Mechanism to enable secure memory sharing between enclaves and I/O adapters

1. A computer-implemented process for secure memory sharing between enclaves and virtual input/output adapters, the computer-implemented process comprising:

providing a system for performing a computer-implemented process for secure memory sharing between enclaves and virtual input/output adapters, wherein the system comprises a host, an enclave and an interrupt virtualization engine, wherein the host comprises a processor and a memory in communication with the processor to perform the computer-implemented process;

in response to a request for the enclave to create a virtual input/output adapter, creating a virtual input/output adapter associated with the enclave, wherein the enclave includes an enclave memory;

in response to receipt of an interrupt from within the system by the interrupt virtualization engine, routing the interrupt directly to the enclave, wherein the routing bypasses the processor;

creating by the enclave a non-sharable micro-enclave, to contain only data, nested within the enclave to use with the virtual input/output adapter, wherein the micro-enclave includes a non-zero portion of the enclave memory that is less that an entirety of the enclave memory, wherein the data of the non-sharable micro-enclave comprises at least one non-executable data segment, and wherein the at least one non-executable data segment comprises a portion of an object file, and creating a second non-sharable micro-enclave, to contain only data, nested within the enclave to use with a second virtual input/output adapter, wherein the second micro-enclave includes a non-zero portion of the enclave memory that is less than an entirety of the enclave memory;

generating a key by a memory encryption engine for the virtual input/output adapter for use by only the virtual input/output adapter; in response to a request to obtain data from the enclave by the virtual input/output adapter, exchanging the key with the non-sharable micro-enclave; in response to receiving the key, decrypting memory of only the non-sharable micro-enclave associated with the virtual input/output adapter to obtain the data; and sending the data from the non-sharable micro-enclave nested within the enclave to the virtual input/output adapter.

2. The computer-implemented process of claim 1 , wherein the computer-implemented process is performed concurrently for a plurality of non-sharable micro-enclaves and a corresponding plurality of virtual input/output adapters.

3. The computer-implemented process of claim 1 , wherein sending the data comprises using direct memory access.

4. The computer-implemented process of claim 1 , wherein sending the data comprises using remote direct memory access.

5. The computer-implemented process of claim 1 , wherein sending the data comprises using single-root input/output virtualization.

6. The computer-implemented process of claim 1 , further comprising attaching the virtual input/output adapter to the enclave at a time when creating the virtual input/output adapter.

7. The computer-implemented process of claim 1 , further comprising attaching the virtual input/output adapter to the enclave dynamically using a hotplug operation, wherein the hotplug operation comprises performing the attaching while the system continues operating and avoids a restart of the system.

8. The computer-implemented process of claim 1 , wherein the interrupt includes a routing priority.

9. The method of claim 1 , wherein the micro-enclave and virtual input/output adapter define a first micro-enclave and virtual input/output adapter pair, and wherein the second micro-enclave and the second virtual input/output adapter define a second micro-enclave and virtual input/output adapter pair, wherein the generating includes generating a first unique cryptographic key for the first micro-enclave and virtual input/output adapter pair, and wherein the method includes generating a second unique cryptographic key for the second micro-enclave and virtual input/output adapter pair.

10. The method of claim 1 , wherein the micro-enclave and virtual input/output adapter define a first micro-enclave and virtual input/output adapter pair, and wherein the second micro-enclave and the second virtual input/output adapter define a second micro-enclave and virtual input/output adapter pair, wherein the generating includes generating by an ultravisor a first unique cryptographic key for the first micro-enclave and virtual input/output adapter pair, and wherein the method includes generating by the ultravisor a second unique cryptographic key for the second micro-enclave and virtual input/output adapter pair.

11. A computer program product for facilitating secure memory sharing between enclaves and virtual input/output adapters, the computer program product comprising:

a non-transitory storage medium readable by a processor of a host within a system, the system further comprising an enclave and an interrupt virtualization engine, the non-transitory storage medium storing instructions for performing a method of secure memory sharing between enclaves and virtual input/output adapters, the method comprising:

in response to a request for the enclave to create a virtual input/output adapter, creating a virtual input/output adapter associated with the enclave;

in response to receipt of an interrupt from within the system by the interrupt virtualization engine, routing the interrupt directly to the enclave, wherein the routing bypasses the processor;

creating a non-sharable micro-enclave, to contain only data, nested within the enclave to use with the virtual input/output adapter, wherein the data of the non-sharable micro-enclave comprises at least one non-executable data segment, and wherein the at least one non-executable data segment comprises a portion of an object file; and creating a second non-shareable micro-enclave, to contain only data, nested within the enclave to use with a second virtual input/output adapter, wherein the second micro-enclave includes a non-zero portion of the enclave memory that is less than an entirety of the enclave memory;

generating a key by a memory encryption engine for the virtual input/output adapter for use by only the virtual input/output adapter;

in response to a request to obtain data from the enclave by the virtual input/output adapter, exchanging the key with the non-sharable micro-enclave;

in response to receiving the key, decrypting memory of only the non-sharable micro-enclave associated with the virtual input/output adapter to obtain the data; and

sending the data from the non-sharable micro-enclave nested within the enclave to the virtual input/output adapter.

12. A system for secure memory sharing between enclaves and input/output adapters, the system comprising:

a host, an enclave and an interrupt virtualization engine, wherein the host comprises:

at least one processor; and

a memory in communication with the at least one processor to perform a method of secure memory sharing between enclaves and virtual input/output adapters, the method comprising:

in response to a request for the enclave to create a virtual input/output adapter, creating a virtual input/output adapter associated with the enclave;

in response to receipt of an interrupt from within the system by the interrupt virtualization engine, routing the interrupt directly to the enclave, wherein the routing bypasses the processor;

creating a non-sharable micro-enclave, to contain only data, nested within the enclave to use with the virtual input/output adapter; and creating a second non-shareable micro-enclave, to contain only data, nested within the enclave to use with a second virtual input/output adapter, wherein the second micro-enclave includes a non-zero portion of the enclave memory that is less than an entirety of the enclave memory;

generating a key by a memory encryption engine for the virtual input/output adapter for use by only the virtual input/output adapter;

in response to a request to obtain data from the enclave by the virtual input/output adapter, exchanging the key with the non-sharable micro-enclave;

in response to receiving the key, decrypting memory of only the non-sharable micro-enclave associated with the virtual input/output adapter to obtain the data; and

sending the data from the non-sharable micro-enclave nested within the enclave to the virtual input/output adapter.

13. The system of claim 12 , wherein the method is performed concurrently for a plurality of non-sharable micro-enclaves and a corresponding plurality of virtual input/output adapters.

14. The system of claim 12 , wherein sending the data comprises using at least one of direct memory access, remote direct memory access and single-root input/output virtualization.

15. The system of claim 12 , further comprising attaching the virtual input/output adapter to the enclave at a time when creating the virtual input/output adapter.

16. The system of claim 12 , further comprising attaching the virtual input/output adapter to the enclave dynamically using a hotplug operation, wherein the hotplug operation comprises performing the attaching while the system continues operating and avoids a restart of the system.

17. The system of claim 12 , wherein the enclave includes an enclave memory, and wherein the micro-enclave includes a non-zero portion of the enclave memory that is less that an entirety of the enclave memory, wherein the method includes creating a second non-sharable micro-enclave, to contain only data, nested within the enclave to use with a second virtual input/output adapter, wherein the second micro-enclave includes a non-zero portion of the enclave memory that is less that an entirety of the enclave memory, wherein the second micro-enclave includes a non-zero portion of the enclave memory that is less that an entirety of the enclave memory.

18. The system of claim 12 , wherein the enclave includes an enclave memory, and wherein the micro-enclave and virtual input/output adapter define a first micro-enclave and virtual input/output adapter pair, and wherein the second micro-enclave and the second virtual input/output adapter define a second micro-enclave and virtual input/output adapter pair, wherein the generating includes generating a first unique cryptographic key for the first micro-enclave and virtual input/output adapter pair, and wherein the method includes generating a second unique cryptographic key for the second micro-enclave and virtual input/output adapter pair.

19. The system of claim 12 , wherein the enclave runs on an ultravisor and includes an enclave memory.