Instructions and logic to provide advanced paging capabilities for secure enclave page caches
Instructions and logic provide advanced paging capabilities for secure enclave page caches. Embodiments include multiple hardware threads or processing cores, a cache to store secure data for a shared page address allocated to a secure enclave accessible by the hardware threads. A decode stage decodes a first instruction specifying said shared page address as an operand, and execution units mark an entry corresponding to an enclave page cache mapping for the shared page address to block creation of a new translation for either of said first or second hardware threads to access the shared page. A second instruction is decoded for execution, the second instruction specifying said secure enclave as an operand, and execution units record hardware threads currently accessing secure data in the enclave page cache corresponding to the secure enclave, and decrement the recorded number of hardware threads when any of the hardware threads exits the secure enclave.
1. A processor comprising: a first hardware thread and a second hardware thread;
an enclave page cache to store secure data in a cache line for a shared page address allocated to a corresponding secure enclave accessible by said first and second hardware threads;
a decode stage to decode a first instruction for execution by said processor, the first instruction specifying said shared page address as an operand; and one or more execution units, responsive to the decoded first instruction, to:
mark an entry corresponding to an enclave page cache mapping for the shared page address to block creation of a new translation for either of said first or second hardware threads to access secure data corresponding to the shared page address; said decode stage to decode a second instruction for execution by said processor, the second instruction specifying said secure enclave as an operand; and
one or more execution units, responsive to the decoded second instruction, to:
record hardware threads currently accessing secure data in the enclave page cache corresponding to the secure enclave;
wherein the second instruction is an instruction that specifies said secure enclave to record a number of hardware threads currently executing in the secure enclave;
wherein said one or more execution units, responsive to the decoded second instruction, to: decrement the recorded number of hardware threads currently executing in the secure enclave when any of the hardware threads exits the secure enclave.
2. The processor of claim 1 , wherein the first instruction is an instruction that specifies said shared page address to prevent the creation of a new translation corresponding to the shared page address in any translation lookaside buffer (TLB).
3. The processor of claim 1 ,
wherein said one or more execution units, responsive to the decoded first instruction, to:
decrement the recorded number of hardware threads currently executing in the secure enclave when any of the hardware threads exits the secure enclave.
4. A processor comprising:
a first hardware thread and a second hardware thread;
an enclave page cache to store secure data in a cache line for a shared page address allocated to a corresponding secure enclave accessible by said first and second hardware threads;
a decode stage to decode a first instruction for execution by said processor, the first instruction specifying said secure enclave as an operand; one or more execution units, responsive to the decoded first instruction, to:
record hardware threads currently accessing secure data in the enclave page cache corresponding to the secure enclave;
said decode stage to decode a second instruction for execution by said processor, the second instruction specifying said shared page address as an operand; and
one or more execution units, responsive to the decoded second instruction, to:
mark an entry corresponding to an enclave page cache mapping for the shared page address to block creation of a new translation for either of said first or second hardware threads to access secure data corresponding to the shared page address;
wherein the second instruction is an instruction that specifies said shared page address to prevent the creation of a new translation corresponding to the shared page address in any TLB; and
wherein said one or more execution units, responsive to the decoded second instruction, to:
decrement the recorded number of hardware threads currently executing in the secure enclave when any of the hardware threads exits the secure enclave.
5. The processor of claim 4 , wherein the first instruction is an instruction that specifies said secure enclave to record a number of hardware threads currently executing in the secure enclave.
6. The processor of claim 5 , wherein:
said one or more execution units, responsive to the decoded first instruction, to:
decrement the recorded number of hardware threads currently executing in the secure enclave when any of the hardware threads exits the secure enclave.
7. The processor of claim 4 comprising:
said decode stage to decode a second instruction for execution by said processor, the second instruction specifying said shared page address as an operand; and
one or more execution units, responsive to the decoded second instruction, to:
evict and write back secure data in the enclave page cache corresponding to the shared page address if the recorded number of hardware threads currently executing in the secure enclave reaches zero.
8. The processor of claim 7 , wherein the second instruction is an enclave write back (EWB) instruction that specifies said shared page address to evict and write back the shared page from the enclave page cache.
9. The processor of claim 8 , wherein the second instruction fails if the recorded number of hardware threads currently executing in the secure enclave has not reached zero.
10. The processor of claim 8 , wherein the second instruction waits to execute until the recorded number of hardware threads currently executing in the secure enclave reaches zero.
11. A method comprising:
executing, in a multithreaded processor, a first hardware thread and a second hardware thread;
storing secure data in a cache line for a shared page address allocated to a corresponding secure enclave accessible by said first and second hardware threads;
decoding a first instruction for execution by said processor, the first instruction specifying said shared page address as an operand;
responsive to decoding the first instruction, marking an entry corresponding to an enclave page cache mapping for the shared page address to block creation of a new translation for either of said first or second hardware threads to access secure data corresponding to the shared page address;
decoding a second instruction for execution by said processor, the second instruction specifying said secure enclave as an operand; and
responsive to decoding the second instruction, recording hardware threads currently accessing secure data in the enclave page cache corresponding to the secure enclave;
wherein responsive to decoding the second instruction, the recorded number of hardware threads currently executing in the secure enclave decrements when any of the hardware threads exits the secure enclave.
12. The method of claim 11 , wherein the first instruction is an instruction that specifies said shared page address to prevent the creation of a new translation corresponding to the shared page address in any TLB.
13. The method of claim 11 comprising:
responsive to decoding the first instruction, also recording hardware threads currently accessing secure data in the enclave page cache corresponding to the secure enclave.
14. The method of claim 13 , wherein responsive to decoding the first instruction, the recorded number of hardware threads currently executing in the secure enclave decrements when any of the hardware threads exits the secure enclave.
15. The method of claim 14 , wherein a translation corresponding to the shared page address is flushed in a TLB corresponding to any of the hardware threads when the corresponding hardware thread exits the secure enclave.
16. The method of claim 11 , comprising:
decoding a third instruction for execution by said processor, the third instruction specifying said shared page address as an operand; and
responsive to decoding the third instruction, evicting and writing back secure data in the enclave page cache corresponding to the shared page address if the recorded number of hardware threads currently executing in the secure enclave reaches zero.
17. The method of claim 16 wherein responsive to decoding the third instruction for execution by said processor, the secure data in the enclave page cache corresponding to the shared page address is encrypted prior to writing the secure data back to memory or non-volatile storage.
18. The method of claim 16 , wherein the third instruction fails if the recorded number of hardware threads currently executing in the secure enclave has not reached zero.
19. The method of claim 16 , wherein the third instruction waits to execute until the recorded number of hardware threads currently executing in the secure enclave reaches zero.
20. A method comprising:
executing, in a multithreaded processor, a first hardware thread and a second hardware thread;
storing secure data in a cache line for a shared page address allocated to a corresponding secure enclave accessible by said first and second hardware threads;
decoding a first instruction for execution by said processor, the first instruction specifying said secure enclave as an operand; and
responsive to decoding the first instruction, recording hardware threads currently accessing secure data in the enclave page cache corresponding to the secure enclave;
wherein the first instruction is an instruction that specifies said secure enclave to record a number of hardware threads currently executing in the secure enclave;
wherein responsive to decoding the first instruction, the recorded number of hardware threads currently executing in the secure enclave decrements when any of the hardware threads exits the secure enclave.
21. The method of claim 20 , wherein responsive to decoding the first instruction, the creation of a new translation corresponding to the shared page address in any TLB is prevented.
22. The method of claim 20 comprising:
decoding a second instruction for execution by said processor, the second instruction specifying said shared page address as an operand; and
responsive to decoding the second instruction, evicting and writing back secure data in the enclave page cache corresponding to the shared page address if the recorded number of hardware threads currently executing in the secure enclave reaches zero.
23. The method of claim 22 wherein responsive to decoding the second instruction for execution by said processor, the secure data in the enclave page cache corresponding to the shared page address is encrypted prior to writing the secure data back to memory or non-volatile storage.
24. The method of claim 22 , wherein the second instruction fails if the recorded number of hardware threads currently executing in the secure enclave has not reached zero.
25. A processing system comprising:
a memory; and
a processor comprising:
a first hardware thread and a second hardware thread,
an enclave page cache to store secure data in a cache line for a shared page address allocated to a corresponding secure enclave accessible by said first and second hardware threads,
a decode stage to decode a first instruction for execution by said processor, the first instruction specifying said shared page address as an operand, and
one or more execution units, responsive to the decoded first instruction, to mark an entry corresponding to an enclave page cache mapping for the shared page address to block creation of a new translation for either of said first or second hardware threads to access secure data corresponding to the shared page address;
said decode stage to decode a second instruction for execution by said processor, the second instruction specifying said secure enclave as an operand, and
said one or more execution units, responsive to the decoded second instruction, to
record hardware threads currently accessing secure data in the enclave page cache corresponding to the secure enclave,
decrement the recorded number of hardware threads currently executing in the secure enclave when any of the hardware threads exits the secure enclave.
26. The processing system of claim 25 , wherein a translation corresponding to the shared page address is flushed in a TLB corresponding to any of the hardware threads when the corresponding hardware thread exits the secure enclave.
27. The processing system of claim 26 , said processor comprising:
said decode stage to decode a third instruction for execution by said processor, the third instruction specifying said shared page address as an operand; and
said one or more execution units, responsive to the decoded third instruction to evict and write back said secure data in the enclave page cache corresponding to the shared page address if the recorded number of hardware threads currently executing in the secure enclave reaches zero.
28. The processing system of claim 27 , wherein the third instruction fails if the recorded number of hardware threads currently executing in the secure enclave has not reached zero.