Contents
What is enclave memory size?
Enclave Memory Measurement Tool (EMMT) During system boot-up, a total of 128 MB is typically reserved for Intel SGX, and 96 MB of that is allocated to the Enclave Page Cache (EPC). The EPC is shared among all running enclaves on the system.
What is the purpose of an enclave in the Intel SGX architecture?
Intel® SGX allows user-level code to allocate private regions of memory, called enclaves, which are designed to be protected from processes running at higher privilege levels. Only Intel® SGX offers such a granular level of control and protection.
What is enclave page cache?
Enclave Page Cache (EPC) This is achieved by having the EPC split into 4 KB pages that can be assigned to different enclaves. The system software, which can be a hypervisor or an OS kernel, uses SGX instructions to allocate unused pages to enclaves, and to free previously allocated EPC pages.
What is an enclave Intel SGX?
Intel Software Guard Extensions (SGX) is a set of security-related instruction codes that are built into some modern Intel central processing units (CPUs). The enclave is decrypted on the fly only within the CPU itself, and even then, only for code and data running from within the enclave itself.
What is SGX enclave size?
The size of the SGX enclave is fixed but is different depending on the processor model. Sizes range from 8 GB to 512 GB per processor. For a 2-socket ThinkSystem server, if enough DDR memory is installed, the system BIOS can reserve between 16GB and 1TB based on processor model installed.
Should I disable Intel SGX?
Generally, you shouldn’t disable Intel SGX under any circumstances. If you plan to use Intel SGX to help secure your applications and sensitive data, disablement should be completely avoided, as disablement offers no application or data protection whatsoever.
Does AMD support SGX?
Intel SGX does not exist on AMD platforms. AMD has their own version of it but PowerDVD does not support it. It is easier and cheaper to rip and play, or to get a standalone player.
What is open enclave SDK?
The Open Enclave SDK (OE SDK) is an open-source SDK that allows abstraction over different confidential computing-enabled hardware. The OE SDK is built to be a single abstraction layer over any hardware on any CSP.
Does Intel SGX affect performance?
Intel® SGX enclaves provide hardware enforced confidentially and integrity guarantees for running computations. In addition, extra security measures such as integrity tests and memory usage limitations can also effect performance.
How do I disable SGX?
From the System Utilities screen, select System Configuration > BIOS/Platform Configuration (RBSU) > System Options > Processor Options > Intel Software Guard Extensions (SGX) and press Enter. Software Controlled – Enabling or disabling of SGX is determined by the Intel drivers, which can be configured in the OS.
What is Enclave software?
What Are Secure Enclaves? A secure enclave is a set of software and hardware features that together provide an isolated execution environment to enable a set of strong security guarantees for applications running inside the enclave. Specifically, secure enclaves can provide confidentiality, integrity, and attestation.
Where are enclave data structures stored in SGX?
The contents of enclaves and the associated data structures are stored in the Enclave Page Cache (EPC), which is a subset of the PRM. The SGX design supports having multiple enclaves on a system at the same time, which is a necessity in multi-process environments.
How is Intel SGX used to enforce isolation?
Intel SGX enforces isolation by storing enclave code and data in a data structure called the Enclave Page Cache (EPC), which resides in a preconfigured portion of DRAM called the Processor Reserved Memory (PRM). The processor ensures that any software outside the enclave cannot access the PRM.
Why does SGX fail to allocate EPC page?
For example, if the system software attempts to allocate the same EPC page to two enclaves, the SGX instruction used to perform the allocation will fail. In order to perform its security checks, SGX records some information about the system software’s allocation decisions for each EPC page in the Enclave Page Cache Map (EPCM).
Can a code hosted in an enclave access PRM memory?
However, code hosted inside an enclave can access both non- PRM memory and PRM memory that belongs to the enclave. SGX includes a memory encryption engine which encrypts and authenticates enclave data evicted to memory, and ensures integrity and freshness using a merkle-tree structure over the EPC.