Instructions and logic to provide advanced paging capabilities for secure enclave page caches

Patent metadata

Field	Value
Publication number	US-9430384-B2
Application number	US-201313854107-A
Country	US
Kind code	B2
Filing date	Mar 31, 2013
Priority date	Mar 31, 2013
Publication date	Aug 30, 2016
Grant date	Aug 30, 2016

Abstract

Instructions and logic provide advanced paging capabilities for secure enclave page caches. Embodiments include multiple hardware threads or processing cores, a cache to store secure data for a shared page address allocated to a secure enclave accessible by the hardware threads. A decode stage decodes a first instruction specifying said shared page address as an operand, and execution units mark an entry corresponding to an enclave page cache mapping for the shared page address to block creation of a new translation for either of said first or second hardware threads to access the shared page. A second instruction is decoded for execution, the second instruction specifying said secure enclave as an operand, and execution units record hardware threads currently accessing secure data in the enclave page cache corresponding to the secure enclave, and decrement the recorded number of hardware threads when any of the hardware threads exits the secure enclave.

First claim

What is claimed is:

1. A processor comprising: a first hardware thread and a second hardware thread;
an enclave page cache to store secure data in a cache line for a shared page address allocated to a corresponding secure enclave accessible by said first and second hardware threads;
a decode stage to decode a first instruction for execution by said processor, the first instruction specifying said shared page address as an operand; and one or more execution units, responsive to the decoded first instruction, to:
mark an entry corresponding to an enclave page cache mapping for the shared page address to block creation of a new translation for either of said first or second hardware threads to access secure data corresponding to the shared page address; said decode stage to decode a second instruction for execution by said processor, the second instruction specifying said secure enclave as an operand; and
one or more execution units, responsive to the decoded second instruction, to:
record hardware threads currently accessing secure data in the enclave page cache corresponding to the secure enclave;
wherein the second instruction is an instruction that specifies said secure enclave to record a number of hardware threads currently executing in the secure enclave;
wherein said one or more execution units, responsive to the decoded second instruction, to: decrement the recorded number of hardware threads currently executing in the secure enclave when any of the hardware threads exits the secure enclave.

2. The processor of claim 1 , wherein the first instruction is an instruction that specifies said shared page address to prevent the creation of a new translation corresponding to the shared page address in any translation lookaside buffer (TLB).

3. The processor of claim 1 ,
wherein said one or more execution units, responsive to the decoded first instruction, to:
decrement the recorded number of hardware threads currently executing in the secure enclave when any of the hardware threads exits the secure enclave.

4. A processor comprising:
a first hardware thread and a second hardware thread;
an enclave page cache to store secure data in a cache line for a shared page address allocated to a corresponding secure enclave accessible by said first and second hardware threads;
a decode stage to decode a first instruction for execution by said processor, the first instruction specifying said secure enclave as an operand; one or more execution units, responsive to the decoded first instruction, to:
record hardware threads currently accessing secure data in the enclave page cache corresponding to the secure enclave;
said decode stage to decode a second instruction for execution by said processor, the second instruction specifying said shared page address as an operand; and
one or more execution units, responsive to the decoded second instruction, to:
mark an entry corresponding to an enclave page cache mapping for the shared page address to block creation of a new translation for either of said first or second hardware threads to access secure data corresponding to the shared page address;
wherein the second instruction is an instruction that specifies said shared page address to prevent the creation of a new translation corresponding to the shared page address in any TLB; and
wherein said one or more execution units, responsive to the decoded second instruction, to:
decrement the recorded number of hardware threads currently executing in the secure enclave when any of the hardware threads exits the secure enclave.

5. The processor of claim 4 , wherein the first instruction is an instruction that specifies said secure enclave to record a number of hardware threads currently executing in the secure enclave.

6. The processor of claim 5 , wherein:
said one or more execution units, responsive to the decoded first instruction, to:
decrement the recorded number of hardware threads currently executing in the secure enclave when any of the hardware threads exits the secure enclave.

7. The processor of claim 4 comprising:
said decode stage to decode a second instruction for execution by said processor, the second instruction specifying said shared page address as an operand; and
one or more execution units, responsive to the decoded second instruction, to:
evict and write back secure data in the enclave page cache corresponding to the shared page address if the recorded number of hardware threads currently executing in the secure enclave reaches zero.

8. The processor of claim 7 , wherein the second instruction is an enclave write back (EWB) instruction that specifies said shared page address to evict and write back the shared page from the enclave page cache.

9. The processor of claim 8 , wherein the second instruction fails if the recorded number of hardware threads currently executing in the secure enclave has not reached zero.

10. The processor of claim 8 , wherein the second instruction waits to execute until the recorded number of hardware threads currently executing in the secure enclave reaches zero.

11. A method comprising:
executing, in a multithreaded processor, a first hardware thread and a second hardware thread;
storing secure data in a cache line for a shared page address allocated to a corresponding secure enclave accessible by said first and second hardware threads;
decoding a first instruction for execution by said processor, the first instruction specifying said shared page address as an operand;
responsive to decoding the first instruction, marking an entry corresponding to an enclave page cache mapping for the shared page address to block creation of a new translation for either of said first or second hardware threads to access secure data corresponding to the shared page address;
decoding a second instruction for execution by said processor, the second instruction specifying said secure enclave as an operand; and
responsive to decoding the second instruction, recording hardware threads currently accessing secure data in the enclave page cache corresponding to the secure enclave;
wherein responsive to decoding the second instruction, the recorded number of hardware threads currently executing in the secure enclave decrements when any of the hardware threads exits the secure enclave.

12. The method of claim 11 , wherein the first instruction is an instruction that specifies said shared page address to prevent the creation of a new translation corresponding to the shared page address in any TLB.

13. The method of claim 11 comprising:
responsive to decoding the first instruction, also recording hardware threads currently accessing secure data in the enclave page cache corresponding to the secure enclave.

14. The method of claim 13 , wherein responsive to decoding the first instruction, the recorded number of hardware threads currently executing in the secure enclave decrements when any of the hardware threads exits the secure enclave.

15. The method of claim 14 , wherein a translation corresponding to the shared page address is flushed in a TLB corresponding to any of the hardware threads when the corresponding hardware thread exits the secure enclave.

16. The method of claim 11 , comprising:
decoding a third instruction for execution by said processor, the third instruction specifying said shared page address as an operand; and
responsive to decoding the third instruction, evicting and writing back secure data in the enclave page cache corresponding to the shared page address if the recorded number of hardware threads currently executing in the secure encl

Assignees

• Rozas Carlos V
• Alexandrovich Ilya
• Anati Ittai
• Berenzon Alex
• Goldsmith Michael A
• Huntley Barry E
• Ivanov Anton
• Johnson Simon P
• Leslie-Hurd Rebekah M
• Mckeen Francis X
• Neiger Gilbert
• Rappoport Rinat
• Rodgers Scott Dion
• Savagaonkar Uday R
• Scarlata Vincent R
• Shanbhogue Vedvyas
• Smith Wesley H
• Wood William Colin
• Intel Corp

Inventors

• Rozas Carlos V
• Alexandrovich Ilya
• Anati Ittai
• Berenzon Alex
• Goldsmith Michael A
• Huntley Barry E
• Ivanov Anton
• Johnson Simon P
• Leslie-Hurd Rebekah M
• Mckeen Francis X
• Neiger Gilbert
• Rappoport Rinat
• Rodgers Scott Dion
• Savagaonkar Uday R
• Scarlata Vincent R
• Shanbhogue Vedvyas
• Smith Wesley H
• Wood William Colin

Classifications

• G06F12/0875 Primary

  with dedicated cache, e.g. instruction or stack · CPC title

• G06F12/1475 Primary

  in a virtual system, e.g. with translation means · CPC title

• G06F12/1027

  using associative or pseudo-associative address translation means, e.g. translation look-aside buffer [TLB] · CPC title

• G06F2212/1016

  Performance improvement · CPC title

• G06F21/62

  Protecting access to data via a platform, e.g. using keys or access control rules · CPC title