English (United Kingdom)

https://curated-unify.zendy.io/wp-json/zendy-region/v1/featured_content/oa?rat=en

https://curated-unify.zendy.io/wp-json/zendy-region/v1/highlighted_journal/

Global: Zendy Plus annual

Presents the access of premium content as premium feature

Premium Content

Presents the keyphrase highlighting as premium feature

Keyphrase Highlighting

Presents the summarisation as premium feature

Summarisation

Insights

Presents the pdf analysis as premium feature

PDF Analysis

Presents the zaia usage as premium feature

ZAIA

Global: Zendy Plus monthly

Global: Zendy Tools annual

Global: Zendy Tools monthly

Global: Zendy Free Plan

The Intel Software Guard Extensions (SGX) technology enables applications torun in an isolated SGX enclave environment, with elevated confidentiality andintegrity guarantees. Gramine Library OS facilitates execution of existingunmodified applications in SGX enclaves, requiring only an accompanyingmanifest file that describes the application's security posture andconfiguration. However, Intel SGX is a CPU-only technology, thus Graminecurrently supports CPU-only workloads. To enable a broader class ofapplications that offload computations to hardware accelerators - GPU offload,NIC offload, FPGA offload, TPM communications - Gramine must be augmented withdevice-backed mmap support and generic ioctl support. In this paper, wedescribe the design and implementation of this newly added support, thecorresponding changes to the manifest-file syntax and the requisite deep copyalgorithm. We evaluate our implementation on Intel Media SDK workloads anddiscuss the encountered caveats and limitations. Finally, we outline a use casefor the presented mmap/ioctl support beyond mere device communication, namelythe mechanism to slice the application into the trusted enclave part (where thecore application executes) and the untrusted shared-memory part (where insecureshared libraries execute).

Computation offloading to hardware accelerators in Intel SGX and Gramine Library OS