Shared memory in a secure processing environment

Patent metadata

Field	Value
Publication number	US-9703715-B2
Application number	US-201314142838-A
Country	US
Kind code	B2
Filing date	Dec 28, 2013
Priority date	Dec 28, 2013
Publication date	Jul 11, 2017
Grant date	Jul 11, 2017

Abstract

Embodiments of an invention for sharing memory in a secure processing environment are disclosed. In one embodiment, a processor includes an instruction unit and an execution unit. The instruction unit is to receive an instruction to match an offer to make a page in an enclave page cache shareable to a bid to make the page shareable. The execution unit is to execute the instruction. Execution of the instruction includes making the page shareable.

First claim

What is claimed is:

1. A processor comprising:
instruction circuitry to receive a first instruction, the first instruction having an offer parameter, a bid parameter, and permissions, the offer parameter to be created by a first enclave to make a page in an enclave page cache shareable to a second enclave according to the permissions, the bid parameter to be created by the second enclave to specify a linear address to which the page is to be mapped within the second enclave;
execution circuitry to execute the first instruction, wherein execution of the first instruction includes making the page shareable; and
memory access control circuitry including a page miss handler to allow the second enclave to access the page according to the permissions.

2. The processor of claim 1 , wherein the instruction unit is also to receive a second instruction to create a shared page metadata array and the execution unit is also to execute the second instruction.

3. The processor of claim 2 , wherein the instruction unit is also to receive a third instruction to create a shared page metadata and the execution unit is also to execute the third instruction.

4. The processor of claim 3 , wherein execution of the first instruction also includes populating the shared page metadata.

5. The processor of claim 4 , wherein the instruction unit is also to receive a fourth instruction to prevent creation of new translations to access the page and the execution unit is also to execute the fourth instruction.

6. The processor of claim 5 , wherein the instruction unit is also to receive a fifth instruction to track sharing of the page and the execution unit is also to execute the fifth instruction.

7. The processor of claim 6 , wherein the instruction unit is also to receive a sixth instruction to detach mappings to the page and the execution unit is also to execute the sixth instruction.

8. The processor of claim 7 , wherein the instruction unit is also to receive a seventh instruction to re-attach the shared page metadata to the page and the execution unit is also to execute the seventh instruction.

9. A method comprising:
creating, in an enclave page cache, a first shared page metadata for a page for a first enclave to make the page shareable;
matching an offer by a first enclave to make the page in the enclave page cache (EPC) shareable to a bid to make the page shareable with a second enclave by executing an instruction having an offer parameter created by the first enclave and a bid parameter created by the second enclave to specify a linear address to which the page is to be mapped within the second enclave; and
making the page shared by creating a second page metadata for the page for the second enclave.

10. The method of claim 9 , further comprising creating a shared page metadata array.

11. The method of claim 10 , further comprising populating the first shared page metadata.

12. The method of claim 11 , further comprising preventing creation of new translations to access the page.

13. The method of claim 12 , further comprising tracking sharing of the page.

14. The method of claim 13 , further comprising detaching mappings to the page.

15. The method of claim 14 , further comprising evicting the page from the EPC.

16. The method of claim 15 , further comprising re-loading the page into the EPC.

17. The method of claim 9 , further comprising authenticating, by the enclave that created the offer, the enclave that created the bid.

18. A system comprising:
a memory; and
a processor including
an instruction unit to receive a first instruction, the first instruction having an offer parameter, a bid parameter, and permissions, the offer parameter to be created by a first enclave to make a page in an enclave page cache of the memory shareable to a second enclave according to the permissions, the bid parameter to be created by the second enclave to specify a linear address to which the page is to be mapped within the second enclave;
an execution unit to execute the first instruction, wherein execution of the first instruction includes making the page shareable; and
a memory access control unit including a page miss handler to allow the second enclave to access the page according to the permissions.

Assignees

• Intel Corp

Inventors

• Goldsmith Michael A
• Johnson Simon P
• Rozas Carlos V
• Scarlata Vincent R

Classifications

• G06F9/468

  Specific access rights for resources, e.g. using capability register · CPC title

• G06F12/084 Primary

  with a shared cache · CPC title

• G06F2221/2141

  Access rights, e.g. capability lists, access control lists, access tables, access matrices · CPC title

• G06F21/606

  by securing the transmission between two devices or processes · CPC title

• G06F2212/608

  Details relating to cache mapping · CPC title