Secure Enclaves for Selective Processor Reset in Cloud Servers
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current cloud-hosted server environments face challenges in maintaining system resilience and uptime due to the need to reset all software and virtual machines when a processor fault occurs, leading to significant downtime and costs, despite advancements in hardware resiliency features like Machine Check handling and memory poisoning.
Innovation Solution
The integration of Intel Software Guard Extensions (SGX) with enhanced RAS capabilities allows secure enclaves to handle errors independently, enabling selective reset of affected components without taking down the entire server, by classifying error sources and configuring error handling at the enclave level, and using manageability components to direct interrupts to impacted enclaves.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional processor fault handling is used, then system reliability is maintained through reset, but cloud availability deteriorates due to complete system downtime
Solution Approach 1:
The system segments the processor into multiple isolated execution contexts (enclaves) with separate address spaces and protection domains. When a fault occurs in one enclave, only that specific enclave is affected and can be reset independently, while other enclaves continue executing without interruption. This segmentation prevents cascading failures across the entire system.
Solution Approach 2:
The patent introduces an intermediary layer (the enclave isolation mechanism) between the fault source and the rest of the system. This intermediary prevents direct propagation of faults by containing them within the enclave boundary, allowing the system to maintain availability while handling errors through controlled reset of only the affected enclave rather than the entire processor.
2Ease of operation
If complete processor reset is performed on fault, then error handling is simplified, but service continuity deteriorates due to loss of all VMs
Solution Approach 1:
The system divides the processor execution environment into separate enclaves, each with its own error handling context. This allows error handling to be applied selectively to individual enclaves rather than requiring system-wide reset, maintaining both operational simplicity and service continuity.
Solution Approach 2:
Instead of applying full processor reset (excessive action) to handle errors, the system applies partial reset only to the affected enclave. This partial action is sufficient to clear the error while preserving the rest of the system, thereby maintaining productivity and service continuity.
3Reliability
If hardware RAS features are enhanced, then system resilience improves, but device complexity increases
Solution Approach 1:
The patent implements segmentation of the execution environment into enclaves, which provides strong isolation and resilience without requiring complex hardware RAS features. The segmentation itself creates natural failure boundaries that enhance system resilience while maintaining relatively simple hardware architecture.
Solution Approach 2:
The system changes the parameter of error containment from system-wide to enclave-local through the use of protection rings and address space isolation. This parameter change enables enhanced resilience through software-defined boundaries rather than complex hardware mechanisms.
Data Source
AI summary
Methods and apparatus to increase cloud availability and silicon isolation using secure enclaves. A compute platform is configured to host a compute domain in which a plurality of secure enclaves are implemented. In conjunction with creating and deploying secure enclaves, mapping information is generated that maps the secure enclaves to platform/CPU resources, such as Intellectual Property blocks (IP) belong to the secure enclaves. In response to platform error events caused by errant platform/CPU resources, the secure enclave(s) belonging to the errant platform/CPU are identified via the mapping information, and an interrupt is directed to that/those secure enclave(s). In response to the interrupt, a secure enclave may be configured to one or more of handle the error, pass information to another secure enclave, and teardown the enclave. The secure enclave may execute an interrupt service routine that causes the errant platform/CPU resource to reset without resetting the entire platform or CPU, as applicable.