Intel Corporation

Cirrus Logic Inc.

Wesley Hamilton Smith

Carlos V Rozas

Vincent R Scarlata

Simon P Johnson

Francis X Mckeen

Uday R Savagaonkar

Vedvyas Shanbhogue

Michael A Goldsmith

Gilbert A Neiger

Ittai Anati

Ilya Alexandrovich

Rebekah M Leslie-Hurd

Alex Berenzon

Barry E Huntley

Siddhartha Chhabra

Raghunandan Makaram

Amy L Santoni

Krystof C Zmudzinski

Bo A Zhang

Karl I Nordling

James D Beaney, Jr

Amir Hindie

Karl Leinfelder

Jim Beaney

Eduardo Cabre

Piotr Zmijewski

Sebastian Gracias

Sigang Qiu

Rebekah Leslie

Xiao M Gao

Mandayam Krishnan

Scott Dion Rodgers

Rinat Rappoport

David Pearce

Vedavalli Gomatam Krishnan

Anton Ivanov

William Colin Wood

Veda Krishnan

Kanna Krishnan

Barrey E Huntley

Prashant Pratap Tawade

Francis McKeen

Shahin Hedayat

Navin Jaffer

Sanjay Gupta

Fred Schuckert

Don Carmon

Vedavalli G Krishna

Karl Thomas Leinfelder

Babu Mandava

A processor for supporting secure memory intent is disclosed. The processor of the disclosure includes a memory execution unit to access memory and a processor core coupled to the memory execution unit. The processor core is to receive a request to access a convertible page of the memory. In response to the request, the processor core to determine an intent for the convertible page in view of a page table entry (PTE) corresponding to the convertible page. The intent indicates whether the convertible page is to be accessed as at least one of a secure page or a non-secure page.

Supporting secure memory intent

Embodiments include systems, methods, computer readable media, and devices configured to, for a first processor of a platform, generate a platform root key; create a data structure to encapsulate the platform root key, the data structure comprising a platform provisioning key and an identification of a registration service; and transmit, on a secure connection, the data structure to the registration service to register the platform root key for the first processor of the platform. Embodiments include systems, methods, computer readable media, and devices configured to store a device certificate received from a key generation facility; receive a manifest from a platform, the manifest comprising an identification of a processor associated with the platform; and validate the processor using a stored device certificate.

Platform attestation and registration for servers

A computing platform implements one or more secure enclaves including a first provisioning enclave to interface with a first provisioning service to obtain a first attestation key from the first provisioning service, a second provisioning enclave to interface with a different, second provisioning service to obtain a second attestation key from the second provisioning service, and a provisioning certification enclave to sign first data from the first provisioning enclave and second data from the second provisioning enclave using a hardware-based provisioning attestation key. The signed first data is used by the first provisioning enclave to authenticate to the first provisioning service to obtain the first attestation key and the signed second data is used by the second provisioning enclave to authenticate to the second provisioning service to obtain the second attestation key.

Flexible provisioning of attestation keys in secure enclaves

Instructions and logic provide advanced paging capabilities for secure enclave page caches. Embodiments include multiple hardware threads or processing cores, a cache to store secure data for a shared page address allocated to a secure enclave accessible by the hardware threads. A decode stage decodes a first instruction specifying said shared page address as an operand, and execution units mark an entry corresponding to an enclave page cache mapping for the shared page address to block creation of a new translation for either of said first or second hardware threads to access the shared page. A second instruction is decoded for execution, the second instruction specifying said secure enclave as an operand, and execution units record hardware threads currently accessing secure data in the enclave page cache corresponding to the secure enclave, and decrement the recorded number of hardware threads when any of the hardware threads exits the secure enclave.

Instructions and logic to provide advanced paging capabilities for secure enclave page caches

Embodiments of an invention for memory management in secure enclaves are disclosed. In one embodiment, a processor includes an instruction unit and an execution unit. The instruction unit is to receive a first instruction and a second instruction. The execution unit is to execute the first instruction, wherein execution of the first instruction includes allocating a page in an enclave page cache to a secure enclave. The execution unit is also to execute the second instruction, wherein execution of the second instruction includes confirming the allocation of the page.

Memory management in secure enclaves

Secure memory repartitioning technologies are described. A processor includes a processor core and a memory controller coupled between the processor core and main memory. The main memory includes a memory range including a section of convertible pages that are convertible to secure pages or non-secure pages. The processor core, in response to a page conversion instruction, is to determine from the instruction a convertible page in the memory range to be converted and convert the convertible page to be at least one of a secure page or a non-secure page. The memory range may also include a hardware reserved section that is convertible in response to a section conversion instruction.

Secure memory repartitioning

Growing community of inventors

Raleigh, NC, United States of America

Wesley Hamilton Smith