Microprocessor pipeline circuitry to support cryptographic computing

Abstract

In one embodiment, a processor of a cryptographic computing system includes a register to store an encryption key and address generation circuitry to obtain a pointer representing a linear address to be accessed by a read or write operation, the pointer being at least partially encrypted, obtain the key from the register and a context value, decrypt the encrypted portion of the pointer using the key and the context value as a tweak input, and generate an effective address for use in the read or write operation based on an output of the decryption.

What is claimed is: 
     
         1 . A processor comprising:
 a register to store an encryption key; and   address generation circuitry to:
 obtain a pointer representing a linear address to be accessed by a read or write operation, the pointer being at least partially encrypted; 
 obtain the key from the register and a context value; 
 decrypt the encrypted portion of the pointer using the key and the context value as a tweak input; and 
 generate an effective address for use in the read or write operation based on an output of the decryption. 
   
     
     
         2 . The processor of  claim 1 , wherein the context value is obtained from another register of the processor. 
     
     
         3 . The processor of  claim 1 , wherein the context value is obtained from bits of the pointer. 
     
     
         4 . The processor of  claim 1 , wherein the context value is obtained from memory. 
     
     
         5 . The processor of  claim 1 , wherein the pointer comprises an encrypted base address, plaintext upper bits, and a plaintext offset, and the address generation circuitry is to generate the effective address by:
 decrypting the encrypted base address portion to yield a decrypted base address; and   combining the decrypted base address, the upper bits, and the offset.   
     
     
         6 . The processor of  claim 5 , wherein the address generation circuitry is to generate the effective address by:
 concatenating the decrypted base address with a set of complimentary upper bits and the offset to yield an intermediate base address; and   combining the upper bits with the intermediate base address.   
     
     
         7 . The processor of  claim 6 , wherein the address generation circuitry is to combine the upper bits with the intermediate base address using one or more of an XOR, ADD, or logical AND function. 
     
     
         8 . The processor of  claim 1 , further comprising:
 a data cache unit storing encrypted data; and   memory access circuitry to:
 access the encrypted data stored in the data cache unit; and 
 decrypt the encrypted data based on the key and the effective address. 
   
     
     
         9 . The processor of  claim 8 , wherein the effective address is used as a tweak input to the decryption. 
     
     
         10 . The processor of  claim 8 , wherein the circuitry is to decrypt the encrypted data by:
 generating a key stream based on the effective address and a counter value; and   performing an XOR operation on the key stream and the encrypted data to yield decrypted data.   
     
     
         11 . A method comprising:
 obtaining a pointer representing a linear address to be accessed by a read or write operation, the pointer being at least partially encrypted;   obtaining the key from a processor register and a context value;   decrypting the encrypted portion of the pointer using the key and the context value as a tweak input; and   generating an effective address for use in the read or write operation based on an output of the decryption.   
     
     
         12 . The method of  claim 11 , wherein the context value is obtained from another processor register. 
     
     
         13 . The method of  claim 11 , wherein the context value is obtained from bits of the pointer. 
     
     
         14 . The method of  claim 11 , wherein the context value is obtained from memory. 
     
     
         15 . The method of  claim 11 , wherein the pointer comprises an encrypted base address, plaintext upper bits, and a plaintext offset, and generating the effective address comprises:
 decrypting the encrypted base address portion to yield a decrypted base address; and   combining the decrypted base address, the upper bits, and the offset.   
     
     
         16 . The method of  claim 15 , generating the effective address comprises:
 concatenating the decrypted base address with a set of complimentary upper bits and the offset to yield an intermediate base address; and   combining the upper bits with the intermediate base address.   
     
     
         17 . The method of  claim 16 , wherein combining the upper bits with the intermediate base address comprises using one or more of an XOR, ADD, or logical AND function. 
     
     
         18 . The processor of  claim 11 , further comprising:
 accessing encrypted data stored in a data cache unit; and   decrypting the encrypted data based on the key and the effective address.   
     
     
         19 . The method of  claim 18 , wherein the effective address is used as a tweak input to the decryption. 
     
     
         20 . The method of  claim 18 , wherein decrypting the encrypted data comprises:
 generating a key stream based on the effective address and a counter value; and   performing an XOR operation on the key stream and the encrypted data to yield decrypted data.   
     
     
         21 . A system comprising:
 memory; and   a processor coupled to the memory, the processor comprising:
 a register to store an encryption key; and 
 address generation circuitry to:
 obtain a pointer representing a linear address to be accessed by a read or write instruction stored in the memory, the pointer being at least partially encrypted; 
 obtain the key from the register and a context value; 
 decrypt the encrypted portion of the pointer using the key and the context value as a tweak input; and 
 generate an effective address for use in the read or write operation based on an output of the decryption. 
 
   
     
     
         22 . The system of  claim 21 , wherein the pointer comprises an encrypted base address, plaintext upper bits, and a plaintext offset, and the address generation circuitry is to generate the effective address by:
 decrypting the encrypted base address portion to yield a decrypted base address; and   combining the decrypted base address, the upper bits, and the offset.   
     
     
         23 . The system of  claim 22 , wherein the address generation circuitry is to generate the effective address by:
 concatenating the decrypted base address with a set of complimentary upper bits and the offset to yield an intermediate base address; and   combining the upper bits with the intermediate base address.   
     
     
         24 . The system of  claim 23 , wherein the address generation circuitry is to combine the upper bits with the intermediate base address using one or more of an XOR, ADD, or logical AND function. 
     
     
         25 . The system of  claim 21 , wherein the processor further comprises memory access circuitry to:
 access encrypted data stored in the memory; and   decrypt the encrypted data based on the key and the effective address.