From 383076f2b45987330dcfbe4f0edfd03877fa81ca Mon Sep 17 00:00:00 2001 From: Chihyun Song Date: Sat, 15 Feb 2020 21:53:43 +0900 Subject: [PATCH] [Pal/Linux-SGX] Add support for the DCAP SGX driver versions 1.5- The DCAP SGX driver works with Flexible Launch Control (FLC) enabled SGX processors. The FLC feature allows to use arbitrary non-Intel Launch Enclaves and thus makes the EINITTOKEN struct unnecessary. This commit skips the step of obtaining the EINITTOKEN struct from the Launch enclave and instead allows to create a dummy token for DCAP- and FLC-enabled SGX systems. --- Documentation/building.rst | 10 ++++- .../oldwiki/Introduction-to-Graphene-SGX.rst | 4 +- Documentation/quickstart.rst | 11 +++-- Jenkinsfiles/Linux-SGX-18.04 | 3 ++ Pal/lib/Makefile | 2 +- Pal/src/host/Linux-SGX/generated-offsets.c | 12 +++++ Pal/src/host/Linux-SGX/sgx-driver | 2 +- Pal/src/host/Linux-SGX/sgx_framework.c | 5 +++ .../host/Linux-SGX/signer/pal-sgx-get-token | 45 ++++++++++++++++++- 9 files changed, 84 insertions(+), 10 deletions(-) diff --git a/Documentation/building.rst b/Documentation/building.rst index a376360d..75f282bb 100644 --- a/Documentation/building.rst +++ b/Documentation/building.rst @@ -86,12 +86,18 @@ Prerequisites 2. Install the Intel SGX SDK and driver - The Intel SGX Linux SDK is required to compile and run Graphene on SGX. - Download and install it from the official Intel GitHub repositories: + The Intel SGX Linux SDK and the Intel SGX driver are required to compile and + run Graphene on SGX. Download and install them from the official Intel + GitHub repositories: - - + Alternatively, if you want to use the DCAP versions of the SDK and driver, + download and install them from: + + - + 3. Build and install the Graphene SGX driver A Graphene-specific Linux driver must also be installed before running Graphene in an SGX environment. Simply run the following commands to build diff --git a/Documentation/oldwiki/Introduction-to-Graphene-SGX.rst b/Documentation/oldwiki/Introduction-to-Graphene-SGX.rst index 76f92bd0..e6abcbe5 100644 --- a/Documentation/oldwiki/Introduction-to-Graphene-SGX.rst +++ b/Documentation/oldwiki/Introduction-to-Graphene-SGX.rst @@ -94,7 +94,9 @@ Prerequisites for Untrusted Host ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ To run the applications on Intel SGX with Graphene-SGX, the host must have an SGX-enabled CPU, with Intel SGX SDK and the SGX driver installed. Please download and install the SDK and the driver from: - and . + and . If you want +to use the DCAP SDK and driver, please download and install from: +. A Graphene SGX driver (gsgx) also needs to be installed on the untrusted host. Simply run the following commands to build the driver:: diff --git a/Documentation/quickstart.rst b/Documentation/quickstart.rst index d42612e5..3b4e44b3 100644 --- a/Documentation/quickstart.rst +++ b/Documentation/quickstart.rst @@ -34,19 +34,22 @@ SGX Quick Start Before you run any applications in Graphene-SGX, please make sure that Intel SGX SDK and the SGX driver are installed on your system. We recommend using Intel -SGX SDK and the SGX driver no older than version 2.1. +SGX SDK and the SGX driver no older than version 1.9 (or the DCAP SGX SDK and +the driver version 1.4/1.5). If Intel SGX SDK and the SGX driver are not installed, please follow the READMEs in and to download and install them. +If you want to use the DCAP SDK and driver, please follow the READMEs in +. 1. Ensure That Intel SGX is Enabled on Your Platform:: - lsmod | grep isgx + lsmod | grep sgx ps ax | grep [a]esm_service -The first command should list :command:`isgx` and the second command should list -the process status of :command:`aesm_service`. +The first command should list :command:`isgx` (or :command:`sgx`) and the +second command should list the process status of :command:`aesm_service`. 2. Clone the Repository and Set the Home Directory of Graphene:: diff --git a/Jenkinsfiles/Linux-SGX-18.04 b/Jenkinsfiles/Linux-SGX-18.04 index e3714c36..467c9224 100644 --- a/Jenkinsfiles/Linux-SGX-18.04 +++ b/Jenkinsfiles/Linux-SGX-18.04 @@ -37,6 +37,9 @@ pipeline { ISGX_DRIVER_PATH=/opt/intel/linux-sgx-driver ISGX_DRIVER_VERSION=1.9 make ''' sh ''' + CFLAGS="-DSGX_DCAP" make -j 8 SGX=1 WERROR=1 + CFLAGS="-DSGX_DCAP" make -j 8 SGX=1 clean + make -j 8 SGX=1 WERROR=1 make -j 8 SGX=1 WERROR=1 test ''' diff --git a/Pal/lib/Makefile b/Pal/lib/Makefile index 0e5b63e9..a5013165 100644 --- a/Pal/lib/Makefile +++ b/Pal/lib/Makefile @@ -3,7 +3,7 @@ include ../../Scripts/Makefile.rules include ../src/host/$(PAL_HOST)/Makefile.am CFLAGS += -I../include/lib -I../include -I../include/pal -I../include/host/$(PAL_HOST) \ - -Icrypto/mbedtls/include -Icrypto/mbedtls/crypto/include + -I../src/host/$(PAL_HOST) -Icrypto/mbedtls/include -Icrypto/mbedtls/crypto/include CRYPTO_PROVIDER ?= mbedtls diff --git a/Pal/src/host/Linux-SGX/generated-offsets.c b/Pal/src/host/Linux-SGX/generated-offsets.c index d083d0b9..c6cd45db 100644 --- a/Pal/src/host/Linux-SGX/generated-offsets.c +++ b/Pal/src/host/Linux-SGX/generated-offsets.c @@ -10,6 +10,13 @@ #include "sgx_arch.h" #include "sgx_tls.h" +/* sgx.h header from the Intel SGX driver assumes that `__packed` macro was defined */ +#ifndef __packed +#define __packed __attribute__((packed)) +#endif +#include "sgx.h" +#undef __packed + #include void dummy(void) @@ -169,4 +176,9 @@ void dummy(void) OFFSET_T(XSAVE_HEADER_OFFSET, PAL_XREGS_STATE, header); DEFINE(PAL_XSTATE_ALIGN, PAL_XSTATE_ALIGN); DEFINE(PAL_FP_XSTATE_MAGIC2_SIZE, PAL_FP_XSTATE_MAGIC2_SIZE); + + /* SGX_DCAP */ +#ifdef SGX_DCAP + DEFINE(SGX_DCAP, SGX_DCAP); +#endif } diff --git a/Pal/src/host/Linux-SGX/sgx-driver b/Pal/src/host/Linux-SGX/sgx-driver index ff8bab5e..44833b40 160000 --- a/Pal/src/host/Linux-SGX/sgx-driver +++ b/Pal/src/host/Linux-SGX/sgx-driver @@ -1 +1 @@ -Subproject commit ff8bab5ef58cca3ccc93674b62c0c16fe6668c93 +Subproject commit 44833b409da6a746a59e0c47de6285d027e5cb4f diff --git a/Pal/src/host/Linux-SGX/sgx_framework.c b/Pal/src/host/Linux-SGX/sgx_framework.c index 8aa40111..891853b3 100644 --- a/Pal/src/host/Linux-SGX/sgx_framework.c +++ b/Pal/src/host/Linux-SGX/sgx_framework.c @@ -285,6 +285,9 @@ int init_enclave(sgx_arch_secs_t * secs, sgx_arch_enclave_css_t * sigstruct, sgx_arch_token_t * token) { +#ifdef SGX_DCAP + __UNUSED(token); +#endif unsigned long enclave_valid_addr = secs->base + secs->size - g_page_size; @@ -298,7 +301,9 @@ int init_enclave(sgx_arch_secs_t * secs, struct sgx_enclave_init param = { .addr = enclave_valid_addr, .sigstruct = (uint64_t) sigstruct, +#ifndef SGX_DCAP .einittoken = (uint64_t) token, +#endif }; int ret = INLINE_SYSCALL(ioctl, 3, isgx_device, SGX_IOC_ENCLAVE_INIT, ¶m); diff --git a/Pal/src/host/Linux-SGX/signer/pal-sgx-get-token b/Pal/src/host/Linux-SGX/signer/pal-sgx-get-token index ca7c7ca8..6893d03a 100755 --- a/Pal/src/host/Linux-SGX/signer/pal-sgx-get-token +++ b/Pal/src/host/Linux-SGX/signer/pal-sgx-get-token @@ -2,6 +2,7 @@ # pylint: disable=invalid-name import argparse +import array import os import socket import struct @@ -76,6 +77,9 @@ def read_sigstruct(sig): return attr +def is_dcap(): + """ Check if we're dealing with DCAP driver.""" + return hasattr(offs, 'SGX_DCAP') def connect_aesmd(attr): """Connect with AESMD.""" @@ -118,6 +122,41 @@ def connect_aesmd(attr): return ret_msg.ret.token +def create_dummy_token(attr): + """ Create dummy token with a few fields initialized with real values + and others with a placeholder ('\0')""" + token = array.array('B', b'\0'*304) + + # format: field_name -> tuple (offset, type_with_size) + fields = dict() + + fields['valid'] = (0, "