Intel’s Software Guard Extensions (SGX) is a set of extensions to the Intel architecture that aims to provide integrity and confidentiality guarantees to securitysensitive computation performed on a computer where all the privileged software (kernel, hypervisor, etc) is potentially malicious. This paper analyzes Intel SGX, based on the 3 papers [14, 78, 137] that introduced it, on the Intel Software Developer’s Manual [100] (which supersedes the SGX manuals [94, 98]), on an ISCA 2015 tutorial [102], and on two patents [108, 136]. We use the papers, reference manuals, and tutorial as primary data sources, and only draw on the patents to fill in missing information. This paper’s contributions are a summary of the Intel-specific architectural and micro-architectural details needed to understand SGX, a detailed and structured presentation of the publicly available information on SGX, a series of intelligent guesses about some important but undocumented aspects of SGX, and an analysis of SGX’s security properties.

Intel SGX Explained.

A novel method for logically routing a packet between a source machine that is in a first logical domain and a destination machine that is in a second logical domain is described. The method configures a managed switching element as a second-level managed switching element. The method configures a router in a host that includes the second-level managed switching element. The method communicatively couples the second-level managed switching element with the router. The method causes the router to route a packet when the router receives a packet from the first logical domain that is addressed to the second logical domain.

Distributed logical l3 routing

The present invention provides a virtualization infrastructure that allows multiple guest/user partitions (24, 26, 28) to run within a host hardware partition (10). The host system (10) is divided into distinct logical or virtual partitions and special infrastructure partitions (12-22) implemented to control resource management and to control physical I/O device drivers (16, 18) that are, in turn, used by operating systems in other distinct logical or virtual guest/user partitions (24, 26, 28). Host hardware resource management runs as a tracking application in a resource management 'ultravisor' partition (14), while host resource management decisions are performed in a higher-level command partition (20) based on policies maintained in a separate operations partition (22). The ultravisor partition (14) maintains a master database (33) of the hardware resource allocations, and virtual partition monitors (34, 36) are provided in each partition to constrain the guest/user operating system to the assigned resources.

Virtual data center that allocates and manages system resources across multiple nodes

A high-performance, superscalar-based computer system with out-of-order instruction execution for enhanced resource utilization and performance throughput. The computer system fetches a plurality of fixed length instructions with a specified, sequential program order (in-order). The computer system includes an instruction execution unit including a register file, a plurality of functional units, and an instruction control unit for examining the instructions and scheduling the instructions for out-of-order execution by the functional units. The register file includes a set of temporary data registers that are utilized by the instruction execution control unit to receive data results generated by the functional units. The data results of each executed instruction are stored in the temporary data registers until all prior instructions have been executed, thereby retiring the executed instruction in-order.

High performance, superscalar-based computer system with out-of-order instruction execution

A system for testing middleware of applications in the N-tiered model. The test system contains test code generators, test engines to execute multiple copies of the test code and a data analyzer to analyze and present the results to a human user. The system is able to automatically generate test code to exercise components of the middleware using information about these components that would otherwise be available to the application under test. Multiple copies of the test code are executed in a synchronized fashion. Execution times of multiple events are recorded and then presented in one of several formats. With the system, an application developer can identify components that represent performance bottlenecks or can gather information on deployment properties of individual components that can be used to enhance the performance of the application under test.

Method and system for software object testing

A method and apparatus for enhancing/extending a serial point-to-point interconnect architecture, such as Peripheral Component Interconnect Express (PCIe) is herein described. Temporal and locality caching hints and prefetching hints are provided to improve system wide caching and prefetching. Message codes for atomic operations to arbitrate ownership between system devices/resources are included to allow efficient access/ownership of shared data. Loose transaction ordering provided for while maintaining corresponding transaction priority to memory locations to ensure data integrity and efficient memory access. Active power sub-states and setting thereof is included to allow for more efficient power management. And, caching of device local memory in a host address space, as well as caching of system memory in a device local memory address space is provided for to improve bandwidth and latency for memory accesses.

Pci express enhancements and extensions

A processor including a virtualization system of the processor with a memory virtualization support system to map a reference to guest-physical memory made by guest software executable on a virtual machine which in turn is executable on a host machine in which the processor is operable to a reference to host-physical memory of the host machine.

Virtualizing physical memory in a virtual machine system

In an embodiment, a method is provided. The method includes managing user-level threads on a first instruction sequencer in response to executing user-level instructions on a second instruction sequencer that is under control of an application level program. A first user-level thread is run on the second instruction sequencer and contains one or more user level instructions. A first user level instruction has at least 1) a field that makes reference to one or more instruction sequencers or 2) implicitly references with a pointer to code that specifically addresses one or more instruction sequencers when the code is executed.

Mechanism for instruction set based thread execution on a plurality of instruction sequencers

A method and apparatus for monitoring the performance characteristics of a multithreaded processor (10) executing instructions from two or more threads simultaneously. Event detectors detect the occurrence of specific processor events (20) during the execution of instructions from threads of a multithreaded processor. Specialized event select controls registers (30) are programmed to control the selection, masking and qualifying of events to be monitored. Events arequalified according to their thread ID and thread current privilege level (CPL). Each event that is qualified is counted by one of several programmable event counters (70) that keep track of all processor events being monitored. The contents of the event counters can then be accessed and sampled via a program instruction.

Qualification of event detection by thread id and thread privilege level

A method and apparatus for handling events, such as those which occur in a processor. An event vector is formed by combining event type information indicating a type of event in the processor and mode information indicating an operating mode of the processor. A microcode event handler vector is generated therefrom, for example, by referencing a lookup table. The microcode event handler vector is then used for invoking a microcode event handler to handle occurrence of these events in the processor. By the formation of an event vector, and the microcode event handler vector, execution performance is increased due to avoiding conditional branching within the processor, such as modem high performance architectures, including those which execute instructions in and out-of-order.

Scott D. Rodgers

Papers

Pci express enhancements and extensions

Virtualizing physical memory in a virtual machine system

Mechanism for instruction set based thread execution on a plurality of instruction sequencers

Qualification of event detection by thread id and thread privilege level

Method and apparatus for generating event handler vectors based on both operating mode and event type