Method and apparatus to provide secure application execution
A technique to enable secure application and data integrity within a computer system. In one embodiment, one or more secure enclaves are established in which an application and data may be stored and executed.
1. A processor comprising:
execution logic to perform:
at least a first instruction to move protected data between an enclave page cache (EPC) and a storage area outside of the EPC during execution of a program accessing the protected data, wherein the program is to run in a protected mode; and
at least a second instruction to enable debugging of the program accessing the protected data, wherein the debugging includes usurping the protected mode of the program and wherein the protected mode of the program is usurped only if the EPC includes a debug flag that is associated with the program.
2. The processor of claim 1 , wherein a security map (SMAP) is to help ensure an integrity of the program when the program is stored in a hard disk drive or protected memory.
3. A processor comprising:
execution logic to perform:
at least a first instruction to dynamically access at least one information field to determine an integrity of protected data stored in an enclave page cache (EPC) that is being accessed by a program in a protected mode, wherein the at least one information field includes a secure map (SMAP) field and a security information (SEC_INFO) field; and
at least a second instruction to enable debugging of the program accessing the protected data, wherein the debugging includes usurping the protected mode of the program and wherein the protected mode of the program is usurped only if the EPC includes a debug flag that is associated with the program.
4. A processor comprising:
execution logic to perform:
at least a first instruction to move protected data between an enclave page cache (EPC) and a storage area outside of the EPC during execution of a software program accessing the protected data, wherein the software program is to run in a protected mode, wherein a crypto memory aperture (CMA) protects the software program against attacks when the software program is executing; and a secure map (SMAP) protects the software program when the software program is not executing; and
at least a second instruction to enable debugging of the software program accessing the protected data, wherein the debugging includes usurping the protected mode of the software program and wherein the protected mode of the software program is usurped only if the EPC includes a debug flag that is associated with the software program.