On-demand paging support for confidential computing
On-demand paging support for confidential computing is described. An example of an apparatus includes circuitry including one or more processors including a first processor, the first processor including a TEE and registers, wherein the one or more processors are to: receive a memory access request associated with a trust domain (TD), wherein one or more direct memory access payloads associated with the request being generated by a protocol engine (PE) of a peripheral device and written to a host interface (HIF), the HIF including an address translation engine (ATE); and, in response to a page fault being identified for a payload, divert the payload and forward a payload fault to one or more TD fault buffers in a set of registers, and resolve the page fault by an ATE driver and a virtual machine manager using the TEE.
1. An apparatus comprising:
circuitry including one or more processors including a first processor, the first processor including a trusted execution environment (TEE) and a plurality of registers, wherein the one or more processors are to:
receive a memory access request associated with a trust domain (TD), one or more direct memory access (DMA) payloads associated with the request being generated by a protocol engine (PE) of a peripheral device and written to a host interface (HIF) of the peripheral device, the HIF including an address translation engine (ATE); and
in response to a page fault being identified for a DMA payload of the one or more DMA payloads:
divert the DMA payload and forward a payload fault to one or more TD fault buffers in a set of registers of the plurality of registers, and
resolve the page fault by an ATE driver and a virtual machine manager (VMM) using the TEE.
2. The apparatus of claim 1 , wherein the one or more processors are further to process the one or more DMA payloads for the TD.
3. The apparatus of claim 1 , wherein the one or more processors are further to securely copy the diverted DMA payload associated with the page fault to a TD application buffer.
4. The apparatus of claim 3 , wherein the PE and the HIF are within a trusted computing base (TCB) for the TD.
5. The apparatus of claim 4 , wherein the TD PE driver and the application buffer are trust domain software contained with the TCB of the TD.
6. The apparatus of claim 1 , wherein the set of registers are designated for trust domains (TDs).
7. The apparatus of claim 1 , wherein the peripheral device includes a network interface card (NIC).
8. One or more non-transitory computer-readable storage mediums having stored thereon executable computer program instructions that, when executed by one or more processors, cause the one or more processors to perform operations comprising:
receiving a memory access request associated with a trust domain (TD) in a system, the system including a trusted execution environment (TEE), wherein one or more direct memory access (DMA) payloads associated with the request are generated by a protocol engine (PE) of a peripheral device and the one or more DMA payloads are written to a host interface (HIF) of the peripheral device, the HIF including an address translation engine (ATE); and
in response to a page fault being identified for a DMA payload of the one or more DMA payloads:
diverting the DMA payload and forwarding a payload fault to one or more TD fault buffers in a set of registers, and
resolving the page fault by an ATE driver and a virtual machine manager (VMM) using the TEE.
9. The storage mediums of claim 8 , wherein the instructions further include instructions for:
processing the one or more DMA payloads for the TD.
10. The storage mediums of claim 8 , wherein the instructions further include instructions for:
securely copying the diverted DMA payload associated with the page fault to a TD application buffer.
11. The storage mediums of claim 10 , wherein the PE and the HIF are within a trusted computing base (TCB) for the TD.
12. The storage mediums of claim 11 , wherein a TD PE driver and the application buffer are trust domain software contained with the TCB of the TD.
13. The storage mediums of claim 8 , wherein the set of registers are designated for trust domains (TDs).
14. The storage mediums of claim 8 , wherein the peripheral device includes a network interface card (NIC).
15. A method comprising:
receiving a memory access request associated with a trust domain (TD) in a system, the system including a trusted execution environment (TEE), wherein one or more direct memory access (DMA) payloads associated with the request are generated by a protocol engine (PE) of a peripheral device and the one or more DMA payloads are written to a host interface (HIF) of the peripheral device, the HIF including an address translation engine (ATE); and
in response to a page fault being identified for a DMA payload of the one or more DMA payloads:
diverting the DMA payload and forwarding a payload fault to one or more TD fault buffers in a set of registers, and
resolving the page fault by an ATE driver and a virtual machine manager (WM) using the TEE.
16. The method of claim 15 , further comprising:
processing the one or more DMA payloads for the TD.
17. The method of claim 15 , further comprising:
securely copying the diverted DMA payload associated with the page fault to a TD application buffer.
18. The method of claim 17 , wherein the PE and the HIF are within a trusted computing base (TCB) for the TD.
19. The method of claim 18 , wherein a TD PE driver and the application buffer are trust domain software contained with the TCB of the TD.
20. The method of claim 15 , wherein the set of registers are designated for trust domains (TDs).