SGX Driver Page Swap Query

[AAhma10]

Hi,

As far as I understand, whenever a page has to be swapped out from the EPC region, the page has to be encrypted while it resides in the DRAM. Can you please provide some details about this? More specifically, I'm interested in how the encryption actually takes place considering that suppose a bit is modified from the page, will the whole page be re-encrypted or is the encryption done block by block even on the page etc.?

I am not able to find out much details about this from the documentations. Please refer me if there is any documentation relevant to this.

Thanks!

Adil

P.S. I am talking about the Linux SGX driver

[Prabu_R_Intel]

Yes , page is encrypted securely  before swapping out of EPC .

Intel SGX includes the EWB instruction for securely evicting pages out of the EPC. EWB encrypts a page in the EPC and writes it to unprotected memory. In addition, EWB also creates a cryptographic MAC of the page and stores it in unprotected memory. A page can be reloaded back to the processor only if the data and MAC match.

Pls refer to below document for more details : https://software.intel.com/sites/default/files/managed/48/88/329298-002.pdf 

Section 3.5.2 OS Management of EPC Pages
 

[AAhma10]

Thanks for the answer. But my question is a bit more regarding the specifics of the encryption process. I am interested in how the encryption takes place and at what granularity. The document unfortunately does not answer my question. I was wondering if someone at Intel could provide me with more details.