Hello, I'm currently researching a little about the Intel SGX technology and I find it difficult to build a trusted enclave within an untrusted operating system. Maybe there is no effective mechanism to notify a Ring3 application whether the enclave is trusted or not.
Take an example to explain the details of my question. In an untrusted OS, I can make IA32_FEATURE_CONTROL.SGX_ENABLE = 0 through installing a VMM, and make the Ring3 application think the IA32_FEATURE_CONTROL.SGX_ENABLE = 1. Then any SGX instructions (i.e. ENCLS and ENCLU) will trigger a #GP(0). I also use the VMM to hook the handler of #GP(0). In the fake #GP(0) handler, it emulates the results of SGX instructions. Therefore, I can create a fake enclave for the Ring3 applications and emulate all of the operations of SGX instructions through the VMM and the fake #GP(0) handler. Any application uses the fake enclave will leak its secret content. And the application will not be able to notice the enclave is untrusted since all of these operations are transparent to it.
I do not know whether it is a bug or I lose some knowledge about SGX. Please enlighten me on this subject. Thank you.
