intel / intel/confidential-computing.sgx

Provide VM image for AESMD

Open
#791 2 comments 0 reactions 0 assignees View on GitHub
Dominant language
C++
Stars
1.5k
Forks
565
PR merge metrics
No merged PRs in 30d

Description

It would improve the overall SGX ecosystem, if we had a VM image release of AESMD, which would simply have it as a statically linked binary, which would be the init process for the system. The only goal of this VM would be to run AESMD. It could run as root and does not require a GUI.

Obviously the optimal would be to able to launch it with a raw KVM API but I'm not sure how the networks sockets are used in that scenario, so perhaps a more realistic goal would QEMU hosted version. This is not a technical argument per se. It's just my lack of knowledge on the subject.

One great reason to do this is to have guaranteed availability for remote attestation as `/dev/sgx_vepc` works by partitioning pages. As long as the partition is big enough, AE's are guaranteed to have pinned EPC pages.

One counter-argument would be potentially EPC memlocking, cgroups or some other possible future shenanigans that might be added but the supporting argument is that the solution works on **any** kernel version with the SGX-KVM support.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.