Secure memory repartitioning

1. A processor comprising:

a cache;

a processor core coupled to the cache; and

a memory controller coupled between the processor core and main memory, wherein the main memory comprises a memory range comprising a section of convertible pages that are convertible to secure pages or non-secure pages, wherein each of the convertible pages comprises a plurality of data lines, and wherein the processor core, in response to a page conversion instruction, is to:

determine from the page conversion instruction a convertible page in the memory range to be converted; and

convert the convertible page to be at least one of a secure page or a non-secure page, wherein the processor core, to convert the convertible page, is to:

change a bit in a page cache map corresponding to the convertible page, wherein the page cache map comprises an entry for each of the convertible pages in the section;

invalidate cached page contents for the convertible page stored in the cache; and

invalidate a translation mapping with an address of the convertible page.

2. The processor of claim 1 , wherein the page conversion instruction is a first conversion instruction, and wherein the processor core is to convert the convertible page from a non-secure page to a secure page in response to the first conversion instruction.

3. The processor of claim 2 , wherein the processor core is to perform the following in response to the first conversion instruction:

ensure that the address of the convertible page points to a page that is convertible to a secure page;

verify that the bit of the page cache map corresponding to the convertible page is set to be non-secure; and

set the bit of the page cache map to be secure.

4. The processor of claim 1 , wherein the page conversion instruction is a second conversion instruction, and wherein the processor core is to convert the convertible page from a secure page to a non-secure page in response to the second conversion instruction.

5. The processor of claim 4 , wherein the processor core is to perform the following in response to the second conversion instruction:

ensure that address of the convertible page points to a page that is convertible to a non-secure page;

verify that the bit of the page cache map corresponding to the convertible page is set to be secure;

verify that a valid bit of the page cache map is set to invalid; and

set the bit of the page cache map to be non-secure.

6. The processor of claim 1 , wherein the memory range further comprises a hardware reserved section, wherein the processor core, in response to a section conversion instruction, is to convert the hardware reserved section to be at least one of a secure section or a non-secure section.

7. The processor of claim 6 , wherein the section conversion instruction is a third conversion instruction, and wherein the processor core is to convert the hardware reserved section from a non-secure section to a secure section in response to the third conversion instruction.

8. The processor of claim 7 , further comprising a memory encryption engine (MEE) coupled between the processor core and the main memory, wherein the processor core is to perform the following in response to the third conversion instruction:

ensure that an address of the third conversion instruction points to a page in the hardware reserved section;

ensure that the hardware reserved section of the memory range is set as convertible, currently non-secure;

instruct the MEE to install a replay-protection filter for the hardware reserved section; and

instruct the MEE to put the hardware reserved section in an initialized state.

9. The processor of claim 6 , wherein the section conversion instruction is a fourth conversion instruction, and wherein the processor core is to convert the hardware reserved section from a secure section to a non-secure section in response to the fourth conversion instruction.

10. The processor of claim 9 , further comprising a memory encryption engine (MEE) coupled between the processor core and the main memory, wherein the processor core is to perform the following in response to the fourth conversion instruction:

ensure that an address of the fourth conversion instruction points to a page in the hardware reserved section;

ensure that the convertible pages in the section corresponding to the hardware reserved section are in a non-secure state;

instruct the MEE to uninstall a replay-protection filter for the hardware reserved section; and

instruct the MEE to flush contents of the hardware reserved section from its internal cache.

11. The processor of claim 6 , wherein the memory range further comprises another hardware reserved section that cannot be converted.

12. The processor of claim 11 , wherein the main memory comprises a non-secure memory range.

13. A method comprising:

decoding, by a processor core of a processor, a page conversion instruction to convert a convertible page in a memory range in main memory coupled to the processor core, wherein the memory range comprises a section of convertible pages that are convertible to secure pages or non-secure pages; and

executing, by the processor core, the page conversion instruction to convert the convertible page to be at least one of a secure page or a non-secure page wherein the executing further comprises:

changing a bit in a page cache map corresponding to the convertible page, wherein the page cache map comprises an entry for each of the convertible pages in the section;

invalidating cached page contents for the convertible page stored in a cache; and

invalidating a translation mapping with an address of the convertible page.

14. The method of claim 13 , further comprising:

converting, by the processor core, the convertible page from a non-secure page to a secure page when the page conversion instruction is a first conversion instruction; and

converting, by the processor core, the convertible page from the secure page to the non-secure page when the page conversion instruction is a second conversion instruction.

15. The method of claim 14 , further comprising:

in response to the first conversion instruction,

ensuring that the address of the convertible page points to a page that is convertible to a secure page;

verifying that the bit of the page cache map corresponding to the convertible page is set to be non-secure; and

setting the bit of the page cache map to be secure.

16. The method of claim 14 , further comprising:

in response to the second conversion instruction,

ensuring that the address of the convertible page points to a page that is convertible to a non-secure page;

verifying that the bit of the page cache map corresponding to the convertible page is set to be secure;

verifying that a valid bit of the page cache map is set to invalid; and

setting the bit of the page cache map to be non-secure.

17. The method of claim 14 , wherein the memory range further comprises a hardware reserved section, the method further comprises:

decoding, by the processor core, a section conversion instruction to convert the hardware reserved section in the memory range; and

executing the section conversion instruction to convert the hardware reserved section to be at least one of a secure section or a non-secure section.

18. The method of claim 17 , further comprising:

converting, by the processor core, the hardware reserved section from a non-secure section to a secure section when the section conversion instruction is a third conversion instruction; and

converting, by the processor core, the hardware reserved section from the secure section to the non-secure section when the section conversion instruction is a fourth conversion instruction.

19. The method of claim 18 , further comprising:

in response to the third conversion instruction:

ensuring that an address of the third conversion instruction points to a page in the hardware reserved section;

ensuring that the hardware reserved section of the memory range is set as convertible, currently non-secure;

instructing a memory encryption engine (MEE) coupled between the processor core and the main memory to install a replay-protection filter for the hardware reserved section;

instructing the MEE to put the hardware reserved section in an initialized state; and

in response to the fourth conversion instruction:

ensuring that an address of the fourth conversion instruction points to a page in the hardware reserved section;

ensure that the convertible pages in the section corresponding to the hardware reserved section are in a non-secure state;

instructing the MEE to uninstall the replay-protection filter for the hardware reserved section; and

instructing the MEE to flush contents of the hardware reserved section from its internal cache.

20. A system comprising:

a cache;

a processor coupled to the processor, the processor comprising a plurality of functional units to execute instructions; and

a memory device coupled to the processor, wherein the memory device is operable to store code memory and data memory and comprises a memory range comprising a section of convertible pages that are convertible to secure pages or non-secure pages, wherein the processor is to:

decode a page conversion instruction to convert a convertible page in the memory range; and

execute the page conversion instruction to convert the convertible page to be at least one of a secure page or a non-secure page, wherein the processor, to execute the page conversion instruction, is further to:

change a bit in a page cache map corresponding to the convertible page, wherein the page cache map comprises an entry for each of the convertible pages in the section;

invalidate cached page contents for the convertible page stored in the cache; and

invalidate a translation mapping with an address of the convertible page.

21. The system of claim 20 , wherein the page conversion instruction is a first conversion instruction, and wherein the processor is to convert the convertible page from a non-secure page to a secure page in response to the first conversion instruction, and wherein the processor is to perform the following in response to the first conversion instruction:

ensure that the address of the convertible page points to a page that is convertible to a secure page;

verify that the bit of the page cache map corresponding to the convertible page is set to be non-secure; and

set the bit of the page cache map to be secure.

22. The system of claim 20 , wherein the page conversion instruction is a second conversion instruction, and wherein the processor is to convert the convertible page from a secure page to a non-secure page in response to the second conversion instruction, and wherein the processor is to perform the following in response to the second conversion instruction:

ensure that an address of the convertible page points to a page that is convertible to a non-secure page;

verify that the bit of the page cache map corresponding to the convertible page is set to be secure;

verify that a valid bit of the page cache map is set to invalid; and

set the bit of the page cache map to be non-secure.

23. The system of claim 20 , wherein the memory range further comprises a hardware reserved section, wherein the processor, in response to a section conversion instruction, is to:

decode the section conversion instruction to convert the hardware reserved section; and

execute the section conversion instruction to convert the hardware reserved section to be at least one of a secure section or a non-secure section.

24. The system of claim 23 , further comprising a memory encryption engine (MEE) coupled between the processor and the memory device, wherein the section conversion instruction is a third conversion instruction, and wherein the processor is to convert the hardware reserved section from a non-secure section to a secure section in response to the third conversion instruction, wherein the processor is to perform the following in response to the third conversion instruction:

ensure that an address of the third conversion instruction points to a page in the hardware reserved section;

ensure that the hardware reserved section of the memory range is set as convertible, currently non-secure;

instruct the MEE to install a replay-protection filter for the hardware reserved section; and

instruct the MEE to put the hardware reserved section in an initialized state.

25. The system of claim 23 , further comprising a memory encryption engine (MEE) coupled between the processor and the memory device, wherein the section conversion instruction is a fourth conversion instruction, and wherein the processor is to convert the hardware reserved section from a secure section to a non-secure section in response to the fourth conversion instruction, wherein the processor is to perform the following in response to the fourth conversion instruction:

ensure that an address of the fourth conversion instruction points to a page in the hardware reserved section;

ensure that the convertible pages in the section corresponding to the hardware reserved section are in a non-secure state;

instruct the MEE to uninstall a replay-protection filter for the hardware reserved section; and

instruct the MEE to flush contents of the hardware reserved section from its internal cache.