Providing isolation in virtualized systems using trust domains

US11687654B2 · kind B2 · utility

Assignee

• Intel Corporation · US

Inventors

• Ravi L. Sahita · Portland, US
• Baiju V. Patel · Portland, US
• Barry E. Huntley · Hillsboro, US
• Gilbert Neiger · Hillsboro, US
• Hormuzd M. Khosravi · Hillsboro, US
• Ido Ouziel · Atlit, IL
• David M. Durham · Beaverton, US
• Ioannis T. Schoinas · Portland, US
• Siddhartha Chhabra · Portland, US
• Carlos V. Rozas · Portland, US
• Gideon Gerzon · Jerusalem, IL

Key dates

• Filing date: Sep 15, 2017
• Grant date: Jun 27, 2023
• Expiry date: Sep 15, 2037

Classification

• Technology area (CPC G): Physics
• CPC primary: G06F2221/2149
• WIPO field: Computer technology
• WIPO sector: Electrical engineering

Abstract

Implementations describe providing isolation in virtualized systems using trust domains. In one implementation, a processing device includes a memory ownership table (MOT) that is access-controlled against software access. The processing device further includes a processing core to execute a trust domain resource manager (TDRM) to manage a trust domain (TD), maintain a trust domain control structure (TDCS) for managing global metadata for each TD, maintain an execution state of the TD in at least one trust domain thread control structure (TD-TCS) that is access-controlled against software accesses, and reference the MOT to obtain at least one key identifier (key ID) corresponding to an encryption key assigned to the TD, the key ID to allow the processing device to decrypt memory pages assigned to the TD responsive to the processing device executing in the context of the TD, the memory pages assigned to the TD encrypted with the encryption key.