3 ms·
> all. Then again, with current restrictions on SGX, like having to partition out memory for it at boot time, Huh? why is this an issue at all. The most memor
by nullc 9y ago
> all. Then again, with current restrictions on SGX, like having to partition out memory for it at boot time,
Huh? why is this an issue at all. The most memory SGX can directly use is 128MB. So partition it off-- it's a small cost if it's likely that you'll use it.
Enclaves are not limited to 128MB in total, since the OS can page in and out SGX pages...
- duskwuff 9y ago> the OS can page in and out SGX pages... That doesn't seem right. How is the OS supposed to page SGX in/out without being able to read its memory?
- xyzzyz 9y agoThere is a special dance the OS has to perform in order to do it. In short, the OS calls EWB instruction, which makes CPU read the page from EPC, encrypt it, and write it to normal memory. To load it back, OS executes the ELDB instruction, which decrypts it and writes to EPC. There is slightly more to it due to version array, which is used to prevent replay attacks, but in general, paging in and out is completely fine in SGX.
- xyzzyz 9y ago>Huh? why is this an issue at all. I think you missed my point. I was talking specifically about providing SGX to VM guests on multi-tenant machines. The difficulty is not insurmountable, but other than some experimental Intel patches, KVM doesn’t support it yet.