Method and apparatus to provide secure application execution
A technique to enable secure application and data integrity within a computer system. In one embodiment, one or more secure enclaves are established in which an application and data may be stored and executed.
1. A processor comprising:
execution circuitry to perform at least a first instruction to move protected data between an enclave page cache (EPC) and a second storage area during execution of a program accessing the protected data, wherein the program is to run in a protected mode, wherein the execution of first instruction is to add a page to a secure enclave and the first instruction is to include an address of a data structure used as a parameter to EPC-management instructions and an address of a destination in the EPC.
2. The processor of claim 1 , wherein a security map (SMAP) is to help ensure the integrity of the program when the program is stored in a hard disk drive or protected memory.
3. The processor of claim 1 , wherein the first instruction is to be executed in a non-kernel privilege level.
4. The processor of claim 3 , wherein the secure enclave is not initialized.
5. The processor of claim 3 , wherein secure enclave is initialized.
6. A computer-implemented method comprising:
performing at least a first instruction to move protected data between an enclave page cache (EPC) and a second storage area during execution of a program accessing the protected data, wherein the program is to run in a protected mode, wherein the execution of first instruction is to add a page to a secure enclave and the first instruction is to include an address of a data structure used as a parameter to EPC-management instructions and an address of a destination in the EPC.
7. The computer-implemented method of claim 6 , wherein a security map (SMAP) is used to help ensure the integrity of the program when the program is stored in a hard disk drive or protected memory.
8. The computer-implemented method of claim 6 , wherein the first instruction is to be executed in a non-kernel privilege level.
9. The computer-implemented method of claim 8 , wherein the secure enclave is not initialized.
10. The computer-implemented method of claim 8 , wherein secure enclave is initialized.