Sanctum's LLC partitioning method is based on page coloring, which is readily
available thanks to an existing interaction between page tables and
direct-mapped or set-associative caches. Normally, pages with the same color
are spread throughout DRAM, as shown in Figure~\ref{fig:dram_regions}, so a
DMA buffer that requires consecutive DRAM pages occupies multiple colors. The
hardware changes described in \S~\ref{sec:dram_regions} manipulate the input to
the cache set indexing computation so that the pages with the same color are
grouped into contiguous \textbf{DRAM regions}, and it is possible to have large
DMA buffers that only use a few page colors.

\begin{figure}[htb]
  \centering
  \includegraphics[width=50mm]{figures/dram_regions.pdf}
  \caption{Page coloring and Sanctum's DRAM regions.}
  \label{fig:dram_regions}
%\EndFigure
\end{figure}

In effect, the computer's DRAM is divided into equally sized DRAM regions that
use disjoint LLC sets. It follows that \textit{addresses in a DRAM region do
not collide in the LLC with addresses from any other DRAM region}. If
programs Alice and Eve use disjoint DRAM regions, they cannot interfere in the
LLC, so Eve cannot mount LLC timing attacks on Alice.

The OS allocates the LLC dynamically to its processes and to enclaves by
allocating DRAM regions. Each DRAM region can either be entirely owned by an
enclave, or entirely owned by the OS and used by non-enclave processes.
Furthermore, the OS can place applications in different DRAM regions by
manipulating page tables, without having to modify application code.

The Sanctum design replicates the per-core registers that impact address translation,
which are enumerated in Table~\ref{fig:pmh_fsm_registers}. The replicas are
used to configure the current enclave's page tables, which are independent from
the OS page tables. For example, the page table base register (\texttt{ptbr})
is replicated as the enclave page table base register (\texttt{eptbr}).

\begin{table}[htb]
  \centering
  \caption{Per-core registers that specify and restrict the OS page tables, that specify EVRANGE, and DMA master registers.}
  \label{fig:pmh_fsm_registers}
  \begin{tabularx}{\columnwidth}{| l | X |}
  \hline
  \textbf{Mnemonic} & \textbf{Register Name} \\
  \hline
  \texttt{ptbr} & Page Table Base Register \\
  \hline
  \texttt{parbase} & Protected Address Range Base \\
  \hline
  \texttt{parmask} & Protected Address Range Mask \\
  \hline
  \texttt{drb} & DRAM Region Bitmap \\
  \hline \hline \hline
  \texttt{evbase} & EVRANGE Base \\
  \hline
  \texttt{evmask} & EVRANGE Mask \\
  \hline \hline \hline
  \hline
  \texttt{dmarbase} & Allowable DMA Range Base \\
  \hline
  \texttt{dmarmask} & Allowable DMA Range Mask \\
  \hline
  \end{tabularx}
\end{table}

Sanctum modifies the input to the \textit{page walker} that translates addresses on
TLB misses, so it can either use the OS page tables or the current enclave's
page tables, depending on whether the translated virtual address is inside
EVRANGE or not. For example, if the virtual address is inside EVRANGE, the
value inside \texttt{eptbr} is forwarded to the page walker. Otherwise,
\texttt{ptbr} is forwarded. To minimize hardware complexity, EVRANGE is
specified using a pair of base/mask registers, shown at the bottom of
Table~\ref{fig:pmh_fsm_registers}, which have the same semantics as the
variable Memory Type Range registers (MTRRs) in the x86 architecture. These
changes are described in detail in \S~\ref{sec:pmh_walker_input}.

%\begin{table}
%  \centering
%  \begin{tabularx}{\columnwidth}{| l | X |}
%  \hline
%  \textbf{Mnemonic} & \textbf{Register Name} \\
%  \hline
%  \texttt{evbase} & EVRANGE Base \\
%  \hline
%  \texttt{evmask} & EVRANGE Mask \\
%  \hline
%  \end{tabularx}
%  \caption{Per-core registers that specify EVRANGE}
%  \label{fig:evrange_registers}
%\end{table}

Sanctum makes sure that the OS and enclave page table entries obey Sanctum's security
rules by adding the logic described in \S~\ref{sec:pmh_walker} as a filter
between the page walker and the L1 cache. This logic causes page faults to
occur when the page walker encounters an OS page table entry that points
outside DRAM regions allocated to the page table's owner. The security
monitor specifies the allowable regions for each page table using a DRAM region
bitmap register.

Sanctum's filter logic also allows the security monitor to specify a Protected
Address Range~(PAR) that covers the monitor's sensitive data structures. The
logic causes a page fault when it encounters an non-leaf entry that
points into the PAR. The security monitor sets up a PAR for the OS page tables,
in order to prevent a malicious OS from reading the monitor's attestation key
and from tampering with the monitor's code.

\begin{figure}[htb]
  \centering
  \includegraphics[width=80mm]{figures/pmh_registers.pdf}
  \caption{Sanctum's registers on a CPU core that is currently running Enclave
           A's code.}
  \label{fig:pmh_registers}
%\EndFigure
\end{figure}

Lastly, Sanctum trusts the DMA bus master to reject DMA transfers pointing into DRAM
regions allocated to enclaves, to protect against attacks where a malicious OS
programs a peripheral to access enclave data. This requires changes similar to
the modifications done by SGX and later revisions of TXT to the integrated
memory controller on recent Intel chips. The changes are described in
\S~\ref{sec:dma_master}, and are configured using the registers enumerated in
Table~\ref{fig:pmh_fsm_registers}.

%\begin{table}
%  \centering
%  \begin{tabularx}{\columnwidth}{| l | X |}
%  \hline
%  \textbf{Mnemonic} & \textbf{Register Name} \\
%  \hline
%  \texttt{dmarbase} & Allowable DMA Range Base \\
%  \hline
%  \texttt{dmarmask} & Allowable DMA Range Mask \\
%  \hline
%  \end{tabularx}
%  \caption{DMA master registers}
%  \label{fig:dma_master_registers}
%\end{table}
