Openenclave: Supports JIT compilation and PCL

[qinkunbao]

Hi,

I was wondering if Open Enclave supports JIT compilation inside the enclave? Is there any application built on the open enclave SDK that has implemented JIT compilation? Does the open enclave have the protected code loader by the way?

Thank you very much.

[mingweishih]

No, OE does not support JIT inside an enclave. However, you may be able to use sgx-lkl to run JIT engines.

What do you mean by the protected code loader?

[mingweishih]

If you refer to Intel's PCL implementation, then the answer is OE currently does not support it.

[qinkunbao]

If you refer to Intel's PCL implementation, then the answer is OE currently does not support it.

Thank you for the information. Yes, I am referring to Intel PCL or something similar that we can load the encrypted code into the enclave.

[dthaler]

This Issue and #3399 are both related to code confidentiality.

[radhikaj]

Keeping this issue open for tracking the PCL feature.

[anakrish]

@MWShan says first class feature in Intel SDK.
@dthaler says edge customers want it too.
@CodeMonkeyLeet Samples could demonstrate this. Ought to revisit this in maybe 6 months.

Multiple ways to do this:

• Dynamic code loading
• Or baked into the enclave binary

For now put in milestone 13; but expected to be moved past.

[qinkunbao]

Thank you for the information.

I agree that there are multiple ways to implement PCL. But for SGX, no matter how you do it, you have to create a writable and executable page inside the enclave. So the design naturally breaks the data execution prevention feature in modern computer systems.

It is the same with JIT. Maybe the issue can be solved by Intel SGX2.

[johnvenn]

@MWShan says first class feature in Intel SDK.
@dthaler says edge customers want it too.
@CodeMonkeyLeet Samples could demonstrate this. Ought to revisit this in maybe 6 months.

Multiple ways to do this:

• Dynamic code loading
• Or baked into the enclave binary

For now put in milestone 13; but expected to be moved past.

I am working on porting Intel's SGX SDK protected-code-loader to Open Enclave with a proposal(still WIP). The current implementation in Intel 's SGX SDK is based on the 2nd option. There is also security concern (a known issue)about revert back the RWX pages to RX on loading the enclave. We'll take it into consideration in our solution.