A detail about SGX loading

user_1616210 0
Viewed 1499

Is it possible to load a program larger than the EPC memory to an enclave? I feel like in theory it is permissible because

  • OS can swap pages out freely
  • EEXTEND measures an enclave incrementally by 256 bytes

So in theory, it seems possible to load a big program using just one page of EPC memory:

  1. load 4K bytes to an EPC page
  2. measure the loaded page
  3. evict the loaded page
  4. load the next 4K bytes to the same EPC page as the one in (1)

Am I understanding correctly in theory? Although in practice, I got an error immediately when loading big programs.

trusted-computing intel
2 Answers

Researcher here, working with Intel SGX.

I would just like to add that Linux, however, does support mechanism 2) mentioned above, allowing pages to be encrypted and swapped out to regular DRAM. What this effectively means is yes to your original question. Linux is able to create enclaves of arbitrary size. However, in its current form(v1) once the enclave is finalized the size may not expand.

As to whether this is a good idea, the answer is definitely no. Expanding enclaves above the size of the EPC causes a lot of costly pagefaults to occur degrading performance significantly.

user_63897820
Related