then concatenates the patch header of the plaintext microcode patch to obtain the ciphertext of the first microcode patch.

[0087] In step S1003, the processor core receives an interrupt response message. If the authentication is successful, it retrieves the first microcode patch ciphertext from a dedicated memory area in memory via the memory controller, saves it to the microcode patch temporary storage area, and then decrypts the first microcode patch ciphertext using the first random key to obtain the microcode patch plaintext. If the authentication for loading the microcode patch fails, the microcode patch loading process ends directly, and the processor core does not load the microcode patch.

[0088] In step S1004, the processor core performs an integrity check on the plaintext of the microcode patch, including:

[0089] The processor core calculates a digest of the patch header and patch content of the plaintext microcode patch using a digest algorithm instruction, and compares it with the digest contained in the plaintext microcode patch. If the digests match, the verification passes, the microcode patch is loaded, and the MSR used to represent the microcode patch version number is updated. If the digests do not match, the verification fails, the microcode patch loading process ends, and the processor core does not load the microcode patch to be loaded.

[0090] It should also be noted that after loading the microcode patch, the processor kernel checks whether the MSR, which indicates the microcode patch version number, has been updated to determine whether the microcode patch was loaded successfully. This step is also implemented by the processor kernel executing the BIOS / OS system program.

[0091] The above process loads the microcode patch during the BIOS / OS boot phase. Once this process is complete, the entire patch loading process is finished.

[0092] Furthermore, in one embodiment, the memory controller may have automatic encryption / decryption capabilities for accessing dedicated memory regions on memory corresponding to the processor core.

[0093] The security module writes the first microcode patch ciphertext into memory via the memory controller, including:

[0094] The security module sends the first microcode patch ciphertext to the memory controller. The memory controller uses a second random key to encrypt the first microcode patch ciphertext to obtain the second microcode patch ciphertext, and then writes the second microcode patch ciphertext into a dedicated memory area. The memory controller's encryption mechanism involves encrypting the entire first microcode patch ciphertext using the second random key to obtain the second microcode patch ciphertext.

[0095] The processor core obtains the first microcode patch ciphertext through the memory controller, including:

[0096] The memory controller retrieves the second microcode patch ciphertext from memory, decrypts it using a second random key to obtain the first microcode patch ciphertext, and sends the first microcode patch ciphertext to the processor core.

[0097] To further explain, during the processor startup phase, the security module needs to complete the following steps in advance: the security module generates a second random key, writes the second random key into the memory controller, and then enables the memory controller to automatically encrypt and decrypt the dedicated memory area on the memory corresponding to the processor core. That is, when writing to the dedicated memory area, the second random key configured by the security module is used to automatically encrypt, and when reading the dedicated memory area, the second random key configured by the security module is used to automatically decrypt.

[0098] In this embodiment, the encryption of the security module and the decryption of the processor core are symmetrical, as are the encryption and decryption of the memory controller itself. However, the encryption methods of the security module and the memory controller are different.

[0099] Figure 3 The formats of the plaintext microcode patch, the microcode patch to be loaded, the ciphertext of the first microcode patch, and the ciphertext of the second microcode patch in this embodiment are shown.

[0100] like Figure 3 (a) The plaintext of the microcode patch consists of three parts:

[0101] (1) Microcode patch header: contains information such as microcode patch version number, size, and applicable CPU model;

[0102] (2) Microcode patch content: contains detailed microcode repair data;

[0103] (3) Summary: It is a summary of the microcode patch header and the patch content as a whole.

[0104] like Figure 3 (b) The microcode patch to be loaded is a plaintext microcode patch released by the processor manufacturer, encrypted and signed using the chip root key. It consists of three parts:

[0105] (1) Security module header: contains information such as microcode patch version number, size, and encryption parameters;

[0106] (2) Microcode patch ciphertext: i.e., the data after the entire microcode patch plaintext is encrypted;

[0107] (3) Security module signature: This is the signature of the security module header and the microcode patch as a whole.

[0108] like Figure 3 (c) First microcode patch ciphertext: obtained by encrypting the patch content and digest of the microcode patch plaintext using the first random key and then concatenating the patch header of the microcode patch plaintext.

[0109] like Figure 3 (d) Second microcode patch ciphertext: obtained by encrypting the entire first microcode patch ciphertext twice using a second random key.

[0110] As can be seen from the above microcode patch format, if the memory controller does not support encryption and decryption functions, the security module can encrypt the plaintext of the microcode patch using the first random key and write it directly into memory. The processor core can obtain the ciphertext of the microcode patch, decrypt it using the first random key, and verify its integrity. This can also resist physical attacks, but the content of the microcode patch header will appear in memory in plaintext form.

[0111] The microcode patch loading method of this invention authenticates the microcode patch to be loaded through a security module, ensuring the legitimacy of the microcode patch and guaranteeing that it is released by the processor manufacturer. Furthermore, the plaintext microcode patch is encrypted using a random key and written to memory. The processor kernel then retrieves the ciphertext microcode patch from memory, decrypts it using the random key, obtains the plaintext microcode patch, and verifies its integrity. The entire process utilizes a random key encryption / decryption mechanism, eliminating the risk of key leakage and effectively resisting physical attacks that could tamper with memory data, thus ensuring the secure loading of the microcode patch.

[0112] On the other hand, one embodiment of the present invention provides a microcode patch loading method for a processor, the processor including a processor core, a security module, and a memory controller, see reference. Figure 4 The microcode patch loading method includes the following steps:

[0113] S4001, the processor core initiates the microcode patch loading process and sends an interrupt request to the security module to notify the security module to authenticate the microcode patch to be loaded stored in memory;

[0114] In response to an interrupt request, the security module in S4002 performs the following operations: It retrieves and authenticates the microcode patch to be loaded. If authentication is successful, it obtains the plaintext microcode patch from the patch to be loaded, writes the ciphertext of the third microcode patch (obtained by encrypting the plaintext microcode patch with a third random key) into memory via the memory controller, and sends an interrupt response message to the processor kernel to indicate successful authentication. If authentication fails, it sends an interrupt response message to the processor kernel to indicate authentication failure.

[0115] S4003: The processor core receives an interrupt response message. If the authentication is successful, the processor core obtains the plaintext of the microcode patch through the memory controller. The plaintext of the microcode patch is obtained by the memory controller obtaining the ciphertext of the third microcode patch from memory and decrypting the ciphertext of the third microcode patch using the third random key.

[0116] S4004: The processor kernel performs an integrity check on the plaintext microcode patch. If the check is successful, the processor kernel loads the plaintext microcode patch.

[0117] In one embodiment, if the processor includes multiple processor cores, each processor core sends an interrupt request to the security module. In response to the first received interrupt request, the security module performs the following operations: acquires and authenticates the microcode patch to be loaded; if authentication is successful, obtains the plaintext microcode patch from the patch to be loaded; writes the ciphertext of the third microcode patch (obtained by encrypting the plaintext microcode patch with a third random key) into memory via the memory controller; and sends an interrupt response message to the processor core that issued the first interrupt request to indicate successful authentication. In response to subsequent interrupt requests, the security module performs the following operations: checks if the microcode patch version number has been updated; if the version number has not been updated, it directly sends an interrupt response message to the processor core that issued the subsequent interrupt requests to indicate successful authentication. If the microcode patch version number has been updated, it is considered a new round of microcode patch loading, and the legality of the microcode patch needs to be re-authenticated. In practice, since the microcode patches to be loaded on multiple processor cores are the same, there will be no microcode patch version update; that is, the security module directly indicates successful authentication in response to subsequent interrupt requests.

[0118] Regarding the specific implementation of steps S4001 to S4004, the difference compared to the aforementioned embodiments lies in the encryption and decryption mechanism. The encryption and decryption of the plaintext in the microcode patch is implemented by the memory controller, and the security module and processor kernel do not participate in encryption and decryption. Other processing procedures can refer to the aforementioned embodiments, and will not be repeated here.

[0119] To further explain, during the processor startup phase, the security module needs to complete the following steps in advance: the security module generates a third random key, writes the third random key into the memory controller, and then enables the memory controller to automatically encrypt and decrypt the dedicated memory area on the memory corresponding to the processor core. That is, when writing to the dedicated memory area, the third random key configured by the security module is used for automatic encryption, and when reading the dedicated memory area, the third random key configured by the security module is used for automatic decryption.

[0120] Figure 5 The format of the plaintext microcode patch, the microcode patch to be loaded, and the ciphertext of the third microcode patch in this embodiment is shown.

[0121] like Figure 5 (a) The plaintext of the microcode patch consists of three parts:

[0122] (1) Microcode patch header: contains information such as microcode patch version number, size, and applicable CPU model;

[0123] (2) Microcode patch content: contains detailed microcode repair data;

[0124] (3) Summary: It is a summary of the microcode patch header and the patch content as a whole.

[0125] like Figure 5 (b) The microcode patch to be loaded is a plaintext microcode patch released by the processor manufacturer, encrypted and signed using the chip root key. It consists of three parts:

[0126] (1) Security module header: contains information such as microcode patch version number, size, and encryption parameters;

[0127] (2) Microcode patch ciphertext: i.e., the data after the entire microcode patch plaintext is encrypted;

[0128] (3) Security module signature: This is the signature of the security module header and the microcode patch as a whole.

[0129] like Figure 5 (c) Third microcode patch ciphertext: obtained by encrypting the entire microcode patch plaintext using a third random key.

[0130] As can be seen from the format of the microcode patch described above, only the memory controller contains a random key and supports symmetric cryptography algorithms. In this way, the security module directly sends the plaintext microcode patch to the memory controller, and the encryption function of the memory controller ensures that the content of the microcode patch in memory is ciphertext. Correspondingly, when the processor core obtains the microcode patch, the memory controller obtains the ciphertext of the microcode patch, decrypts it into plaintext, and then sends it to the processor core. Because the processor core will verify the integrity of the plaintext microcode patch, it can also resist physical attacks, but the data on the processor bus will be plaintext.

[0131] The microcode patch loading method of this invention authenticates the microcode patch to be loaded through a security module, ensuring the legitimacy of the microcode patch and guaranteeing that it is released by the processor manufacturer. Furthermore, the memory controller encrypts the plaintext microcode patch using a random key and writes it to memory. When the processor kernel obtains the encrypted microcode patch, the memory controller decrypts it and verifies the integrity of the plaintext. The entire process uses a random key encryption / decryption mechanism, eliminating the risk of key leakage and effectively resisting physical attacks that could tamper with memory data, thus ensuring the secure loading of the microcode patch.

[0132] On the other hand, one embodiment of the present invention also provides a processor. Figure 6 This is a schematic diagram of the processor structure in one embodiment of the present invention. Figure 6 As shown, taking a single-core processor as an example, the processor includes: a security module 601, a processor core 602, and a memory controller 603. The processor core supports symmetric cryptographic algorithm instructions (such as AES, SM4) and hash algorithm instructions (such as SHA, SM3, CRC). The security module can access a dedicated memory region corresponding to each processor core. The processor core's microcode can interact with the security module via interrupts.

[0133] The security module 601 controls the processor's boot process and includes a first cryptographic algorithm module 6011, a first encryption module 6012, a key configuration module 6013, and a dedicated secure storage area (which can be RAM).

[0134] The first cryptographic algorithm module 6011 contains a chip root key and also supports symmetric cryptographic algorithm instructions (such as AES, SM4), digest algorithm instructions (such as SHA, SM3), asymmetric cryptographic algorithm instructions (such as RSA, ECC, SM2) and true random numbers. The first cryptographic algorithm module 6011 is used to authenticate the microcode patch to be loaded in the microcode patch loading process. After successful authentication, the plaintext of the microcode patch is obtained and the first random key is generated.

[0135] The first encryption module 6012 is used to encrypt the plaintext of the microcode patch using the first random key to obtain the ciphertext of the first microcode patch, and write the ciphertext of the first microcode patch into memory through the memory controller;

[0136] The key configuration module 6013 is used to configure the first random key into the processor core.

[0137] In addition to conventional instruction and cache resources, processor core 602 includes ROM for storing microcode and a microcode patch buffer (which may be RAM) for storing microcode patches. It also includes a key register 6021 for storing a first random key; this key register is writable only by the security module and readable by the microcode. Furthermore, it includes a first decryption module 6022, used to obtain the ciphertext of the first microcode patch through the memory controller and decrypt it using the first random key to obtain the plaintext microcode patch, which can then be further loaded.

[0138] The memory controller 603 is used to write data from the processor's internal memory to memory and retrieve data from memory to the processor's internal memory. This memory controller does not support encryption or decryption functions.

[0139] Figure 7 This is a schematic diagram of the processor structure provided for another embodiment of the present invention. Figure 7 In comparison Figure 6 The memory controller 603 internally contains a second encryption module 6031 and a second decryption module 6032.

[0140] The second encryption module 6031 is used to encrypt the first microcode patch ciphertext with the second random key to obtain the second microcode patch ciphertext, and then write the second microcode patch ciphertext into memory.

[0141] The second decryption module 6032 is used to decrypt the second microcode patch ciphertext using the second random key to obtain the first microcode patch ciphertext, and then send the first microcode patch ciphertext to the processor core.

[0142] The second random key is generated by the security module 601 and configured into the second encryption module 6031 and the second decryption module 6032.

[0143] Figure 8 This is a schematic diagram of the processor provided in yet another embodiment of the present invention. Figure 8 As shown, taking a single-core processor as an example, the processor includes: a security module 801, a processor core 802, and a memory controller 803. The security module can access a dedicated memory region corresponding to each processor core. The processor core's microcode can interact with the security module via interrupts.

[0144] The security module 801 controls the processor's startup process, and has a built-in second cryptographic algorithm module 8011 and a unique secure storage area (which can be RAM). The second cryptographic algorithm module 8011 is used to authenticate the microcode patch to be loaded during the microcode patch loading process. After successful authentication, the plaintext of the microcode patch is obtained, and the ciphertext of the third microcode patch is written into memory through the memory controller.

[0145] In addition to regular instructions and cache resources, processor core 802 also includes ROM for storing microcode and a microcode patch temporary storage area (which can be RAM) for storing microcode patches. It also includes an acquisition module 8021, which is used to acquire the plaintext of the microcode patch through the memory controller in order to further load the plaintext of the microcode patch.

[0146] The memory controller 803 includes: a third encryption module 8031 ​​and a third decryption module 8032.

[0147] The third encryption module 8031 ​​is used to encrypt the plaintext of the microcode patch using a third random key to obtain the ciphertext of the third microcode patch, and then write the ciphertext of the third microcode patch into memory.

[0148] The third decryption module 8032 is used to decrypt the third microcode patch ciphertext using the third random key to obtain the microcode patch plaintext, and then send the microcode patch plaintext to the processor core.

[0149] The third random key is generated by the security module 801 and configured into the third encryption module 8031 ​​and the third decryption module 8032.

[0150] The processor provided in this embodiment does not support decryption in its core; only the memory controller has an encryption / decryption module. The security module does not need to configure a key for the processor core; it only needs to configure a random key for the memory controller.

[0151] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0152] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0153] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for loading microcode patches for a processor, characterized in that, The processor includes a processor core, a security module, and a memory controller, and the microcode patch loading method includes: The processor kernel initiates the microcode patch loading process and sends an interrupt request to the security module; In response to the interrupt request, the security module performs the following operations: acquires and authenticates the microcode patch to be loaded; if authentication is successful, obtains the plaintext microcode patch from the microcode patch to be loaded, encrypts the plaintext microcode patch using a first random key to obtain a first ciphertext microcode patch, writes the first ciphertext microcode patch into memory through the memory controller, configures the first random key to the processor core, and sends an interrupt response message to the processor core to indicate successful authentication; if authentication fails, it sends an interrupt response message to the processor core to indicate authentication failure. The processor core receives an interrupt response message. If the authentication is successful, the processor core obtains the first microcode patch ciphertext through the memory controller and decrypts the first microcode patch ciphertext using the first random key to obtain the microcode patch plaintext. The processor kernel performs an integrity check on the plaintext microcode patch. If the check is successful, the processor kernel loads the plaintext microcode patch.

2. The processor microcode patch loading method according to claim 1, characterized in that, The plaintext of the microcode patch includes a patch header, patch content, and a summary of the patch header and patch content as a whole.

3. The processor microcode patch loading method according to claim 2, characterized in that, The security module uses the first random key to encrypt the plaintext of the microcode patch to obtain the ciphertext of the first microcode patch, including: The security module uses the first random key to encrypt the patch content and digest of the plaintext microcode patch, and then concatenates the patch header of the plaintext microcode patch to obtain the ciphertext of the first microcode patch.

4. The processor microcode patch loading method according to claim 2, characterized in that, The processor core performs integrity verification on the plaintext of the microcode patch, including: The digest algorithm calculates the digest of the patch header and patch content of the microcode patch plaintext and compares it with the digest contained in the microcode patch plaintext. If the digests match, the verification passes; otherwise, the verification fails.

5. The processor microcode patch loading method according to claim 1, characterized in that, The security module writes the first microcode patch ciphertext into memory via the memory controller, including: The security module sends the first microcode patch ciphertext to the memory controller, and the memory controller uses a second random key to encrypt the first microcode patch ciphertext to obtain the second microcode patch ciphertext, and writes the second microcode patch ciphertext into memory; The processor core obtains the first microcode patch ciphertext through the memory controller, including: The memory controller retrieves the second microcode patch ciphertext from memory, decrypts the second microcode patch ciphertext using the second random key to obtain the first microcode patch ciphertext, and sends the first microcode patch ciphertext to the processor core.

6. The processor microcode patch loading method according to claim 1, characterized in that, If the processor includes multiple processor cores, each processor core sends an interrupt request to the security module; In response to the first received interrupt request, the security module performs the following operations: acquires and authenticates the microcode patch to be loaded; if authentication is successful, obtains the plaintext microcode patch from the microcode patch to be loaded, encrypts the plaintext microcode patch using a first random key to obtain the first ciphertext microcode patch, writes the first ciphertext microcode patch into memory, configures the first random key to each of the processor cores, and sends an interrupt response message to the processor core that issued the first interrupt request to indicate successful authentication. In response to subsequent interrupt requests, the security module performs the following operations: checks whether the microcode patch version number has been updated; if the microcode patch version number has not been updated, directly sends an interrupt response message to the processor core that issued the subsequent interrupt requests to indicate successful authentication.

7. The microcode patch loading method according to claim 1, characterized in that, The microcode patch loading method also includes: Before the processor core initiates the microcode patch loading process, the processor core retrieves the microcode patch to be loaded from the disk or network, and then writes the microcode patch to be loaded to a specified location in memory; The processor core writes the physical address at the specified location into a processor-specific register used to control microcode patch loading, thereby triggering the processor core to start the microcode patch loading process and send an interrupt request to the security module.

8. The microcode patch loading method according to claim 7, characterized in that, The interrupt request includes the physical address of the specified location, and the security module obtains and authenticates the microcode patch to be loaded, including: The security module retrieves the microcode patch to be loaded from a specified location in memory based on the physical address contained in the interrupt request. The microcode patch to be loaded is decrypted and its signature verified.

9. A method for loading microcode patches for a processor, characterized in that, The processor includes a processor core, a security module, and a memory controller, and the microcode patch loading method includes: The processor kernel initiates the microcode patch loading process and sends an interrupt request to the security module; In response to the interrupt request, the security module performs the following operations: acquires and authenticates the microcode patch to be loaded; if authentication is successful, obtains the plaintext microcode patch from the microcode patch to be loaded, writes the ciphertext of the third microcode patch into memory through the memory controller (the ciphertext of the third microcode patch is obtained by the memory controller encrypting the plaintext microcode patch using a third random key), and sends an interrupt response message to the processor kernel to indicate successful authentication; if authentication fails, it sends an interrupt response message to the processor kernel to indicate authentication failure. The processor core receives an interrupt response message. If the authentication is successful, the processor core obtains the plaintext microcode patch through the memory controller. The plaintext microcode patch is obtained by the memory controller obtaining the ciphertext of the third microcode patch from memory and decrypting the ciphertext of the third microcode patch using the third random key. The processor kernel performs an integrity check on the plaintext microcode patch. If the check is successful, the processor kernel loads the plaintext microcode patch.

10. The microcode patch loading method according to claim 9, characterized in that, If the processor includes multiple processor cores, each processor core sends an interrupt request to the security module; In response to the first received interrupt request, the security module performs the following operations: acquires and authenticates the microcode patch to be loaded; if authentication is successful, obtains the plaintext microcode patch from the microcode patch to be loaded; writes the ciphertext of the third microcode patch into memory through the memory controller, the ciphertext of the third microcode patch being obtained by the memory controller encrypting the plaintext microcode patch using a third random key; and sends an interrupt response message to the processor core that issued the first interrupt request to indicate successful authentication. In response to subsequent interrupt requests, the security module performs the following operations: checks whether the microcode patch version number has been updated; if the microcode patch version number has not been updated, directly sends an interrupt response message to the processor core that issued the subsequent interrupt requests to indicate successful authentication.

11. A processor, characterized in that, include: Security module, processor core, and memory controller; The security module includes: The first cryptographic algorithm module is used to authenticate the microcode patch to be loaded during the microcode patch loading process. After successful authentication, the plaintext of the microcode patch is obtained, and the first random key is generated. The first encryption module is used to encrypt the plaintext of the microcode patch using the first random key to obtain the ciphertext of the first microcode patch, and write the ciphertext of the first microcode patch into memory through the memory controller; A key configuration module is used to configure the first random key into the processor core; The processor core includes: A key register is used to store the first random key; The first decryption module is used to obtain the first microcode patch ciphertext through the memory controller, and use the first random key to decrypt the first microcode patch ciphertext to obtain the microcode patch plaintext, so as to further load the microcode patch plaintext.

12. The processor according to claim 11, characterized in that, The memory controller includes: The second encryption module is used to encrypt the first microcode patch ciphertext using a second random key to obtain a second microcode patch ciphertext, and then write the second microcode patch ciphertext into memory. The second decryption module is used to decrypt the second microcode patch ciphertext using the second random key to obtain the first microcode patch ciphertext, and then send the first microcode patch ciphertext to the processor core. The second random key is generated by the security module and configured into the second encryption module and the second decryption module.

13. A processor, characterized in that, include: Security module, processor core, and memory controller. The security module includes: The second cryptographic algorithm module is used to authenticate the microcode patch to be loaded during the microcode patch loading process. After successful authentication, the plaintext of the microcode patch is obtained, and the ciphertext of the third microcode patch is written into memory through the memory controller. The processor core includes: The acquisition module is used to acquire the plaintext of the microcode patch through the memory controller, so as to further load the plaintext of the microcode patch; The memory controller includes: The third encryption module is used to encrypt the plaintext of the microcode patch using a third random key to obtain the ciphertext of the third microcode patch, and then write the ciphertext of the third microcode patch into memory. The third decryption module is used to decrypt the third microcode patch ciphertext using the third random key to obtain the microcode patch plaintext, and then send the microcode patch plaintext to the processor core. The third random key is generated by the security module and configured into the third encryption module and the third decryption module.

Images