Patent application EP20164745A (EP), filed 2020-03-21
Publication number: EP3757839A1
Title: SCALABLE VIRTUAL MACHINE OPERATION INSIDE TRUST DOMAINS WITHIN THE TRUST DOMAIN ARCHITECTURE
Abstract: [0001]    Implementations describe a computing system that implements a plurality of virtual machines inside a trust domain (TD), enabled via a secure arbitration mode (SEAM) of the processor. A processor includes one or more registers to store a SEAM range of memory, a TD key identifier of a TD private encryption key. The processor is capable of initializing a trust domain resource manager (TDRM) to manage the TD, and a virtual machine monitor within the TD to manage the plurality of virtual machines therein. The processor is further capable of exclusively associating a plurality of memory pages with the TD, wherein the plurality of memory pages associated with the TD is encrypted with a TD private encryption key inaccessible to the TDRM. The processor is further capable of using the SEAM range of memory, inaccessible to the TDRM, to provide isolation between the TDRM and the plurality of virtual machines.
IPC codes: G06F  21/    57            A I
G06F   9/   455            A I
Claims: number: 1
text: A processor comprising:
number: 2
text: The processor of claim 1, wherein the processor core is further to, responsive to a command from the TD-VMM:
number: 3
text: The processor of any of claims 1 and 2, further comprising a physical address metadata table (PAMT) to store attributes of the plurality of memory pages associated with the TD, wherein the attributes of a memory page include at least one of a state, a type, an owner identifier, or a status of the memory page.
number: 4
text: The processor of any of claims 1-3, wherein the SEAM range of memory comprises one or more memory pages encrypted with a SEAM private encryption key inaccessible to the TDRM
number: 5
text: The processor of any of claims 1-4, wherein the SEAM range of memory comprises one or more memory pages to store a secure extended page table (SEPT), wherein the SEPT comprises mappings of guest physical memory addresses (GPAs) to host physical memory addresses (HPAs) for the plurality of memory pages associated with the TD.
number: 6
text: The processor of claim 5, wherein the SEPT comprises:
number: 7
text: The processor of any of claims 5 and 6, wherein the processor core is further to:
number: 8
text: The processor of any of claims 5-7, wherein the processor core is further to:
number: 9
text: The processor of any of claims 5-8, wherein the processor core is further to:
number: 10
text: The processor of any of claims 5-9, wherein the processor core is further to:
number: 11
text: A method comprising:
number: 12
text: The method of claim 11, further comprising, responsive to a command from the TD-VMM:
number: 13
text: The method of any of claims 11 and 12, further comprising storing a physical address metadata table (PAMT), wherein the PAMT is to store attributes of the plurality of memory pages associated with the TD-VMM, wherein the attributes of a memory page include at least one of a state, a type, an owner identifier, or a status of the memory page.
number: 14
text: The method of any of claims 11-13, further comprising encrypting one or more memory pages in the SEAM range of memory with a SEAM private encryption key inaccessible to the TDRM
number: 15
text: A machine-readable non-transitory medium having stored thereon program code that, when executed by a processor, perform operations comprising:
Office action: search_report, dated 2020-12-30
Prior art cited: ref_id: US2019087575A1
ref_type: patent
severity: background
ref_id: US2018260251A1
ref_type: patent
severity: background
ref_id: - ASVIJA B ET AL: "Security in hardware assisted virtualization for cloud computing-State of the art issues and challenges", COMPUTER NETWORKS, vol. 151, 14 March 2019 (2019-03-14), pages 68 - 92, XP085610770, ISSN: 1389-1286, DOI: 10.1016/J.COMNET.2019.01.013
ref_type: npl
severity: background
ref_id: US2018260251
ref_type: patent
severity: background
ref_id: US2019087575
ref_type: patent
severity: background
ref_id: - ASVIJA B ET AL, "Security in hardware assisted virtualization for cloud computing-State of the art issues and challenges", COMPUTER NETWORKS, (20190314), vol. 151, doi:10.1016/J.COMNET.2019.01.013, ISSN 1389-1286, pages 68 - 92, XP085610770 [A] 1-15 * paragraphs  [02.4] , [00 8] *
ref_type: npl
severity: background
Final disposition: pending (2020-12-30)