Low overhead integrity protection with high availability for trust domains

Abstract

Techniques are described for providing low-overhead cryptographic memory isolation to mitigate attack vulnerabilities in a multi-user virtualized computing environment. Memory read and memory write operations for target data, each operation initiated via an instruction associated with a particular virtual machine (VM), include the generation and/or validation of a message authentication code that is based at least on a VM-specific cryptographic key and a physical memory address of the target data. Such operations may further include transmitting the generated message authentication code via a plurality of ancillary bits incorporated within a data line that includes the target data. In the event of a validation failure, one or more error codes may be generated and provided to distinct trust domain architecture entities based on an operating mode of the associated virtual machine.

What is claimed: 
     
         1 . A system comprising:
 processing circuitry to execute a plurality of instructions, wherein each instruction is associated with one virtual machine (VM) of a plurality of virtual machines (VMs); and   memory circuitry communicatively coupled to the processing circuitry to:
 perform a write operation associated with a first VM of the plurality of VMs, wherein to perform the write operation is to include:
 generating a first message authentication code (MAC) based in part on target data to be stored in a memory via the write operation; and 
 storing the first MAC in secondary bits of a data line that includes the target data to be stored in the memory; and 
 
 perform a read operation associated with the first VM, wherein to perform the read operation is to include:
 retrieving the data line from the memory; 
 generating a second message authentication code (MAC) based in part on the target data included in the retrieved data line; and 
 detecting an integrity failure based on a comparison of the second MAC with the first MAC included in the secondary bits of the retrieved data line. 
 
   
     
     
         2 . The system of  claim 1 , wherein the detecting the integrity failure is to include:
 determining that the second MAC does not match the first MAC included in the secondary bits of the retrieved data line.   
     
     
         3 . The system of  claim 1 , wherein the processing circuitry is to:
 generate an error code in response to determining that the integrity failure has occurred, wherein the generated error code is a page fault code.   
     
     
         4 . The system of  claim 3 , wherein the memory circuitry is further to provide, responsive to detecting the integrity failure, an indication to the processing circuitry that the integrity failure has been detected, and
 wherein the processing circuitry is further to determine an operating mode of the first VM and to provide the generated error code to a destination that is based on the determined operating mode of the first VM.   
     
     
         5 . The system of  claim 4 , wherein the determined operating mode of the first VM is one of a group that includes a trust domain (TD) non-root mode, a TD root mode, a VM extension (VMX) root mode, and a VMX non-root mode. 
     
     
         6 . The system of  claim 1 , wherein the generating the first MAC is based, in part, on a first cryptographic key that is specific to the first VM of the plurality of VMs, and a first physical memory address in which the target data is to be stored via the write operation. 
     
     
         7 . The system of  claim 6 , wherein the target data includes ciphertext generated by an encryption algorithm using a second cryptographic key distinct from the first cryptographic key. 
     
     
         8 . The system of  claim 1 , wherein the secondary bits include a plurality of error-correcting code (ECC) bits or other bits transmitted with the target data on a memory bus to the memory. 
     
     
         9 . The system of  claim 1 , wherein the retrieving the data line including the target data and the first MAC from the memory includes performing a single fetch operation. 
     
     
         10 . The system of  claim 1 , wherein the memory circuitry includes a memory controller communicatively coupled to a memory protection controller. 
     
     
         11 . The system of  claim 1 , wherein the plurality of VMs correspond to a plurality of users, tenants, customers, or applications. 
     
     
         12 . An apparatus comprising:
 memory circuitry configured to be communicatively coupled to processing circuitry, the memory circuitry to:
 perform a write operation associated with a first domain of a plurality of domains, wherein to perform the write operation is to include:
 generating a first message authentication code (MAC) based in part on target data to be stored in a memory via the write operation; and 
 storing the first MAC in secondary bits of a data line that includes the target data to be stored in the memory; and 
 
 perform a read operation associated with the first domain, wherein to perform the read operation is to include:
 retrieving the data line from the memory; 
 generating a second message authentication code (MAC) based in part on the target data included in the retrieved data line; and 
 determining that no integrity failure has occurred based on a comparison of the second MAC with the first MAC included in the secondary bits of the retrieved data line. 
 
   
     
     
         13 . The apparatus of  claim 12 , wherein the determining that no integrity failure has occurred is to include:
 determining that the second MAC matches the first MAC included in the secondary bits of the retrieved data line.   
     
     
         14 . The apparatus of  claim 12 , wherein the generating the first MAC is based, in part, on a first cryptographic key that is specific to the first domain of the plurality of domains, and a first physical memory address in which the target data is to be stored via the write operation. 
     
     
         15 . The apparatus of  claim 14 , wherein the target data includes ciphertext generated by an encryption algorithm using a second cryptographic key distinct from the first cryptographic key. 
     
     
         16 . The apparatus of  claim 12 , wherein the secondary bits include a plurality of error-correcting code (ECC) bits or other bits transmitted with the target data on a memory bus to the memory. 
     
     
         17 . The apparatus of  claim 12 , wherein the retrieving the data line including the target data and the first MAC from the memory includes performing a single fetch operation. 
     
     
         18 . A non-transitory machine-readable medium including instructions that, when executed by a processor, the instructions are to cause the processor to:
 perform a write operation associated with a first VM of a plurality of VMs, wherein to perform the write operation is to include:
 generating a first message authentication code (MAC) based in part on target data to be stored in a memory via the write operation; and 
 storing the first MAC in secondary bits of a data line that includes the target data to be stored in the memory; and 
   perform a read operation associated with the first VM, wherein to perform the read operation is to include:
 retrieving the data line from the memory; 
 generating a second message authentication code (MAC) based in part on the target data included in the retrieved data line; and 
 detecting an integrity failure based on a comparison of the second MAC with the first MAC included in the secondary bits of the retrieved data line. 
   
     
     
         19 . The non-transitory machine-readable medium of  claim 18 , wherein the detecting the integrity failure is to include:
 determining that the second MAC does not match the first MAC included in the secondary bits of the retrieved data line.   
     
     
         20 . The non-transitory machine-readable medium of  claim 18 , wherein the instructions, when executed by the processor, are to cause the processor further to:
 generate an error code in response to determining that the integrity failure has occurred, wherein the generated error code is a page fault code.   
     
     
         21 . The non-transitory machine-readable medium of  claim 18 , wherein the generating the first MAC is based, in part, on a first cryptographic key that is specific to the first VM of the plurality of VMs, and a first physical memory address in which the target data is to be stored via the write operation. 
     
     
         22 . A method comprising:
 in response to a write request associated with a first virtual machine (VM) of a plurality of virtual machines (VMs) to store target data in a memory, generating by memory circuitry a first message authentication code (MAC) based in part on the target data;   storing the first MAC in secondary bits of a data line that includes the target data to be stored in the memory;   storing the data line in the memory;   in response to a read request associated with the first VM to retrieve the data line from the memory, generating by the memory circuitry a second message authentication code (MAC) based in part on the target data included in the retrieved data line; and   detecting an integrity failure based determining that the second MAC does not match the first MAC included in the secondary bits of the retrieved data line.   
     
     
         23 . The method of  claim 22 , further comprising:
 generating, by processor circuitry, a page fault code as an error code in response to detecting the integrity failure.   
     
     
         24 . The method of  claim 23 , further comprising:
 providing by the memory circuitry to the processing circuitry, an indication that the integrity failure has been detected;   determining an operating mode of the first VM; and   providing the error code to a destination that is based on the determined operating mode of the first VM.