Techniques to enforce policies for computing platform resources
Various embodiments are generally directed to techniques to enforce policies for computing platform resources, such as to prevent denial of service (DoS) attacks on the computing platform resources. Some embodiments are particularly directed to ISA instructions that allow trusted software/applications to securely enforce policies on a platform resource/device while allowing untrusted software to control allocation of the platform resource. In many embodiments, the ISA instructions may enable secure communication between a trusted application and a platform resource. In several embodiments, a first ISA instruction implemented by microcode may enable a trusted application to wrap policy information for secure transmission through an untrusted stack. In several such embodiments, a second ISA instruction implemented by microcode may enable untrusted software to verify the validity of the wrapped blobs and program registers associated with the platform resource with policy information provided via the wrapped blobs.
1. An apparatus, the apparatus comprising:
a processor; and
a memory comprising instructions that when executed by the processor cause the processor to:
generate a wrapped lock policy and a wrapped unlock policy with a first instruction set architecture (ISA) instruction implemented by microcode based on policy data provided by trusted software, wherein the wrapped lock policy includes a policy setting for a platform resource based on the policy data;
communicate the wrapped lock policy and the wrapped unlock policy to untrusted system software;
verify the wrapped lock policy and the wrapped unlock policy with a second ISA instruction implemented by microcode;
determine generation of the wrapped lock policy and the wrapped unlock policy are associated with a common owner identifier; and
store the policy setting in a policy register to program the platform resource for use by the trusted software with the second ISA instruction based on verification of the wrapped lock policy and the wrapped unlock policy and determination the wrapped lock policy and the wrapped unlock policy are associated with the common owner identifier.
2. The apparatus of claim 1 , the memory comprising instructions that when executed by the processor cause the processor to set a lock bit associated with the platform resource based on generation of the wrapped lock policy.
3. The apparatus of claim 1 , the memory comprising instructions that when executed by the processor cause the processor to verify the wrapped lock policy and the wrapped unlock policy with the second ISA instruction implemented by microcode based on first contents stored in a general purpose register by the untrusted system software.
4. The apparatus of claim 3 , the memory comprising instructions that when executed by the processor cause the processor to program the platform resource for use by the trusted software according to the policy data with the second ISA instruction based on second contents stored in the general purpose register by the untrusted system software.
5. The apparatus of claim 1 , the first ISA instruction include a structure that comprises a target field, a command field, a policy field, and an owner identifier field.
6. The apparatus of claim 5 , the memory comprising instructions that when executed by the processor cause the processor to generate the wrapped lock policy with the first ISA instruction when the command field includes a lock policy command.
7. The apparatus of claim 5 , the memory comprising instructions that when executed by the processor cause the processor to generate the wrapped unlock policy with the first ISA instruction when the command field includes an unlock policy command.
8. The apparatus of claim 5 , the memory comprising instructions that when executed by the processor cause the processor to determine generation of the wrapped lock policy and the wrapped unlock policy are associated with the common owner identifier based on comparison of the owner identifier field of the wrapped lock policy and the owner identifier field of the wrapped unlock policy.
9. The apparatus of claim 5 , the memory comprising instructions that when executed by the processor cause the processor to check a state of the policy register with the first ISA instruction when the command field includes a get policy command.
10. At least one non-transitory computer-readable medium comprising a set of instructions that, in response to being executed by a processor circuit, cause the processor circuit to:
generate a wrapped lock policy and a wrapped unlock policy with a first instruction set architecture (ISA) instruction implemented by microcode based on policy data provided by trusted software, wherein the wrapped lock policy includes a policy setting for a platform resource based on the policy data;
communicate the wrapped lock policy and the wrapped unlock policy to untrusted system software;
verify the wrapped lock policy and the wrapped unlock policy with a second ISA instruction implemented by microcode;
determine generation of the wrapped lock policy and the wrapped unlock policy are associated with a common owner identifier; and
store the policy setting in a policy register to program the platform resource for use by the trusted software with the second ISA instruction based on verification of the wrapped lock policy and the wrapped unlock policy and determination the wrapped lock policy and the wrapped unlock policy are associated with the common owner identifier.
11. The at least one non-transitory computer-readable medium of claim 10 , the first ISA instruction comprising a WRAP_POLICY instruction and the second ISA instruction comprising an UNWRAP_POLICY instruction.
12. The at least one non-transitory computer-readable medium of claim 10 , wherein the first ISA instruction is called by the trusted software and the second ISA instruction is called by the untrusted system software.
13. The at least one non-transitory computer-readable medium of claim 10 , wherein the wrapped lock policy and the wrapped unlock policy each include a counter value to prevent replay by the untrusted system software.
14. The at least one non-transitory computer-readable medium of claim 10 , wherein the wrapped lock policy and the wrapped unlock policy each include a message authentication code (MAC) to prevent modification by the untrusted system software.
15. The at least one non-transitory computer-readable medium of claim 10 , wherein the untrusted system software comprises an operating system or a virtual machine monitor.
16. A computer-implemented method, comprising:
generating a wrapped lock policy and a wrapped unlock policy with a first instruction set architecture (ISA) instruction implemented by microcode based on policy data provided by trusted software, wherein the wrapped lock policy includes a policy setting for a platform resource based on the policy data;
communicating the wrapped lock policy and the wrapped unlock policy to untrusted system software;
verifying the wrapped lock policy and the wrapped unlock policy with a second ISA instruction implemented by microcode;
determining generation of the wrapped lock policy and the wrapped unlock policy are associated with a common owner identifier; and
storing the policy setting in a policy register to program the platform resource for use by the trusted software with the second ISA instruction based on verification of the wrapped lock policy and the wrapped unlock policy and determination the wrapped lock policy and the wrapped unlock policy are associated with the common owner identifier.
17. The computer-implemented method of claim 16 , comprising communicating the wrapped lock policy and the wrapped unlock policy to system software via a stack.
18. The computer-implemented method of claim 16 , comprising:
confirming receipt of the wrapped lock policy and the wrapped unlock policy by the untrusted system software; and
storing the policy setting in the policy register to program the platform resource for use by the trusted software with the second ISA instruction based on confirmation of receipt of the wrapped lock policy and the wrapped lock policy, verification of the wrapped lock policy and the wrapped unlock policy, and determination the wrapped lock policy and the wrapped unlock policy are associated with the common owner identifier.
19. The computer-implemented method of claim 16 , the common owner identifier comprising an identifier of the trusted software that is inaccessible to the untrusted system software.
20. The computer-implemented method of claim 16 , the first ISA instruction to utilize a key inaccessible by the untrusted system software to generate the wrapped lock policy and the wrapped unlock policy.
21. The computer-implemented method of claim 20 , the first ISA instruction to access the wrapped lock policy and the wrapped unlock policy with the key inaccessible by the untrusted system software.
22. The computer-implemented method of claim 16 , the first ISA instruction comprising a WRAP_POLICY instruction and the second ISA instruction comprising an UNWRAP_POLICY instruction.
23. The computer-implemented method of claim 16 , wherein the first ISA instruction is called by the trusted software and the second ISA instruction is called by the untrusted system software.
24. The computer-implemented method of claim 16 , wherein the wrapped lock policy and the wrapped unlock policy each include a counter value to prevent replay by the untrusted system software.
25. The computer-implemented method of claim 16 , wherein the wrapped lock policy and the wrapped unlock policy each include a message authentication code (MAC) to prevent modification by the untrusted system software.