Apparatus and method for limiting access to model specific registers in a microprocessor
A microprocessor having a control register to which the manufacturer of the microprocessor may limit access. The microprocessor includes a manufacturing identifier that uniquely identifies the microprocessor and that is externally readable from the microprocessor by a user. The microprocessor also includes a secret key, manufactured internally within the microprocessor and externally invisible. The microprocessor also includes an encryption engine, coupled to the secret key, configured to decrypt a user-supplied password using the secret key to generate a decrypted result in response to a user instruction instructing the microprocessor to access the control register. The user-supplied password is unique to the microprocessor. The microprocessor also includes an execution unit, coupled to the manufacturing identifier and the encryption engine, configured to allow the instruction access to the control register if the manufacturing identifier is included in the decrypted result, and to otherwise deny the instruction access to the control register.
1. A microprocessor having a control register to which the manufacturer of the microprocessor may limit access, the microprocessor comprising:
a manufacturing identifier, that uniquely identifies the microprocessor, wherein the manufacturing identifier is externally readable from the microprocessor by a user;
a secret key, manufactured internally within the microprocessor, wherein the secret key is externally invisible;
an encryption engine, coupled to the secret key, configured to decrypt a user-supplied password using the secret key to generate a decrypted result in response to a user instruction instructing the microprocessor to access the control register, wherein the user-supplied password is unique to the microprocessor; and
an execution unit, coupled to the manufacturing identifier and the encryption engine, configured to allow the instruction access to the control register if the manufacturing identifier is included in the decrypted result, and to otherwise deny the instruction access to the control register.
2. The microprocessor of claim 1 , wherein the user-supplied password comprises a value provided by the manufacturer to the user.
3. The microprocessor of claim 2 , wherein the user-supplied password is generated by the manufacturer by encrypting the uniquely-identifying manufacturing identifier of the microprocessor with a same encryption algorithm used by the encryption engine to decrypt the user-supplied password.
4. The microprocessor of claim 1 , wherein the encryption engine comprises an advanced encryption standard (AES) engine.
5. The microprocessor of claim 1 , wherein the secret key is known only by the manufacturer of the microprocessor.
6. The microprocessor of claim 1 , wherein the secret key is readable only by microcode of the microprocessor.
7. The microprocessor of claim 1 , further comprising:
a plurality of control registers;
wherein the instruction specifies which one of the plurality of control registers to access;
wherein the user-supplied password is unique both to the microprocessor and to the one of the plurality of control registers specified by the instruction.
8. The microprocessor of claim 1 , wherein the user-supplied password is unique both to the microprocessor and to whether the instruction instructs the microprocessor to read or write the control register.
9. The microprocessor of claim 1 , wherein the instruction comprises an x86 RDMSR or WRMSR instruction.
10. The microprocessor of claim 1 , further comprising:
a plurality of fuses, selectively blown with the manufacturing identifier.
11. A method for limiting access to a control register of a microprocessor, the method comprising:
decoding a user instruction instructing the microprocessor to access the control register;
decrypting a user-supplied password using a secret key to generate a decrypted result in response to said decoding, wherein the user-supplied password is unique to the microprocessor, wherein the secret key is manufactured internally within the microprocessor but is externally invisible; and
denying the instruction access to the control register if a manufacturing identifier is not included in the decrypted result, wherein the manufacturing identifier uniquely identifies the microprocessor and is externally readable from the microprocessor by a user;
wherein said decoding, said decrypting, and said denying are all performed by the microprocessor.
12. The method of claim 11 , wherein the user-supplied password comprises a value provided by the manufacturer to the user.
13. The method of claim 12 , wherein the user-supplied password is generated by the manufacturer by encrypting the uniquely-identifying manufacturing identifier of the microprocessor with a same encryption algorithm used by the encryption engine to decrypt the user-supplied password.
14. The method of claim 11 , wherein said encrypting is performed according to an advanced encryption standard (AES) encryption algorithm.
15. The method of claim 11 , wherein the secret key is known only by the manufacturer of the microprocessor.
16. The method of claim 11 , wherein the secret key is readable only by microcode of the microprocessor.
17. The method of claim 11 , wherein the microprocessor includes a plurality of control registers, wherein the instruction specifies which one of the plurality of control registers to access, wherein the user-supplied password is unique both to the microprocessor and to the one of the plurality of control registers specified by the instruction.
18. The method of claim 11 , wherein the user-supplied password is unique both to the microprocessor and to whether the instruction instructs the microprocessor to read or write the control register.
19. The method of claim 11 , wherein the instruction comprises an x86 RDMSR or WRMSR instruction.
20. The method of claim 11 , where the manufacturing identifier is selectively blown within a plurality of fuses of the microprocessor.
21. A microprocessor having a control register to which the manufacturer of the microprocessor may limit access, the microprocessor comprising:
a manufacturing identifier, that uniquely identifies the microprocessor, wherein the manufacturing identifier is externally readable from the microprocessor by a user;
a secret key, manufactured internally within the microprocessor, wherein the secret key is externally invisible;
an encryption engine, coupled to the secret key, configured to encrypt the manufacturing identifier using the secret key to generate an encrypted result in response to a user instruction instructing the microprocessor to access the control register; and
an execution unit, coupled to the encryption engine, configured to allow the instruction access to the control register if the encrypted result matches a user-supplied password, and to otherwise deny the instruction access to the control register, wherein the user-supplied password is unique to the microprocessor.
22. A method for limiting access to a control register of a microprocessor, the method comprising:
decoding a user instruction instructing the microprocessor to access the control register;
encrypting a manufacturing identifier using a secret key to generate an encrypted result in response to said decoding, wherein the secret key is manufactured internally within the microprocessor but is externally invisible, wherein the manufacturing identifier uniquely identifies the microprocessor and is externally readable from the microprocessor by a user; and
denying the instruction access to the control register if the encrypted result does not match a user-supplied password, wherein the user-supplied password is unique to the microprocessor;
wherein said decoding, said encrypting, and said denying are all performed by the microprocessor.