Applications under native/ cannot be run after commit "Introduce one,
central manifest, zero-config children and constant MRENCLAVE". Instead
of fixing native/, this commit simply moves helloworld and all its
mentions under regression/.
Previously, Graphene-SGX required vm.mmap_min_addr equal to 0x0 for
non-PIE executables (this is due to the SGX hardware requirement of
enclave base being aligned on enclave size, coupled with non-PIE
requirement of starting the code section at address 0x400000).
The legacy Intel SGX driver required a device-file-backed mmap
starting at address 0x0. The newer DCAP/in-kernel SGX drivers don't
require this, so Graphene-SGX can create the enclave at non-zero
starting address and deprecate the hack of vm.mmap_min_addr == 0x0.
LMbench was causing a lot of problems in the past and we just noticed
another one (the last one from the list below), which broke the
camel's back :)
Some of the issues:
- Original mirrors are unstable.
- Its source is terrible.
- It's not portable (e.g. needs custom patches to run on Fedora).
- Runs for quite long in CI (a few minutes).
- The last update to the project was 15 years ago (13 on dev branch).
- It uses some features not implemented in Graphene
(getrusage(RUSAGE_SELF, ...)) without checking for errors, which leads
to reporting bogus times.
- Actually, it silently skips failures, because the command is piped to
`tee` and then `tee`'s exit code is checked instead of the original
command's.
The DCAP SGX driver v1.6+ closely follows the in-kernel SGX driver
v28+. This version changes the driver path to /dev/sgx/enclave and
changes argument struct of the SGX_IOC_ENCLAVE_ADD_PAGE ioctl.
The DCAP SGX driver works with Flexible Launch Control (FLC) enabled
SGX processors. The FLC feature allows to use arbitrary non-Intel
Launch Enclaves and thus makes the EINITTOKEN struct unnecessary.
This commit skips the step of obtaining the EINITTOKEN struct from
the Launch enclave and instead allows to create a dummy token for
DCAP- and FLC-enabled SGX systems.
Co-authored-by: Dmitrii Kuvaiskii <dmitrii.kuvaiskii@intel.com>
This is a big rewrite of several introduction-level documents. There
were several copies of mostly the same information, but desynchronized
in time. Most of that was split between those files:
- README, now shortened and appropriate for GitHub landing
- index.rst (include README removed)
- building.rst
quickstart.rst was corrected according to building.rst
Dmitrii Kuvaiskii