Seamlessly encrypting memory regions to protect against hardware-based attacks
View Patent ↗Systems, apparatuses, and methods, and for seamlessly protecting memory regions to protect against hardware-based attacks are disclosed. In one embodiment, an apparatus includes a decoder, control logic, and cryptographic logic. The decoder is to decode a transaction between a processor and memory-mapped input/output space. The control logic is to redirect the transaction from the memory-mapped input/output space to a system memory. The cryptographic logic is to operate on data for the transaction.
1. An apparatus comprising:
a decoder to decode one of a memory read and a memory write transaction on a connection between a first hardware component and a second hardware component in the apparatus, the transaction from a processor to a first address, the first address in a memory-mapped input/output space;
control logic to, in response to the decoder determining that the first address is within a protected region, redirect the transaction from the first address to second address, the second address in a system memory; and
cryptographic logic to operate on data for the transaction.
2. The apparatus of claim 1 , wherein the transaction is a write transaction and the cryptographic logic is to encrypt the data and the control logic is to write the encrypted data to the system memory.
3. The apparatus of claim 1 , wherein the transaction is a read transaction and the control logic is to read encrypted data from the system memory and the cryptographic logic is to decrypt the encrypted data.
4. The apparatus of claim 1 , further comprising a storage location to store a size of a region in the system memory to store encrypted data for the transaction.
5. The apparatus of claim 1 , further comprising a storage location to store a base address of a region in the system memory to store encrypted data for the transaction.
6. A method comprising:
decoding one of a memory read and a memory write transaction on a connection between a first hardware component and a second hardware component in a system, the transaction from a processor to a first address, the first address in a memory-mapped input/output space;
performing, in response to the decoding determining that the first address is within a protected region, a cryptographic operation on data for the transaction; and
redirecting, in response to the decoding determining that the first address is within the protected region, the transaction from the first address to second address, the second address in a system memory.
7. The method of claim 6 , wherein the transaction is a write transaction and performing the cryptographic operation includes encrypting the data.
8. The method of claim 7 , further comprising writing the encrypted data to the system memory.
9. The method of claim 6 , wherein the transaction is a read transaction, further comprising reading encrypted data from the system memory.
10. The method of claim 9 , further comprising decrypting the encrypted data.
11. The method of claim 10 , further comprising delivering the decrypted data to the processor.
12. The method of claim 6 , further comprising determining a size of a region in the system memory in which to store encrypted data for the transaction.
13. The method of claim 12 , wherein the determination depends on the encryption operation.
14. The method of claim 12 , further comprising programming a first location with the determined size.
15. The method of claim 12 , further comprising allocating a space in the system memory having the determined size.
16. The method of claim 15 , further comprising programming a storage location with a base address of the space in the system memory.
17. A system comprising:
a processor;
a system memory; and
a memory encryption engine including:
a decoder to decode one of a memory read and a memory write transaction on a connection between a first component and a second component in the system, the transaction from the processor to a first address, the first address in a memory-mapped input/output space;
control logic to, in response to the decoder determining that the first address is within a protected region, redirect the transaction from the first address to second address, the second address in the system memory; and
cryptographic logic to operate on data for the transaction.
18. The system of claim 17 , wherein the transaction is a write transaction and the cryptographic logic is to encrypt the data and the control logic is to write the encrypted data to the system memory.
19. The system of claim 17 , wherein the transaction is a read transaction and the control logic is to read encrypted data from the system memory and the cryptographic logic is to decrypt the encrypted data.
20. The system of claim 19 , wherein the memory encryption engine further comprises:
a first storage location to store a size of a region in the system memory to store encrypted data for the transaction; and
a second storage location to store a base address of the region.