Abstract: Technologies disclosed herein provide one example of a system that includes processor circuitry and integrity circuitry. The processor circuitry is to receive a first request associated with an application to perform a memory access operation for an address range in a memory allocation of memory circuitry. The integrity circuitry is to determine a location of a metadata region within a cacheline that includes at least some of the address range, identify a first portion of the cacheline based at least in part on a first data bounds value stored in the metadata region, generate a first integrity value based on the first portion of the cacheline, and prevent the memory access operation in response to determining that the first integrity value does not correspond to a second integrity value stored in the metadata region.

Abstract: A processor includes a processing core having a register to store an encoded pointer for a memory address to a memory allocation of a memory, the encoded pointer including a first even odd slot (EOS) bit set to a first value and a second EOS bit set to a second value; and circuitry to receive a memory access request based on the encoded pointer; and in response to determining that the first value matches the second value, perform a memory operation corresponding to the memory access request.

Abstract: In one embodiment, a processor includes a cache and a core. The core includes an execution unit and cryptographic computing circuitry to encrypt plaintext data output by the execution unit and store the encrypted data in the cache and decrypt encrypted data accessed from the cache and provide the decrypted data to the execution unit for processing. The encryption and decryption are based on both a stream cipher and a block cipher. In some embodiments, the encryption is based on providing an output of the stream cipher to the block cipher and the decryption is based on providing an output of the block cipher to the stream cipher.

Abstract: Techniques for memory tagging are disclosed. In the illustrative embodiment, 16 bits of a virtual memory address are used as memory tag bits. In a page table entry corresponding to the virtual memory address, page tag bits indicate which of the 16 bits of the virtual memory address are to be sent to the memory as memory tag bits when a memory operation is requested on the virtual memory address. The memory can then compare the memory tag bits sent with the physical memory address to memory tag bits stored on the memory that correspond to the physical memory address. If the memory tag bits match, then the operation is allowed to proceed.

Abstract: Techniques for improving exception-based invocation of instrumentation handler programs include executing, by a processor, an interrupt instruction of an instrumented program, the interrupt instruction having an interrupt number; searching for the interrupt number in an interrupt table; and in response to the interrupt number being found in the interrupt table, saving an address of a next instruction of the instrumented program after the interrupt instruction as a return address, determining a destination address, in an interrupt destination table, of a beginning of an instrumentation handler program associated with the interrupt number and transferring control of the instrumented program to the instrumentation handler program at the destination address.

Abstract: The present disclosure includes systems and methods for securing data direct I/O (DDIO) for a secure accelerator interface, in accordance with various embodiments. Historically, DDIO has enabled performance advantages that have outweighed its security risks. DDIO circuitry may be configured to secure DDIO data by using encryption circuitry that is manufactured for use in communications with main memory along the direct memory access (DMA) path. DDIO circuitry may be configured to secure DDIO data by using DDIO encryption circuitry manufactured for use by or manufactured within the DDIO circuitry. Enabling encryption and decryption in the DDIO path by the DDIO circuitry has the potential to close a security gap in modern data central processor units (CPUs).

Abstract: Embodiments of systems, apparatuses and methods provide enhanced function as a service (FaaS) to users, e.g., computer developers and cloud service providers (CSPs). A computing system configured to provide such enhanced FaaS service include one or more controls architectural subsystems, software and orchestration subsystems, network and storage subsystems, and security subsystems. The computing system executes functions in response to events triggered by the users in an execution environment provided by the architectural subsystems, which represent an abstraction of execution management and shield the users from the burden of managing the execution. The software and orchestration subsystems allocate computing resources for the function execution by intelligently spinning up and down containers for function code with decreased instantiation latency and increased execution scalability while maintaining secured execution.

Abstract: Systems and methods for memory isolation are provided. The methods include receiving a request to write a data line to a physical memory address, where the physical memory address includes a key identifier, selecting an encryption key from a key table based on the key identifier of the physical memory address, determining whether the data line is compressible, compressing the data line to generate a compressed line in response to determining that the data line is compressible, where the compressed line includes compression metadata and compressed data, adding encryption metadata to the compressed line, where the encryption metadata is indicative of the encryption key, encrypting a part of the compressed line with the encryption key to generate an encrypted line in response to adding the encryption metadata, and writing the encrypted line to a memory device at the physical memory address. Other embodiments are described and claimed.

Abstract: Technologies disclosed herein provide cryptographic computing. An example method comprises storing, in a register, an encoded pointer to a memory location, where first context information is stored in first bits of the encoded pointer and a slice of a memory address of the memory location is encrypted and stored in second bits of the encoded pointer. The method further includes decoding the encoded pointer to obtain the memory address of the memory location, using the memory address obtained by decoding the encoded pointer to access encrypted data at the memory location, and decrypting the encrypted data based on a first key and a first tweak value. The first tweak value includes one or more bits derived, at least in part, from the encoded pointer.

Abstract: A processor core requests a cacheline to be loaded from a memory in a memory access request; and a cache determines a speculated color value for the memory access request, receives a data granule of the cacheline from the memory, and decrypts data of the data granule using the speculated color value.

Abstract: The technology disclosed herein comprises a processor; a memory to store data and a plurality of error correcting code (ECC) bits associated with the data; and a memory controller coupled to the memory, the memory controller to receive a write request from the processor and, when an access control field is selected in the write request, perform an exclusive OR (XOR) operation on the plurality of ECC bits and a fixed encoding pattern to generate a plurality of encoded ECC bits and store the data and the plurality of encoded ECC bits in the memory.

Abstract: Embodiments are directed to memory protection with hidden inline metadata to indicate data type and capabilities. An embodiment of a processor includes a processor core and cache memory. The processor core is to implant hidden inline metadata in one or more cachelines for the cache memory, the hidden inline metadata hidden at a linear address level, hidden from software, the hidden inline metadata to indicate data type or capabilities for the associated data stored on the same cacheline.

Abstract: Techniques for an instruction for a Runtime Call operation are described. An example apparatus comprises decoder circuitry to decode a single instruction, the single instruction to include a field for an identifier of an opcode, the opcode to indicate execution circuitry is to execute a no operation when a runtime call destination equals a predetermined value; and execute an indirect call with the runtime call destination as a destination address when the runtime call destination does not equal the predetermined value. Other examples are described and claimed.

Abstract: In one embodiment, an indirect branch is detected in computer program code. The indirect branch calls one of a plurality of functions using a first register. In response, the computer program code is augmented to store an identifier of the indirect branch call in a second register, and the code for each of the plurality of functions is augmented to: determine whether an identifier for the function matches the identifier stored in the second register and render the first register unusable if the identifier for the function does not match the identifier stored in the second register.

Abstract: Techniques for an instruction for a conditional jump operation (such as a Jump True operation) to detect memory corruption are described. An example apparatus comprises decoder circuitry to decode a single instruction, the single instruction to include fields for identifiers of a source operand, a destination operand, and a field for an opcode, the opcode to indicate execution circuitry is to generate an exception when a value of the source operand is not a first value and not a second value, execute a next instruction when the value of the source operand is the first value, and jump to a destination indicated by the destination operand when the value of the source operand is the second value. Other examples are described and claimed.

Abstract: Some aspects of the present disclosure relate to an apparatus comprising interface circuitry and processor circuitry to write data bits to a memory, by applying a diffusion function on the data bits to calculate diffused data bits, calculating error correcting code (ECC) bits based on the data bits or based on the diffused data bits, applying a diffusion function on the ECC bits to calculate diffused ECC bits, storing the diffused ECC bits in an ECC portion of the memory, and storing the data bits or the diffused data bits in a data portion of the memory.

Abstract: The technology described herein includes a first plurality of bijection diffusion function circuits to diffuse data bits into diffused data bits and store the diffused data bits into a memory; an error correcting code (ECC) generation circuit to generate ECC bits for the data bits; and a second plurality of bijection diffusion function circuits to diffuse the ECC bits into diffused ECC bits and store the diffused ECC bits into the memory.

Abstract: In one embodiment, a multi-tenant computing system includes at least one processor including a plurality of cores on which a plurality of agents of a plurality of tenants of the multi-tenant computing system are to execute, a configuration storage, and a memory execution circuit. The configuration storage includes a first configuration register to store configuration information associated with the memory execution circuit. The first configuration register is to store a mode identifier to identify a mode of operation of the memory execution circuit. The memory execution circuit, in a first mode of operation, is to receive encrypted data of a first tenant of the plurality of tenants, the encrypted data encrypted by the first tenant, generate an integrity value for the encrypted data, and send the encrypted data and the integrity value to a memory, wherein the integrity value is not visible to the software of the multi-tenant computing system.

Abstract: A processor includes a register to store an encoded pointer for a memory address within a first memory allocation of a plurality of memory allocations in a memory region of a memory. The processor further includes circuitry to receive a memory operation request based on the encoded pointer and to obtain a first tag of a plurality of tags stored in a table in the memory. Each memory allocation of the plurality of memory allocations is associated with a respective one of the plurality of tags stored in the table. The circuitry is to further obtain pointer metadata stored in the encoded pointer and to determine whether to perform a memory operation corresponding to the memory operation request based, at least in part, on a determination of whether the first pointer metadata corresponds to the first tag.

Abstract: A method comprises identifying a first page in a computer readable memory communicatively coupled to the apparatus that has been marked as being stored in memory as plaintext even if accessed using cryptographic addresses, the first page in the computer readable memory comprising at least one encrypted data object, and set a page table entry bit for the first page to a first value which indicates that at least one memory allocation in the first page has been marked as being stored in memory as plaintext even if accessed using cryptographic addresses.