Seamlessly encrypting memory regions to protect against hardware-based attacks

Abstract

Systems, apparatuses, and methods, and for seamlessly protecting memory regions to protect against hardware-based attacks are disclosed. In one embodiment, an apparatus includes a decoder, control logic, and cryptographic logic. The decoder is to decode a transaction between a processor and memory-mapped input/output space. The control logic is to redirect the transaction from the memory-mapped input/output space to a system memory. The cryptographic logic is to operate on data for the transaction.

What is claimed is: 
     
         1 . An apparatus comprising:
 a decoder to decode a transaction between a processor and memory-mapped input/output space;   control logic to redirect the transaction from the memory-mapped input/output space to a system memory; and   cryptographic logic to operate on data for the transaction.   
     
     
         2 . The apparatus of  claim 1 , wherein the transaction is a write transaction and the cryptographic logic is to encrypt the data and the control logic is to write the encrypted data to the system memory. 
     
     
         3 . The apparatus of  claim 1 , wherein the transaction is a read transaction and the control logic is to read encrypted data from the system memory and the cryptographic logic is to decrypt the encrypted data. 
     
     
         4 . The apparatus of  claim 1 , further comprising a storage location to store a size of a region in the system memory to store encrypted data for the transaction. 
     
     
         5 . The apparatus of  claim 1 , further comprising a storage location to store a base address of a region in the system memory to store encrypted data for the transaction. 
     
     
         6 . A method comprising:
 decoding a transaction between a processor and memory-mapped input/output space;   performing a cryptographic operation on data for the transaction; and   redirecting the transaction from the memory-mapped input/output space to a system memory.   
     
     
         7 . The method of  claim 6 , wherein the transaction is a write transaction and performing the cryptographic operation includes encrypting the data. 
     
     
         8 . The method of  claim 7 , further comprising writing the encrypted data to the system memory. 
     
     
         9 . The method of  claim 6 , wherein the transaction is a read transaction, further comprising reading encrypted data from the system memory. 
     
     
         10 . The method of  claim 9 , further comprising decrypting the encrypted data. 
     
     
         11 . The method of  claim 10 , further comprising delivering the decrypted data to the processor. 
     
     
         12 . The method of  claim 6 , further comprising determining a size of a region in the system memory in which to store encrypted data for the transaction. 
     
     
         13 . The method of  claim 12 , wherein the determination depends on the encryption operation. 
     
     
         14 . The method of  claim 12 , further comprising programming a first location with the determined size. 
     
     
         15 . The method of  claim 12 , further comprising allocating a space in the system memory having the determined size. 
     
     
         16 . The method of  claim 15 , further comprising programming a storage location with a base address of the space in the system memory. 
     
     
         17 . A system comprising:
 a processor;   a system memory; and   a memory encryption engine including:
 a decoder to decode a transaction between the processor and memory-mapped input/output space; 
 control logic to redirect the transaction from the memory-mapped input/output space to the system memory; and 
 cryptographic logic to operate on data for the transaction. 
   
     
     
         18 . The system of  claim 17 , wherein the transaction is a write transaction and the cryptographic logic is to encrypt the data and the control logic is to write the encrypted data to the system memory. 
     
     
         19 . The system of  claim 17 , wherein the transaction is a read transaction and the control logic is to read encrypted data from the system memory and the cryptographic logic is to decrypt the encrypted data. 
     
     
         20 . The system of  claim 19 , wherein the memory encryption engine further comprises:
 a first storage location to store a size of a region in the system memory to store encrypted data for the transaction; and   a second storage location to store a base address of the region.