Memory management in secure enclaves

Patent metadata

Field	Value
Publication number	US-9747102-B2
Application number	US-201213729371-A
Country	US
Kind code	B2
Filing date	Dec 28, 2012
Priority date	Dec 28, 2012
Publication date	Aug 29, 2017
Grant date	Aug 29, 2017

Abstract

Embodiments of an invention for memory management in secure enclaves are disclosed. In one embodiment, a processor includes an instruction unit and an execution unit. The instruction unit is to receive a first instruction and a second instruction. The execution unit is to execute the first instruction, wherein execution of the first instruction includes allocating a page in an enclave page cache to a secure enclave. The execution unit is also to execute the second instruction, wherein execution of the second instruction includes confirming the allocation of the page.

First claim

What is claimed is:

1. A processor comprising:
an instruction unit to receive a first instruction, a second instruction, and a third instruction; and
an execution unit to execute the first instruction, wherein
execution of the first instruction includes allocating a first page in an enclave page cache to a secure enclave,
execution of the second instruction in connection with execution of the first instruction includes confirming the allocating of the first page,
execution of the third instruction includes de-allocating the first page in the enclave page cache from the secure enclave and setting a modified indicator in an entry for the first page in the enclave page cache map, wherein the first page is not modifiable while the modified indicator is set, and
execution of the second instruction in connection with execution of the third instruction includes confirming the de-allocating of the first page and clearing the modified indicator.

2. The processor of claim 1 , wherein execution of the first instruction also includes setting a pending indicator in an entry for the first page in an enclave page cache map.

3. The processor of claim 2 , wherein execution of the second instruction also includes clearing the pending indicator.

4. The processor of claim 2 , wherein the first page is not accessible by the secure enclave while the pending indicator is set.

5. A method comprising:
receiving a first request from a secure enclave for more memory space in an enclave page cache;
receiving a first instruction from an operating system;
in response to receiving the first instruction, allocating a first page in the enclave page cache to the secure enclave;
receiving a second instruction from the secure enclave in connection with executing the first instruction;
in response to receiving the second instruction, confirming the allocating of the first page;
receiving a second request from the secure enclave to de-allocate the first page in the enclave page cache;
receiving a third instruction from the operating system;
in response to receiving the third instruction, de-allocating the first page and setting a modified indicator in an entry for the second page in an enclave page cache map wherein the first page is not modifiable while the modified indicator is set;
receiving the second instruction from the secure enclave in connection with executing the third instruction; and
in response to receiving the second instruction, confirming the de-allocating of the first page and clearing the modified indicator.

6. The method of claim 5 , further comprising, in response to receiving the first instruction, setting a pending indicator in an entry for the first page in an enclave page cache map.

7. The method of claim 6 , further comprising, in response to receiving the second instruction, clearing the pending indicator.

8. The method of claim 7 , wherein the first page is not accessible by the secure enclave while the pending indicator is set.

9. A system comprising:
a memory; and
a processor including
an instruction unit to receive a first instruction, a second instruction, and a third instruction; and
an execution unit to execute the first instruction, wherein
execution of the first instruction includes allocating a first page in an enclave page cache to a secure enclave,
execution of the second instruction in connection with execution of the first instruction includes confirming the allocating of the first page,
execution of the third instruction includes de-allocating the first page in the enclave page cache from the secure enclave and setting a modified indicator in an entry for the first page in the enclave page cache map, wherein the first page is not modifiable while the modified indicator is set, and
execution of the second instruction in connection with execution of the third instruction includes confirming the de-allocating of the first page and clearing the modified indicator.

Assignees

• Intel Corp

Inventors

• Leslie Rebekah
• Rozas Carlos V
• Scarlata Vincent R
• Johnson Simon P
• Savagaonkar Uday R
• Huntley Barry E
• Shanbhogue Vedvyas
• Anati Ittai
• Mckeen Francis X
• Goldsmith Michael A
• Alexandrovich Ilya
• Berenzon Alex
• Smith Wesley H
• Neiger Gilbert G

Classifications

• G06F9/44

  Arrangements for executing specific programs · CPC title

• G06F9/30047 Primary

  Prefetch instructions; cache control instructions · CPC title

• G06F9/30076 Primary

  to perform miscellaneous control operations, e.g. NOP · CPC title

• G06F2212/452

  Instruction code · CPC title

• G06F12/1483

  using an access-table, e.g. matrix or list · CPC title