Maximum Number of SGX Enclaves & Multi-Threads on One Server?

[Sean_]

Hi, I wonder what factor determines the maximum number of SGX enclaves and multi-threads on one server?

I thought, the maximum number of SGX multi-threads is determined by the number of logical cores on the server. And, as long as the multi-threads number does not exceed the number of logical cores, we can create different enclaves as much as possible, and the maximum case is, e.g., for a 48-logical-core server, each SGX enclaves consume one thread, and there can be 48 SGX enclaves created at most at the same time.

Thank you in advance!

I see related questions answered before by:

@Juan_d_Intel 

@PadmaPriya_M_Intel 

@Anandakumar 

[Zulkifli_Intel · Accepted solution]

Hi Sean,

Thank you for reaching out to us.

Since there is a limit on the protected memory size (typically 64 or 128 MB) the number of active enclaves in memory is limited. But it is dependent on the memory footprint of each enclave, so use cases suggest 5-20 can reside in memory simultaneously (on a Windows machine). Ultimately it would come down to the size of how much memory is allocated to each enclave.

The maximum enclave is determined by the operating system or memory limits e.g. Windows does not support paging so the max size of an enclave is limited by the available Enclave Page Cache (EPC), while Linux does support paging so the maximum amount of memory not limited by EPC. Here is more information on Enclave Sizes: 

https://www.intel.com/content/www/us/en/support/articles/000089548/software/intel-security-products.html

And for more details, please refer to the SGX Developer Reference Guide. 

Sincerely,

Zul

[Sean_]

You say 5 - 20 enclaves. But I wonder even if the EPC and memory size permitted, if the core of the machine is only 8, can it run more than 8 SGX enclaves at the same time? Or you mean the more than 8 SGX enclaves will seize the limited 8 cores?

[Zulkifli_Intel]

Thank you for your question. If you need any additional information from Intel, please submit a new question as this thread is no longer being monitored.