From 1deb73848acc855efdacc0617a07fcd35ca044cc Mon Sep 17 00:00:00 2001 From: Zhang Lili Date: Wed, 15 Jun 2022 11:49:48 +0800 Subject: [PATCH] Updates for SGX 2.17 reproducible build. Signed-off-by: Zhang Lili --- .gitmodules | 2 +- License.txt | 26 + .../sgx/SGXEnclave/untrusted/sample.cpp | 5 + Makefile | 90 ++- Makefile.psw_dcap | 8 +- README.md | 98 +-- SampleCode/Cxx11SGXDemo/App/App.cpp | 5 + SampleCode/Cxx11SGXDemo/Enclave/Enclave.cpp | 3 +- SampleCode/Cxx11SGXDemo/Enclave/Enclave.h | 2 +- SampleCode/Cxx11SGXDemo/Makefile | 2 +- SampleCode/Cxx14SGXDemo/App/App.cpp | 5 + SampleCode/Cxx14SGXDemo/Enclave/Enclave.cpp | 3 +- SampleCode/Cxx14SGXDemo/Enclave/Enclave.h | 2 +- SampleCode/Cxx14SGXDemo/Makefile | 2 +- .../PowerTransition/App/ErrorSupport.cpp | 1 + .../PowerTransition/Enclave/Enclave.cpp | 2 +- SampleCode/ProtobufSGXDemo/App/App.cpp | 5 + .../ProtobufSGXDemo/Enclave/Enclave.cpp | 3 +- SampleCode/ProtobufSGXDemo/Enclave/Enclave.h | 2 +- .../client/enc/openssl_client.cpp | 35 +- .../SampleAttestedTLS/client/host/host.cpp | 16 +- .../SampleAttestedTLS/client/tls_client.edl | 21 +- .../SampleAttestedTLS/common/enclave.edl | 6 +- .../common/openssl_utility.cpp | 43 +- .../SampleAttestedTLS/common/tcommon.cpp | 2 +- .../SampleAttestedTLS/common/ucommon.cpp | 4 +- .../SampleAttestedTLS/common/utility.cpp | 185 +++--- .../common/verify_callback.cpp | 18 +- .../non_enc_client/client.cpp | 23 +- .../server/enc/openssl_server.cpp | 38 +- .../SampleAttestedTLS/server/host/host.cpp | 6 +- .../SampleAttestedTLS/server/tls_server.edl | 16 +- .../sgx_socket/include/sgx_socket.edl | 6 +- .../sgx_socket/trusted_sgx_socket.cpp | 86 +-- .../sgx_socket/untrusted_sgx_socket.cpp | 37 +- SampleCode/SampleDNNL/App/App.cpp | 5 + SampleCode/SampleDNNL/Enclave/Enclave.cpp | 4 +- .../Enclave/cpu_rnn_inference_f32_cpp.cpp | 2 +- .../Enclave/cpu_rnn_inference_int8_cpp.cpp | 2 +- .../SampleDNNL/Enclave/example_utils.hpp | 2 +- SampleCode/SampleDNNL/Makefile | 2 +- SampleCode/SampleEnclave/App/App.cpp | 5 + .../Enclave/Edger8rSyntax/Arrays.cpp | 15 +- .../Enclave/Edger8rSyntax/Pointers.cpp | 2 +- SampleCode/SampleEnclaveGMIPP/App/App.cpp | 5 + SampleCode/SampleEnclavePCL/App/App.cpp | 5 + .../Enclave/Edger8rSyntax/Arrays.cpp | 15 +- .../Enclave/Edger8rSyntax/Pointers.cpp | 65 +- .../SampleEnclavePCL/Enclave/Enclave.cpp | 3 +- SampleCode/SampleEnclavePCL/Enclave/Enclave.h | 2 +- SampleCode/SealUnseal/App/ErrorSupport.cpp | 1 + SampleCode/Switchless/App/App.cpp | 5 + common/inc/internal/global_data.h | 1 + common/inc/internal/se_version.h | 24 +- common/inc/sgx_error.h | 2 +- common/inc/tlibc/mbusafecrt.h | 2 + common/inc/tlibc/string.h | 4 + download_prebuilt.sh | 8 +- external/dcap_source | 2 +- .../0001-IPP-crypto-for-SGX_psw_dcap.patch | 41 ++ external/ippcp_internal/Makefile.psw_dcap | 74 +++ external/ippcp_internal/inc/sgx_ippcp.h | 569 ++++++++++++++++++ external/protobuf/Makefile | 6 +- external/protobuf/protobuf_code | 2 +- external/protobuf/sgx_protobuf.patch | 405 ++++++------- external/sgxssl/prepare_sgxssl.sh | 8 +- linux/installer/bin/install-sgx-psw.bin.tmpl | 2 +- .../94-sgx-enclave.rules | 2 + .../BOMs/libsgx-enclave-common.txt | 1 + .../common/libsgx-enclave-common/Makefile | 7 + .../psw-dcap/BOM_install/sgx-dcap-pccs.txt | 1 - .../psw-dcap/BOM_source/psw-dcap-tarball.txt | 1 + linux/installer/common/psw/BOMs/psw_base.txt | 4 +- linux/installer/common/sdk/BOMs/sdk_base.txt | 8 +- linux/installer/common/sdk/Makefile | 59 +- .../common/sgx-aesm-service/linksgx.sh | 5 + .../sgx-aesm-service-1.0/debian/control | 4 +- .../sgx-aesm-service-1.0/debian/rules | 2 +- .../installer/rpm/psw-dcap/psw-dcap.spec.tmpl | 1 + linux/installer/rpm/psw-dcap/sanitize.sh | 7 + .../libsgx-aesm-ecdsa-plugin.spec | 2 +- .../libsgx-aesm-pce-plugin.spec | 2 +- linux/reproducibility/README.md | 5 +- .../build_and_launch_docker.sh | 6 +- linux/reproducibility/start_build.sh.tmp | 2 + .../aesm_service/source/core/CMakeLists.txt | 5 + .../core/ipc/UnixCommunicationSocket.cpp | 5 - .../source/oal/linux/error_report.cpp | 32 +- .../source/oal/linux/internal_log.cpp | 1 + psw/ae/pce/config.xml | 2 +- psw/ae/pve/config.xml | 2 +- psw/ae/pve/helper.cpp | 3 +- psw/ae/qe/config.xml | 2 +- psw/ae/qe/quoting_enclave.cpp | 30 +- psw/enclave_common/sgx_enclave_common.cpp | 62 +- psw/urts/linux/sig_handler.cpp | 7 +- psw/urts/loader.cpp | 9 +- psw/urts/parser/update_global_data.hxx | 1 + sdk/debugger_interface/linux/se_ptrace.c | 2 - sdk/edger8r/linux/CodeGen.ml | 123 ++-- sdk/sign_tool/SignTool/sign_tool.cpp | 2 +- .../urtssim/enclave_creator_sim.cpp | 46 +- sdk/switchless/inc/sl_bitops.h | 6 +- sdk/switchless/inc/sl_fcall_mngr_common.h | 50 +- .../sgx_tswitchless/sgx_ocall_switchless.c | 10 +- sdk/tkey_exchange/tkey_exchange.cpp | 2 +- sdk/tlibc/string/asm/memcpy_verw.S | 64 ++ sdk/tlibc/string/memcpy.c | 44 ++ sdk/tlibc/string/memmove.c | 72 +++ sdk/tlibc/string/memset.c | 39 +- sdk/tlibc/string/memset_s.c | 35 ++ sdk/trts/init_enclave.cpp | 2 +- sdk/trts/linux/trts_pic.S | 4 + sdk/trts/trts_util.cpp | 10 +- sdk/trts/trts_veh.cpp | 2 +- sdk/trts/trts_xsave.cpp | 4 +- sdk/tsafecrt/pal/src/safecrt/memcpy_s.c | 56 ++ sdk/tsafecrt/pal/src/safecrt/memmove_s.c | 36 ++ sdk/ttls/ttls.cpp | 15 +- 119 files changed, 2122 insertions(+), 880 deletions(-) create mode 100644 external/ippcp_internal/0001-IPP-crypto-for-SGX_psw_dcap.patch create mode 100644 external/ippcp_internal/Makefile.psw_dcap create mode 100644 external/ippcp_internal/inc/sgx_ippcp.h create mode 100644 linux/installer/common/libsgx-enclave-common/94-sgx-enclave.rules create mode 100644 sdk/tlibc/string/asm/memcpy_verw.S diff --git a/.gitmodules b/.gitmodules index 0f21f635..f99344ba 100644 --- a/.gitmodules +++ b/.gitmodules @@ -17,4 +17,4 @@ [submodule "external/protobuf/protobuf_code"] path = external/protobuf/protobuf_code url = https://github.com/protocolbuffers/protobuf.git - branch = 3.14.x + branch = 3.20.x diff --git a/License.txt b/License.txt index 64cc6492..b97d27f5 100644 --- a/License.txt +++ b/License.txt @@ -1603,3 +1603,29 @@ AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE + +22. musl C + +musl as a whole is licensed under the following standard MIT license: + +---------------------------------------------------------------------- +Copyright © 2005-2020 Rich Felker, et al. + +Permission is hereby granted, free of charge, to any person obtaining +a copy of this software and associated documentation files (the +"Software"), to deal in the Software without restriction, including +without limitation the rights to use, copy, modify, merge, publish, +distribute, sublicense, and/or sell copies of the Software, and to +permit persons to whom the Software is furnished to do so, subject to +the following conditions: + +The above copyright notice and this permission notice shall be +included in all copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, +EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF +MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. +IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY +CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, +TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE +SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. diff --git a/Linux_SGXEclipsePlugin/build_directory/plugins/com.intel.sgx/templates/sgx/SGXEnclave/untrusted/sample.cpp b/Linux_SGXEclipsePlugin/build_directory/plugins/com.intel.sgx/templates/sgx/SGXEnclave/untrusted/sample.cpp index 2885ebd2..c8bcf489 100644 --- a/Linux_SGXEclipsePlugin/build_directory/plugins/com.intel.sgx/templates/sgx/SGXEnclave/untrusted/sample.cpp +++ b/Linux_SGXEclipsePlugin/build_directory/plugins/com.intel.sgx/templates/sgx/SGXEnclave/untrusted/sample.cpp @@ -102,6 +102,11 @@ static sgx_errlist_t sgx_errlist[] = { "Can't open enclave file.", NULL }, + { + SGX_ERROR_MEMORY_MAP_FAILURE, + "Failed to reserve memory for the enclave.", + NULL + }, }; /* Check error conditions for loading enclave */ diff --git a/Makefile b/Makefile index c9905ffc..e5a57065 100644 --- a/Makefile +++ b/Makefile @@ -30,7 +30,7 @@ # include buildenv.mk -.PHONY: all preparation psw sdk clean rebuild sdk_install_pkg psw_install_pkg +.PHONY: all preparation psw sdk clean rebuild sdk_install_pkg psw_install_pkg tdx all: tips @@ -80,6 +80,12 @@ sdk: $(MAKE) -C external/dcap_source/QuoteVerification/dcap_tvl clean $(MAKE) -C external/dcap_source/QuoteVerification/dcap_tvl +tdx: + $(MAKE) -C external/dcap_source/QuoteGeneration pce_logic + $(MAKE) -C external/dcap_source/QuoteGeneration tdx_logic + $(MAKE) -C external/dcap_source/QuoteGeneration tdx_qgs + $(MAKE) -C external/dcap_source/QuoteGeneration tdx_attest + # Generate SE SDK Install package sdk_install_pkg_no_mitigation: sdk_no_mitigation ./linux/installer/bin/build-installpkg.sh sdk @@ -112,17 +118,51 @@ ifeq ("$(wildcard ./external/dcap_source/QuoteGeneration/psw/ae/data/prebuilt/li endif $(MAKE) -C external/dcap_source/QuoteGeneration deb_sgx_ae_id_enclave_pkg $(CP) external/dcap_source/QuoteGeneration/installer/linux/deb/libsgx-ae-id-enclave/libsgx-ae-id-enclave*.deb ./linux/installer/deb/sgx-aesm-service/ + +.PHONY: deb_libsgx_ae_tdqe deb_libsgx_tdx_logic deb_tdx_qgs deb_tdx_attest +ifeq ($(DISTR_ID)$(DISTR_VER),ubuntu18.04) +deb_libsgx_ae_tdqe: + echo "Skip tdqe in ubuntu 18.04" +deb_libsgx_tdx_logic: + echo "Skip tdx_logic in ubuntu 18.04" +deb_tdx_qgs: + echo "Skip tdx_qgs in ubuntu 18.04" +deb_tdx_attest: + echo "Skip tdx_attest in ubuntu 18.04" +else +deb_libsgx_ae_tdqe: +ifeq ("$(wildcard ./external/dcap_source/QuoteGeneration/psw/ae/data/prebuilt/libsgx_tdqe.signed.so)", "") + ./external/dcap_source/QuoteGeneration/download_prebuilt.sh +endif + $(MAKE) -C external/dcap_source/QuoteGeneration deb_sgx_ae_tdqe_pkg + $(CP) external/dcap_source/QuoteGeneration/installer/linux/deb/libsgx-ae-tdqe/libsgx-ae-tdqe*.deb ./linux/installer/deb/sgx-aesm-service/ + +deb_libsgx_tdx_logic: + $(MAKE) -C external/dcap_source/QuoteGeneration deb_sgx_tdx_logic_pkg + $(CP) external/dcap_source/QuoteGeneration/installer/linux/deb/libsgx-tdx-logic/libsgx-tdx-logic*deb ./linux/installer/deb/sgx-aesm-service/ + +deb_tdx_qgs: + $(MAKE) -C external/dcap_source/QuoteGeneration deb_sgx_tdx_qgs_pkg + $(CP) external/dcap_source/QuoteGeneration/installer/linux/deb/tdx-qgs/tdx-qgs*deb ./linux/installer/deb/sgx-aesm-service/ + +deb_tdx_attest: + $(MAKE) -C external/dcap_source/QuoteGeneration deb_sgx_tdx_attest_pkg + $(CP) external/dcap_source/QuoteGeneration/installer/linux/deb/libtdx-attest/libtdx-attest*deb ./linux/installer/deb/sgx-aesm-service/ +endif + .PHONY: deb_libsgx_qe3_logic deb_libsgx_qe3_logic: psw $(MAKE) -C external/dcap_source/QuoteGeneration deb_sgx_qe3_logic_pkg $(CP) external/dcap_source/QuoteGeneration/installer/linux/deb/libsgx-qe3-logic/libsgx-qe3-logic*deb ./linux/installer/deb/sgx-aesm-service/ + .PHONY: deb_libsgx_pce_logic deb_libsgx_pce_logic: psw $(MAKE) -C external/dcap_source/QuoteGeneration deb_sgx_pce_logic_pkg + $(CP) external/dcap_source/QuoteGeneration/build/linux/libsgx_pce_logic.so* $(BUILD_DIR) $(CP) external/dcap_source/QuoteGeneration/installer/linux/deb/libsgx-pce-logic/libsgx-pce-logic*deb ./linux/installer/deb/sgx-aesm-service/ .PHONY: deb_sgx_aesm_service -deb_sgx_aesm_service: psw +deb_sgx_aesm_service: psw deb_libsgx_pce_logic ./linux/installer/deb/sgx-aesm-service/build.sh .PHONY: deb_libsgx_epid @@ -155,7 +195,7 @@ deb_libsgx_headers_pkg: ifeq ($(CC_BELOW_5_2), 1) .PHONY: deb_psw_pkg -deb_psw_pkg: deb_libsgx_headers_pkg deb_libsgx_qe3_logic deb_libsgx_pce_logic deb_sgx_aesm_service deb_libsgx_epid deb_libsgx_launch deb_libsgx_quote_ex deb_libsgx_uae_service deb_libsgx_enclave_common deb_libsgx_urts deb_libsgx_ae_qe3 deb_libsgx_ae_id_enclave +deb_psw_pkg: deb_libsgx_headers_pkg deb_libsgx_qe3_logic deb_libsgx_pce_logic deb_sgx_aesm_service deb_libsgx_epid deb_libsgx_launch deb_libsgx_quote_ex deb_libsgx_uae_service deb_libsgx_enclave_common deb_libsgx_urts deb_libsgx_ae_qe3 deb_libsgx_ae_tdqe deb_libsgx_ae_id_enclave deb_libsgx_tdx_logic deb_tdx_qgs deb_tdx_attest else .PHONY: deb_libsgx_dcap_default_qpl deb_libsgx_dcap_default_qpl: @@ -168,7 +208,7 @@ deb_libsgx_dcap_pccs: $(CP) external/dcap_source/QuoteGeneration/installer/linux/deb/sgx-dcap-pccs/sgx-dcap-pccs*deb ./linux/installer/deb/sgx-aesm-service/ .PHONY: deb_libsgx_dcap_ql -deb_libsgx_dcap_ql: +deb_libsgx_dcap_ql: deb_libsgx_pce_logic $(MAKE) -C external/dcap_source/QuoteGeneration deb_sgx_dcap_ql_pkg $(CP) external/dcap_source/QuoteGeneration/installer/linux/deb/libsgx-dcap-ql/libsgx-dcap-ql*deb ./linux/installer/deb/sgx-aesm-service/ @@ -190,16 +230,14 @@ deb_sgx_pck_id_retrieval_tool_pkg: $(MAKE) -C external/dcap_source/QuoteGeneration deb_sgx_pck_id_retrieval_tool_pkg $(CP) external/dcap_source/tools/PCKRetrievalTool/installer/deb/sgx-pck-id-retrieval-tool/sgx-pck-id-retrieval-tool*deb ./linux/installer/deb/sgx-aesm-service/ - .PHONY: deb_sgx_ra_service_pkg deb_sgx_ra_service_pkg: $(MAKE) -C external/dcap_source/QuoteGeneration deb_sgx_ra_service_pkg $(CP) external/dcap_source/tools/SGXPlatformRegistration/build/installer/sgx-ra-service*deb ./linux/installer/deb/sgx-aesm-service/ $(CP) external/dcap_source/tools/SGXPlatformRegistration/build/installer/libsgx-ra-*deb ./linux/installer/deb/sgx-aesm-service/ - .PHONY: deb_psw_pkg -deb_psw_pkg: deb_libsgx_headers_pkg deb_libsgx_qe3_logic deb_libsgx_pce_logic deb_sgx_aesm_service deb_libsgx_epid deb_libsgx_launch deb_libsgx_quote_ex deb_libsgx_uae_service deb_libsgx_enclave_common deb_libsgx_urts deb_libsgx_ae_qe3 deb_libsgx_ae_id_enclave deb_libsgx_dcap_default_qpl deb_libsgx_dcap_pccs deb_libsgx_dcap_ql deb_libsgx_ae_qve deb_sgx_dcap_quote_verify deb_sgx_pck_id_retrieval_tool_pkg deb_sgx_ra_service_pkg +deb_psw_pkg: deb_libsgx_headers_pkg deb_libsgx_qe3_logic deb_libsgx_pce_logic deb_sgx_aesm_service deb_libsgx_epid deb_libsgx_launch deb_libsgx_quote_ex deb_libsgx_uae_service deb_libsgx_enclave_common deb_libsgx_urts deb_libsgx_ae_qe3 deb_libsgx_ae_id_enclave deb_libsgx_dcap_default_qpl deb_libsgx_dcap_pccs deb_libsgx_dcap_ql deb_libsgx_ae_qve deb_sgx_dcap_quote_verify deb_sgx_pck_id_retrieval_tool_pkg deb_sgx_ra_service_pkg deb_libsgx_ae_tdqe deb_libsgx_tdx_logic deb_tdx_qgs deb_tdx_attest endif .PHONY: deb_local_repo @@ -213,6 +251,15 @@ ifeq ("$(wildcard ./external/dcap_source/QuoteGeneration/psw/ae/data/prebuilt/li endif $(MAKE) -C external/dcap_source/QuoteGeneration rpm_sgx_ae_qe3_pkg $(CP) external/dcap_source/QuoteGeneration/installer/linux/rpm/libsgx-ae-qe3/libsgx-ae-qe3*.rpm ./linux/installer/rpm/sgx-aesm-service/ + +.PHONY: rpm_libsgx_ae_tdqe +rpm_libsgx_ae_tdqe: +ifeq ("$(wildcard ./external/dcap_source/QuoteGeneration/psw/ae/data/prebuilt/libsgx_tdqe.signed.so)", "") + ./external/dcap_source/QuoteGeneration/download_prebuilt.sh +endif + $(MAKE) -C external/dcap_source/QuoteGeneration rpm_sgx_ae_tdqe_pkg + $(CP) external/dcap_source/QuoteGeneration/installer/linux/rpm/libsgx-ae-tdqe/libsgx-ae-tdqe*.rpm ./linux/installer/rpm/sgx-aesm-service/ + .PHONY: rpm_libsgx_ae_id_enclave rpm_libsgx_ae_id_enclave: ifeq ("$(wildcard ./external/dcap_source/QuoteGeneration/psw/ae/data/prebuilt/libsgx_id_enclave.signed.so)", "") @@ -220,10 +267,27 @@ ifeq ("$(wildcard ./external/dcap_source/QuoteGeneration/psw/ae/data/prebuilt/li endif $(MAKE) -C external/dcap_source/QuoteGeneration rpm_sgx_ae_id_enclave_pkg $(CP) external/dcap_source/QuoteGeneration/installer/linux/rpm/libsgx-ae-id-enclave/libsgx-ae-id-enclave*.rpm ./linux/installer/rpm/sgx-aesm-service/ + +.PHONY: rpm_libsgx_tdx_logic +rpm_libsgx_tdx_logic: + $(MAKE) -C external/dcap_source/QuoteGeneration rpm_sgx_tdx_logic_pkg + $(CP) external/dcap_source/QuoteGeneration/installer/linux/rpm/libsgx-tdx-logic/libsgx-tdx-logic*.rpm ./linux/installer/rpm/sgx-aesm-service/ + +.PHONY: rpm_tdx_qgs +rpm_tdx_qgs: + $(MAKE) -C external/dcap_source/QuoteGeneration rpm_sgx_tdx_qgs_pkg + $(CP) external/dcap_source/QuoteGeneration/installer/linux/rpm/tdx-qgs/tdx-qgs*.rpm ./linux/installer/rpm/sgx-aesm-service/ + +.PHONY: rpm_tdx_attest +rpm_tdx_attest: + $(MAKE) -C external/dcap_source/QuoteGeneration rpm_sgx_tdx_attest_pkg + $(CP) external/dcap_source/QuoteGeneration/installer/linux/rpm/libtdx-attest/libtdx-attest*.rpm ./linux/installer/rpm/sgx-aesm-service/ + .PHONY: rpm_libsgx_pce_logic rpm_libsgx_pce_logic: psw $(MAKE) -C external/dcap_source/QuoteGeneration rpm_sgx_pce_logic_pkg $(CP) external/dcap_source/QuoteGeneration/installer/linux/rpm/libsgx-pce-logic/libsgx-pce-logic*.rpm ./linux/installer/rpm/sgx-aesm-service/ + .PHONY: rpm_libsgx_qe3_logic rpm_libsgx_qe3_logic: psw $(MAKE) -C external/dcap_source/QuoteGeneration rpm_sgx_qe3_logic_pkg @@ -267,7 +331,7 @@ rpm_libsgx_headers_pkg: ifeq ($(CC_BELOW_5_2), 1) .PHONY: rpm_psw_pkg -rpm_psw_pkg: rpm_libsgx_headers_pkg rpm_libsgx_pce_logic rpm_libsgx_qe3_logic rpm_sgx_aesm_service rpm_libsgx_epid rpm_libsgx_launch rpm_libsgx_quote_ex rpm_libsgx_uae_service rpm_libsgx_enclave_common rpm_libsgx_urts rpm_libsgx_ae_qe3 rpm_libsgx_ae_id_enclave +rpm_psw_pkg: rpm_libsgx_headers_pkg rpm_libsgx_pce_logic rpm_libsgx_qe3_logic rpm_sgx_aesm_service rpm_libsgx_epid rpm_libsgx_launch rpm_libsgx_quote_ex rpm_libsgx_uae_service rpm_libsgx_enclave_common rpm_libsgx_urts rpm_libsgx_ae_qe3 rpm_libsgx_ae_tdqe rpm_libsgx_ae_id_enclave rpm_libsgx_tdx_logic rpm_tdx_qgs rpm_tdx_attest else .PHONY: rpm_libsgx_dcap_default_qpl rpm_libsgx_dcap_default_qpl: @@ -309,7 +373,7 @@ rpm_sgx_ra_service_pkg: $(CP) external/dcap_source/tools/SGXPlatformRegistration/build/installer/libsgx-ra-*rpm ./linux/installer/rpm/sgx-aesm-service/ .PHONY: rpm_psw_pkg -rpm_psw_pkg: rpm_libsgx_headers_pkg rpm_libsgx_pce_logic rpm_libsgx_qe3_logic rpm_sgx_aesm_service rpm_libsgx_epid rpm_libsgx_launch rpm_libsgx_quote_ex rpm_libsgx_uae_service rpm_libsgx_enclave_common rpm_libsgx_urts rpm_libsgx_ae_qe3 rpm_libsgx_ae_id_enclave rpm_libsgx_dcap_default_qpl rpm_libsgx_dcap_pccs rpm_libsgx_dcap_ql rpm_libsgx_ae_qve rpm_sgx_dcap_quote_verify rpm_sgx_pck_id_retrieval_tool_pkg rpm_sgx_ra_service_pkg +rpm_psw_pkg: rpm_libsgx_headers_pkg rpm_libsgx_pce_logic rpm_libsgx_qe3_logic rpm_sgx_aesm_service rpm_libsgx_epid rpm_libsgx_launch rpm_libsgx_quote_ex rpm_libsgx_uae_service rpm_libsgx_enclave_common rpm_libsgx_urts rpm_libsgx_ae_qe3 rpm_libsgx_ae_id_enclave rpm_libsgx_dcap_default_qpl rpm_libsgx_dcap_pccs rpm_libsgx_dcap_ql rpm_libsgx_ae_qve rpm_sgx_dcap_quote_verify rpm_sgx_pck_id_retrieval_tool_pkg rpm_sgx_ra_service_pkg rpm_libsgx_ae_tdqe rpm_libsgx_tdx_logic rpm_tdx_qgs rpm_tdx_attest endif .PHONY: rpm_local_repo @@ -354,6 +418,10 @@ ifeq ("$(shell test -f external/dcap_source/QuoteVerification/Makefile && echo M ./external/dcap_source/QuoteGeneration/installer/linux/deb/libsgx-ae-qve/clean.sh ./external/dcap_source/QuoteGeneration/installer/linux/deb/libsgx-ae-qe3/clean.sh ./external/dcap_source/QuoteGeneration/installer/linux/deb/libsgx-ae-id-enclave/clean.sh + ./external/dcap_source/QuoteGeneration/installer/linux/deb/libsgx-ae-tdqe/clean.sh + ./external/dcap_source/QuoteGeneration/installer/linux/deb/libsgx-tdx-logic/clean.sh + ./external/dcap_source/QuoteGeneration/installer/linux/deb/libtdx-attest/clean.sh + ./external/dcap_source/QuoteGeneration/installer/linux/deb/tdx-qgs/clean.sh ./external/dcap_source/QuoteGeneration/installer/linux/deb/libsgx-dcap-default-qpl/clean.sh ./external/dcap_source/QuoteGeneration/installer/linux/deb/libsgx-dcap-ql/clean.sh ./external/dcap_source/QuoteGeneration/installer/linux/deb/libsgx-pce-logic/clean.sh @@ -363,6 +431,10 @@ ifeq ("$(shell test -f external/dcap_source/QuoteVerification/Makefile && echo M ./external/dcap_source/QuoteGeneration/installer/linux/rpm/libsgx-ae-qve/clean.sh ./external/dcap_source/QuoteGeneration/installer/linux/rpm/libsgx-ae-qe3/clean.sh ./external/dcap_source/QuoteGeneration/installer/linux/rpm/libsgx-ae-id-enclave/clean.sh + ./external/dcap_source/QuoteGeneration/installer/linux/rpm/libsgx-ae-tdqe/clean.sh + ./external/dcap_source/QuoteGeneration/installer/linux/rpm/libsgx-tdx-logic/clean.sh + ./external/dcap_source/QuoteGeneration/installer/linux/rpm/libtdx-attest/clean.sh + ./external/dcap_source/QuoteGeneration/installer/linux/rpm/tdx-qgs/clean.sh ./external/dcap_source/QuoteGeneration/installer/linux/rpm/libsgx-dcap-default-qpl/clean.sh ./external/dcap_source/QuoteGeneration/installer/linux/rpm/libsgx-dcap-ql/clean.sh ./external/dcap_source/QuoteGeneration/installer/linux/rpm/libsgx-pce-logic/clean.sh diff --git a/Makefile.psw_dcap b/Makefile.psw_dcap index 3d18f679..402c907d 100644 --- a/Makefile.psw_dcap +++ b/Makefile.psw_dcap @@ -38,7 +38,7 @@ endef SGX_SDK := /tmp/intel/sgxsdk export SGX_SDK -.PHONY: build psw dcap install clean sdk install_sdk +.PHONY: build psw dcap install clean sdk install_sdk ippcp build: psw dcap @@ -55,11 +55,15 @@ clean: @$(MAKE) -C psw/ clean @$(MAKE) -C external/dcap_source/ clean @$(MAKE) -C sdk/ clean + @$(MAKE) -C external/ippcp_internal/ clean ifneq ($(call DIR_EXISTS,$(SGX_SDK)),) $(SGX_SDK)/uninstall.sh endif -sdk: +ippcp: + $(MAKE) -C external/ippcp_internal/ + +sdk: ippcp $(MAKE) -C sdk/ USE_OPT_LIBS=$(USE_OPT_LIBS) $(MAKE) -C external/dcap_source/QuoteVerification/dcap_tvl clean $(MAKE) -C external/dcap_source/QuoteVerification/dcap_tvl diff --git a/README.md b/README.md index 02e115e5..2b6af8ab 100644 --- a/README.md +++ b/README.md @@ -42,7 +42,7 @@ The [SGXDataCenterAttestationPrimitives](https://github.com/intel/SGXDataCenterA **Note**: Ice Lake Xeon-SP (and the future Xeon-SP platforms) doesn't support EPID attestation. -The [linux-sgx-driver](https://github.com/01org/linux-sgx-driver) project hosts the other out-of-tree driver for the Linux\* Intel(R) SGX software stack, which will be used until the driver upstreaming process is complete. It is used to support Enhanced Privacy Identification (EPID) based attestation on the platforms without *Flexible Launch Control*. +The [linux-sgx-driver](https://github.com/01org/linux-sgx-driver) project hosts the other out-of-tree driver for the Linux\* Intel(R) SGX software stack, which will be used until the driver upstreaming process is complete. It is used to support Enhanced Privacy Identification (EPID) based attestation on the platforms without *Flexible Launch Control*. The [intel-device-plugins-for-kubernetes](https://github.com/intel/intel-device-plugins-for-kubernetes) project enables users to run container applications running Intel(R) SGX enclaves in Kubernetes clusters. It also gives instructions how to set up ECDSA based attestation in a cluster. @@ -77,16 +77,16 @@ $ cd docker/build && ./build_compose_run.sh ``` $ cd linux/installer/docker && ./build_compose_run.sh ``` - + Build and Install the Intel(R) SGX Driver ----------------------------------------- -Follow the [README.md](https://github.com/intel/SGXDataCenterAttestationPrimitives/blob/master/driver/linux/README.md) in the [SGXDataCenterAttestationPrimitives](https://github.com/intel/SGXDataCenterAttestationPrimitives/) project to build and install the Intel(R) SGX driver. +Follow the [README.md](https://github.com/intel/SGXDataCenterAttestationPrimitives/blob/master/driver/linux/README.md) in the [SGXDataCenterAttestationPrimitives](https://github.com/intel/SGXDataCenterAttestationPrimitives/) project to build and install the Intel(R) SGX driver. **NOTE**: The above Intel(R) SGX driver requires *Flexible Launch Control* and *Intel(R) AES New Instructions* support. If your platform doesn't meet the requirement, please follow the instructions in the [linux-sgx-driver](https://github.com/01org/linux-sgx-driver) project to build and install this version of Intel(R) SGX driver. Build the Intel(R) SGX SDK and Intel(R) SGX PSW Package ------------------------------------------------------- ### Prerequisites: -- Ensure that you have one of the following required operating systems: +- Ensure that you have one of the following required operating systems: * Ubuntu\* 18.04 LTS Desktop 64bits * Ubuntu\* 18.04 LTS Server 64bits * Ubuntu\* 20.04 LTS Desktop 64bits @@ -94,7 +94,7 @@ Build the Intel(R) SGX SDK and Intel(R) SGX PSW Package * Red Hat Enterprise Linux Server release 8.4 64bits * CentOS Stream 8 64bits -- Use the following command(s) to install the required tools to build the Intel(R) SGX SDK: +- Use the following command(s) to install the required tools to build the Intel(R) SGX SDK: * On Ubuntu 18.04: ``` $ sudo apt-get install build-essential ocaml ocamlbuild automake autoconf libtool wget python libssl-dev git cmake perl @@ -112,23 +112,27 @@ Build the Intel(R) SGX SDK and Intel(R) SGX PSW Package * On CentOS Stream 8: ``` $ sudo dnf group install 'Development Tools' - $ sudo dnf --enablerepo=PowerTools install ocaml ocaml-ocamlbuild redhat-rpm-config openssl-devel wget rpm-build git cmake perl python2 + $ sudo dnf --enablerepo=powertools install ocaml ocaml-ocamlbuild redhat-rpm-config openssl-devel wget rpm-build git cmake perl python2 $ sudo alternatives --set python /usr/bin/python2 ``` **Note**: To build Intel(R) SGX SDK, gcc version is required to be 7.3 or above and glibc version is required to be 2.27 or above. -- Use the following command to install additional required tools and latest Intel(R) SGX SDK Installer to build the Intel(R) SGX PSW: +- Use the following command to install additional required tools and latest Intel(R) SGX SDK Installer to build the Intel(R) SGX PSW: 1) To install the additional required tools: - * On Ubuntu 18.04 and Ubuntu 20.04: + * On Ubuntu 18.04: ``` - $ sudo apt-get install libssl-dev libcurl4-openssl-dev protobuf-compiler libprotobuf-dev debhelper cmake reprepro unzip + $ sudo apt-get install libssl-dev libcurl4-openssl-dev protobuf-compiler libprotobuf-dev debhelper cmake reprepro unzip lsb-release + ``` + * On Ubuntu 20.04: + ``` + $ sudo apt-get install libssl-dev libcurl4-openssl-dev protobuf-compiler libprotobuf-dev debhelper cmake reprepro unzip pkgconf libboost-dev libboost-system-dev protobuf-c-compiler libprotobuf-c-dev lsb-release ``` * On Red Hat Enterprise Linux 8.4: ``` - $ sudo yum install openssl-devel libcurl-devel protobuf-devel cmake rpm-build createrepo yum-utils + $ sudo yum install openssl-devel libcurl-devel protobuf-devel cmake rpm-build createrepo yum-utils pkgconf boost-devel protobuf-lite-devel protobuf-c-compiler protobuf-c-devel ``` * On CentOS Stream 8: ``` - $ sudo dnf --enablerepo=PowerTools install openssl-devel libcurl-devel protobuf-devel cmake rpm-build createrepo yum-utils + $ sudo dnf --enablerepo=powertools install openssl-devel libcurl-devel protobuf-devel cmake rpm-build createrepo yum-utils pkgconf boost-devel protobuf-lite-devel protobuf-c-compiler protobuf-c-devel ``` 2) To install latest Intel(R) SGX SDK Installer Ensure that you have downloaded latest Intel(R) SGX SDK Installer from the [Intel(R) SGX SDK](https://software.intel.com/en-us/sgx-sdk/download) and followed the Installation Guide in the same page to install latest Intel(R) SGX SDK Installer. @@ -138,7 +142,7 @@ Build the Intel(R) SGX SDK and Intel(R) SGX PSW Package $ git clone https://github.com/intel/linux-sgx.git $ cd linux-sgx && make preparation ``` - The above ``make preparation`` would trigger the script ``download_prebuilt.sh`` to download the prebuilt binaries. You may need to set an https proxy for the `wget` tool used by the script (such as ``export https_proxy=http://test-proxy:test-port``) + The above ``make preparation`` would trigger the script ``download_prebuilt.sh`` to download the prebuilt binaries. You may need to set an https proxy for the `wget` tool used by the script (such as ``export https_proxy=http://test-proxy:test-port``) - Copy the mitigation tools corresponding to current OS distribution from external/toolset/{current_distr} to /usr/local/bin and make sure they have execute permission: ``` @@ -152,28 +156,28 @@ Build the Intel(R) SGX SDK and Intel(R) SGX PSW Package - To build Intel(R) SGX SDK with default configuration, enter the following command: ``` $ make sdk -``` +``` You can find the three flavors of tools and libraries generated in the `build` directory. - This repository supports to build the Intel(R) SGX SDK with below three combinations: * `USE_OPT_LIBS=0` --- build SDK using SGXSSL and open sourced String/Math * `USE_OPT_LIBS=1` --- build SDK using optimized IPP crypto and open sourced String/Math - * `USE_OPT_LIBS=2` --- build SDK with no mitigation using SGXSSL and optimized String/Math - * `USE_OPT_LIBS=3` --- build SDK with no mitigation using IPP crypto and optimized String/Math + * `USE_OPT_LIBS=2` --- build SDK with no mitigation using SGXSSL and optimized String/Math + * `USE_OPT_LIBS=3` --- build SDK with no mitigation using IPP crypto and optimized String/Math The default build uses `USE_OPT_LIBS=1`, if you directly type `$ make sdk` as above. You can switch to the other build combinations instead by entering the following command: ``` $ make sdk USE_OPT_LIBS=0 ``` -or +or ``` $ make sdk_no_mitigation USE_OPT_LIBS=2 ``` -or +or ``` $ make sdk_no_mitigation USE_OPT_LIBS=3 ``` - **Note**: Building the Intel(R) SGX PSW with open sourced SGXSSL/string/math libraries is not supported. + **Note**: Building the Intel(R) SGX PSW with open sourced SGXSSL/string/math libraries is not supported. **Note**: Building mitigation SDK with `USE_OPT_LIBS=2` or `USE_OPT_LIBS=3` is not allowed. - To build Intel(R) SGX SDK with debug information, enter the following command: @@ -181,7 +185,7 @@ or $ make sdk DEBUG=1 ``` -- To clean the files generated by previous `make sdk` command, enter the following command: +- To clean the files generated by previous `make sdk` command, enter the following command: ``` $ make clean ``` @@ -202,12 +206,12 @@ You can find the generated Intel(R) SGX SDK installer ``sgx_linux_x64_sdk_${vers $ make psw ``` You can find the tools and libraries generated in the `build/linux` directory. - **Note**: You can also go to the `psw` folder and use the `make` command to build the Intel(R) SGX PSW component only. + **Note**: You can also go to the `psw` folder and use the `make` command to build the Intel(R) SGX PSW component only. - To build Intel(R) SGX PSW with debug information, enter the following command: ``` $ make psw DEBUG=1 ``` -- To clean the files generated by previous `make psw` command, enter the following command: +- To clean the files generated by previous `make psw` command, enter the following command: ``` $ make clean ``` @@ -216,7 +220,7 @@ You can find the tools and libraries generated in the `build/linux` directory. ``` $ cd psw/ae/le $ make -``` +``` - To build the Intel(R) SGX PSW installer, enter the following command: * On Ubuntu 18.04 and Ubuntu 20.04: ``` @@ -224,7 +228,7 @@ You can find the tools and libraries generated in the `build/linux` directory. ``` You can find the generated Intel(R) SGX PSW installers located under `linux/installer/deb/libsgx-urts`, `linux/installer/deb/libsgx-enclave-common`, `linux/installer/deb/libsgx-uae-service`, `linux/installer/deb/libsgx-epid`, `linux/installer/deb/libsgx-launch`, `linux/installer/deb/libsgx-quote-ex` and `linux/installer/deb/sgx-aesm-service` respectively. - **Note**: On Ubuntu 18.04 and Ubuntu 20.04, besides the Intel(R) SGX PSW installer, the above command generates another debug symbol package named ``package-name-dbgsym_${version}-${revision}_amd64.ddeb`` for debug purpose. + **Note**: On Ubuntu 18.04 and Ubuntu 20.04, besides the Intel(R) SGX PSW installer, the above command generates another debug symbol package named ``package-name-dbgsym_${version}-${revision}_amd64.ddeb`` for debug purpose. **Note**: Starting with the 2.10 release, besides the Intel(R) SGX PSW installer, the above command generates [SGXDataCenterAttestationPrimitives](https://github.com/intel/SGXDataCenterAttestationPrimitives/) installers as well. **Note**: The above command builds the Intel(R) SGX PSW with default configuration firstly and then generates the target PSW Installer. To build the Intel(R) SGX PSW Installer without optimization and with full debug information kept in the tools and libraries, enter the following command: @@ -247,11 +251,11 @@ You can find the tools and libraries generated in the `build/linux` directory. $ make deb_local_repo ``` You can find the local package repository located under `linux/installer/deb/sgx_debian_local_repo`. - + **Note**: The above command builds the local package repository. If you want to use it, you need to add it to the system repository configuration. The local package repository is not signed, you need to trust it for the purpose of development. - To add the local Debian package repository to the system repository configuration, append the following line to /etc/apt/sources.list. You need to replace PATH_TO_LOCAL_REPO with the proper path on your system: - + * On Ubuntu 18.04: ``` deb [trusted=yes arch=amd64] file:/PATH_TO_LOCAL_REPO bionic main @@ -271,7 +275,7 @@ You can find the tools and libraries generated in the `build/linux` directory. $ make rpm_local_repo ``` You can find the local package repository located under `linux/installer/rpm/sgx_rpm_local_repo`. - + **Note**: The above command builds the local package repository. If you want to use it, you need to add it to the system repository configuration. Since the local package repository is not signed with GPG, you should ignore the gpgcheck when installing the packages. - To add the local RPM package repository to the system repository configuration, you can use the following command. You need to replace PATH_TO_LOCAL_REPO with the proper path on your system: @@ -288,7 +292,7 @@ You can find the tools and libraries generated in the `build/linux` directory. Install the Intel(R) SGX SDK ------------------------ ### Prerequisites -- Ensure that you have one of the following operating systems: +- Ensure that you have one of the following operating systems: * Ubuntu\* 18.04 LTS Desktop 64bits * Ubuntu\* 18.04 LTS Server 64bits * Ubuntu\* 20.04 LTS Desktop 64bits @@ -297,14 +301,14 @@ Install the Intel(R) SGX SDK * CentOS Stream 8 64bits - Use the following command to install the required tool to use Intel(R) SGX SDK: * On Ubuntu 18.04 and Ubuntu 20.04: - ``` + ``` $ sudo apt-get install build-essential python ``` * On Red Hat Enterprise Linux 8.4 and CentOS Stream 8: ``` $ sudo yum groupinstall 'Development Tools' $ sudo yum install python2 - $ sudo alternatives --set python /usr/bin/python2 + $ sudo alternatives --set python /usr/bin/python2 ``` ### Install the Intel(R) SGX SDK @@ -313,7 +317,7 @@ To install the Intel(R) SGX SDK, invoke the installer, as follows: $ cd linux/installer/bin $ ./sgx_linux_x64_sdk_${version}.bin ``` -The above command requires you to specify the installation path. You can use the following command +The above command requires you to specify the installation path. You can use the following command to use the non-interactive installation mode: ``` $ cd linux/installer/bin @@ -325,7 +329,7 @@ NOTE: You need to set up the needed environment variables before compiling your ``` ### Test the Intel(R) SGX SDK Package with the Code Samples -- Compile and run each code sample in Simulation mode to make sure the package works well: +- Compile and run each code sample in Simulation mode to make sure the package works well: ``` $ cd ${sgx-sdk-install-path}/SampleCode/LocalAttestation $ make SGX_MODE=SIM @@ -336,10 +340,10 @@ NOTE: You need to set up the needed environment variables before compiling your ### Compile and Run the Code Samples in the Hardware Mode If you use an Intel SGX hardware enabled machine, you can run the code samples in Hardware mode. -Ensure that you install Intel(R) SGX driver and Intel(R) SGX PSW installer on the machine. -See the earlier topic, *Build and Install the Intel(R) SGX Driver*, for information on how to install the Intel(R) SGX driver. +Ensure that you install Intel(R) SGX driver and Intel(R) SGX PSW installer on the machine. +See the earlier topic, *Build and Install the Intel(R) SGX Driver*, for information on how to install the Intel(R) SGX driver. See the later topic, *Install Intel(R) SGX PSW*, for information on how to install the PSW package. -- Compile and run each code sample in Hardware mode, Debug build, as follows: +- Compile and run each code sample in Hardware mode, Debug build, as follows: ``` $ cd ${sgx-sdk-install-path}/SampleCode/LocalAttestation $ make @@ -352,23 +356,23 @@ See the later topic, *Install Intel(R) SGX PSW*, for information on how to insta Install the Intel(R) SGX PSW ---------------------------- ### Prerequisites -- Ensure that you have one of the following operating systems: +- Ensure that you have one of the following operating systems: * Ubuntu\* 18.04 LTS Desktop 64bits * Ubuntu\* 18.04 LTS Server 64bits * Ubuntu\* 20.04 LTS Desktop 64bits * Ubuntu\* 20.04 LTS Server 64bits * Red Hat Enterprise Linux Server release 8.4 64bits * CentOS Stream 8 64bits -- Ensure that you have a system with the following required hardware: +- Ensure that you have a system with the following required hardware: * 6th Generation Intel(R) Core(TM) Processor or newer -- Configure the system with the **Intel SGX hardware enabled** option and install Intel(R) SGX driver in advance. +- Configure the system with the **Intel SGX hardware enabled** option and install Intel(R) SGX driver in advance. See the earlier topic, *Build and Install the Intel(R) SGX Driver*, for information on how to install the Intel(R) SGX driver. -- Install the library using the following command: +- Install the library using the following command: * On Ubuntu 18.04 and Ubuntu 20.04: ``` $ sudo apt-get install libssl-dev libcurl4-openssl-dev libprotobuf-dev ``` - * On Red Hat Enterprise Linux 8.4: + * On Red Hat Enterprise Linux 8.4: ``` $ sudo yum install openssl-devel libcurl-devel protobuf-devel ``` @@ -378,7 +382,7 @@ Install the Intel(R) SGX PSW ``` ### Install the Intel(R) SGX PSW -The SGX PSW provides 3 services: launch, EPID-based attestation, and algorithm agnostic attestation. Starting with the 2.8 release, the SGX PSW is split into smaller packages and the user can choose which features and services to install. There are 2 methods to install the required packages: Using individual packages or using the local repo generated by the build system. Using the local repo is recommended since the system will resolve the dependencies automatically. Currently, we support .deb and .rpm based repos. +The SGX PSW provides 3 services: launch, EPID-based attestation, and algorithm agnostic attestation. Starting with the 2.8 release, the SGX PSW is split into smaller packages and the user can choose which features and services to install. There are 2 methods to install the required packages: Using individual packages or using the local repo generated by the build system. Using the local repo is recommended since the system will resolve the dependencies automatically. Currently, we support .deb and .rpm based repos. #### Using the local repo(recommended) @@ -413,7 +417,7 @@ Some packages are configured with recommended dependency on other packages that ``` ### ECDSA attestation -To enable ECDSA attestation +To enable ECDSA attestation - Ensure that you have the following required hardware: * 8th Generation Intel(R) Core(TM) Processor or newer with **Flexible Launch Control** support* * Intel(R) Atom(TM) Processor with **Flexible Launch Control** support* @@ -429,15 +433,15 @@ Service, please refer to [SGXDataCenterAttestationPrimitives](https://github.com - Ensure the PCK Caching Service is setup correctly by local administrator or data center administrator. Also make sure that the configure file of quote provider library (/etc/sgx_default_qcnl.conf) is consistent with the real environment, for example: PCS_URL=https://your_pcs_server:8081/sgx/certification/v1/ ### Start or Stop aesmd Service -The Intel(R) SGX PSW installer installs an aesmd service in your machine, which is running in a special linux account `aesmd`. -To stop the service: `$ sudo service aesmd stop` -To start the service: `$ sudo service aesmd start` +The Intel(R) SGX PSW installer installs an aesmd service in your machine, which is running in a special linux account `aesmd`. +To stop the service: `$ sudo service aesmd stop` +To start the service: `$ sudo service aesmd start` To restart the service: `$ sudo service aesmd restart` ### Configure the Proxy for aesmd Service -The aesmd service uses the HTTP protocol to initialize some services. -If a proxy is required for the HTTP protocol, you may need to manually set up the proxy for the aesmd service. -You should manually edit the file `/etc/aesmd.conf` (refer to the comments in the file) to set the proxy for the aesmd service. +The aesmd service uses the HTTP protocol to initialize some services. +If a proxy is required for the HTTP protocol, you may need to manually set up the proxy for the aesmd service. +You should manually edit the file `/etc/aesmd.conf` (refer to the comments in the file) to set the proxy for the aesmd service. After you configure the proxy, you need to restart the service to enable the proxy. Reproducibility diff --git a/SampleCode/Cxx11SGXDemo/App/App.cpp b/SampleCode/Cxx11SGXDemo/App/App.cpp index cc928657..f44b435d 100644 --- a/SampleCode/Cxx11SGXDemo/App/App.cpp +++ b/SampleCode/Cxx11SGXDemo/App/App.cpp @@ -132,6 +132,11 @@ static sgx_errlist_t sgx_errlist[] = { "The enclave is signed as product enclave, and can not be created as debuggable enclave.", NULL }, + { + SGX_ERROR_MEMORY_MAP_FAILURE, + "Failed to reserve memory for the enclave.", + NULL + }, }; /* Check error conditions for loading enclave */ diff --git a/SampleCode/Cxx11SGXDemo/Enclave/Enclave.cpp b/SampleCode/Cxx11SGXDemo/Enclave/Enclave.cpp index 6d58d9f8..a76eb6e8 100644 --- a/SampleCode/Cxx11SGXDemo/Enclave/Enclave.cpp +++ b/SampleCode/Cxx11SGXDemo/Enclave/Enclave.cpp @@ -39,7 +39,7 @@ * printf: * Invokes OCALL to display the enclave buffer to the terminal. */ -void printf(const char *fmt, ...) +int printf(const char *fmt, ...) { char buf[BUFSIZ] = {'\0'}; va_list ap; @@ -47,4 +47,5 @@ void printf(const char *fmt, ...) vsnprintf(buf, BUFSIZ, fmt, ap); va_end(ap); ocall_print_string(buf); + return 0; } diff --git a/SampleCode/Cxx11SGXDemo/Enclave/Enclave.h b/SampleCode/Cxx11SGXDemo/Enclave/Enclave.h index ed0084b5..ea8be2c7 100644 --- a/SampleCode/Cxx11SGXDemo/Enclave/Enclave.h +++ b/SampleCode/Cxx11SGXDemo/Enclave/Enclave.h @@ -39,7 +39,7 @@ extern "C" { #endif -void printf(const char *fmt, ...); +int printf(const char *fmt, ...); #if defined(__cplusplus) } diff --git a/SampleCode/Cxx11SGXDemo/Makefile b/SampleCode/Cxx11SGXDemo/Makefile index b2f262de..3ff689ad 100644 --- a/SampleCode/Cxx11SGXDemo/Makefile +++ b/SampleCode/Cxx11SGXDemo/Makefile @@ -129,7 +129,7 @@ Crypto_Library_Name := sgx_tcrypto Enclave_Cpp_Files := Enclave/Enclave.cpp $(wildcard Enclave/TrustedLibrary/*.cpp) Enclave_Include_Paths := -IEnclave -I$(SGX_SDK)/include -I$(SGX_SDK)/include/libcxx -I$(SGX_SDK)/include/tlibc -Enclave_C_Flags := -nostdinc -fvisibility=hidden -fpie -fstack-protector $(Enclave_Include_Paths) +Enclave_C_Flags := -nostdinc -fvisibility=hidden -fpie -fstack-protector -fno-builtin-printf $(Enclave_Include_Paths) Enclave_Cpp_Flags := $(Enclave_C_Flags) -nostdinc++ # Enable the security flags diff --git a/SampleCode/Cxx14SGXDemo/App/App.cpp b/SampleCode/Cxx14SGXDemo/App/App.cpp index 62a8dded..59cdfbef 100644 --- a/SampleCode/Cxx14SGXDemo/App/App.cpp +++ b/SampleCode/Cxx14SGXDemo/App/App.cpp @@ -132,6 +132,11 @@ static sgx_errlist_t sgx_errlist[] = { "The enclave is signed as product enclave, and can not be created as debuggable enclave.", NULL }, + { + SGX_ERROR_MEMORY_MAP_FAILURE, + "Failed to reserve memory for the enclave.", + NULL + }, }; /* Check error conditions for loading enclave */ diff --git a/SampleCode/Cxx14SGXDemo/Enclave/Enclave.cpp b/SampleCode/Cxx14SGXDemo/Enclave/Enclave.cpp index 6d58d9f8..a76eb6e8 100644 --- a/SampleCode/Cxx14SGXDemo/Enclave/Enclave.cpp +++ b/SampleCode/Cxx14SGXDemo/Enclave/Enclave.cpp @@ -39,7 +39,7 @@ * printf: * Invokes OCALL to display the enclave buffer to the terminal. */ -void printf(const char *fmt, ...) +int printf(const char *fmt, ...) { char buf[BUFSIZ] = {'\0'}; va_list ap; @@ -47,4 +47,5 @@ void printf(const char *fmt, ...) vsnprintf(buf, BUFSIZ, fmt, ap); va_end(ap); ocall_print_string(buf); + return 0; } diff --git a/SampleCode/Cxx14SGXDemo/Enclave/Enclave.h b/SampleCode/Cxx14SGXDemo/Enclave/Enclave.h index ed0084b5..ea8be2c7 100644 --- a/SampleCode/Cxx14SGXDemo/Enclave/Enclave.h +++ b/SampleCode/Cxx14SGXDemo/Enclave/Enclave.h @@ -39,7 +39,7 @@ extern "C" { #endif -void printf(const char *fmt, ...); +int printf(const char *fmt, ...); #if defined(__cplusplus) } diff --git a/SampleCode/Cxx14SGXDemo/Makefile b/SampleCode/Cxx14SGXDemo/Makefile index bca55648..4f9be8d9 100644 --- a/SampleCode/Cxx14SGXDemo/Makefile +++ b/SampleCode/Cxx14SGXDemo/Makefile @@ -129,7 +129,7 @@ Crypto_Library_Name := sgx_tcrypto Enclave_Cpp_Files := Enclave/Enclave.cpp $(wildcard Enclave/TrustedLibrary/*.cpp) Enclave_Include_Paths := -IEnclave -I$(SGX_SDK)/include -I$(SGX_SDK)/include/libcxx -I$(SGX_SDK)/include/tlibc -Enclave_C_Flags := -nostdinc -fvisibility=hidden -fpie -fstack-protector $(Enclave_Include_Paths) +Enclave_C_Flags := -nostdinc -fvisibility=hidden -fpie -fstack-protector -fno-builtin-printf $(Enclave_Include_Paths) Enclave_Cpp_Flags := $(Enclave_C_Flags) -nostdinc++ # Enable the security flags diff --git a/SampleCode/PowerTransition/App/ErrorSupport.cpp b/SampleCode/PowerTransition/App/ErrorSupport.cpp index 4142ab02..a1442b57 100644 --- a/SampleCode/PowerTransition/App/ErrorSupport.cpp +++ b/SampleCode/PowerTransition/App/ErrorSupport.cpp @@ -51,6 +51,7 @@ static sgx_errlist_t sgx_errlist[] = { {SGX_ERROR_OUT_OF_EPC, "Out of EPC memory."}, {SGX_ERROR_NO_DEVICE, "Invalid SGX device."}, {SGX_ERROR_MEMORY_MAP_CONFLICT, "Memory map conflicted."}, + {SGX_ERROR_MEMORY_MAP_FAILURE, "Failed to reserve memory for the enclave."}, {SGX_ERROR_INVALID_METADATA, "Invalid encalve metadata."}, {SGX_ERROR_DEVICE_BUSY, "SGX device is busy."}, {SGX_ERROR_INVALID_VERSION, "Enclave metadata version is invalid."}, diff --git a/SampleCode/PowerTransition/Enclave/Enclave.cpp b/SampleCode/PowerTransition/Enclave/Enclave.cpp index 53d3a1f6..1fb746cb 100644 --- a/SampleCode/PowerTransition/Enclave/Enclave.cpp +++ b/SampleCode/PowerTransition/Enclave/Enclave.cpp @@ -149,7 +149,7 @@ int increase_and_seal_data(size_t tid, struct sealed_buf_t* sealed_buf) return -1; } // Backup the sealed data to outside buffer - memcpy(sealed_buf->sealed_buf_ptr[MOD2(sealed_buf->index + 1)], temp_sealed_buf, sealed_len); + memcpy_verw(sealed_buf->sealed_buf_ptr[MOD2(sealed_buf->index + 1)], temp_sealed_buf, sealed_len); sealed_buf->index++; sgx_thread_mutex_unlock(&g_mutex); diff --git a/SampleCode/ProtobufSGXDemo/App/App.cpp b/SampleCode/ProtobufSGXDemo/App/App.cpp index 58b74b41..ae7f2f31 100644 --- a/SampleCode/ProtobufSGXDemo/App/App.cpp +++ b/SampleCode/ProtobufSGXDemo/App/App.cpp @@ -132,6 +132,11 @@ static sgx_errlist_t sgx_errlist[] = { "The enclave is signed as product enclave, and can not be created as debuggable enclave.", NULL }, + { + SGX_ERROR_MEMORY_MAP_FAILURE, + "Failed to reserve memory for the enclave.", + NULL + }, }; /* Check error conditions for loading enclave */ diff --git a/SampleCode/ProtobufSGXDemo/Enclave/Enclave.cpp b/SampleCode/ProtobufSGXDemo/Enclave/Enclave.cpp index b32697f6..5cf0e308 100644 --- a/SampleCode/ProtobufSGXDemo/Enclave/Enclave.cpp +++ b/SampleCode/ProtobufSGXDemo/Enclave/Enclave.cpp @@ -39,7 +39,7 @@ * Invokes OCALL to display the enclave buffer to the terminal. * 'printf' function is required for sgx protobuf logging module. */ -void printf(const char *fmt, ...) +int printf(const char *fmt, ...) { char buf[BUFSIZ] = {'\0'}; va_list ap; @@ -47,6 +47,7 @@ void printf(const char *fmt, ...) vsnprintf(buf, BUFSIZ, fmt, ap); va_end(ap); ocall_print_string(buf); + return 0; } void ecall_person() diff --git a/SampleCode/ProtobufSGXDemo/Enclave/Enclave.h b/SampleCode/ProtobufSGXDemo/Enclave/Enclave.h index ed0084b5..ea8be2c7 100644 --- a/SampleCode/ProtobufSGXDemo/Enclave/Enclave.h +++ b/SampleCode/ProtobufSGXDemo/Enclave/Enclave.h @@ -39,7 +39,7 @@ extern "C" { #endif -void printf(const char *fmt, ...); +int printf(const char *fmt, ...); #if defined(__cplusplus) } diff --git a/SampleCode/SampleAttestedTLS/client/enc/openssl_client.cpp b/SampleCode/SampleAttestedTLS/client/enc/openssl_client.cpp index 482de713..36b57bc9 100644 --- a/SampleCode/SampleAttestedTLS/client/enc/openssl_client.cpp +++ b/SampleCode/SampleAttestedTLS/client/enc/openssl_client.cpp @@ -118,7 +118,7 @@ int communicate_with_server(SSL* ssl) SERVER_PAYLOAD_SIZE, bytes_read); ret = bytes_read; - goto done; + break; } else { @@ -128,7 +128,6 @@ int communicate_with_server(SSL* ssl) break; } } while (1); - ret = 0; done: return ret; } @@ -137,12 +136,8 @@ done: int create_socket(char* server_name, char* server_port) { int sockfd = -1; - char* addr_ptr = nullptr; - int port = 0; struct sockaddr_in dest_sock; - //struct addrinfo dest_info;//hints, *dest_info = nullptr, *curr_di = nullptr; int res = -1; - char *err_str = nullptr; sockfd = socket(AF_INET, SOCK_STREAM, 0); if (sockfd == -1) @@ -151,14 +146,14 @@ int create_socket(char* server_name, char* server_port) goto done; } - dest_sock.sin_family = AF_INET; - dest_sock.sin_port = htons(atoi(server_port)); - dest_sock.sin_addr.s_addr = inet_addr2(server_name); - bzero(&(dest_sock.sin_zero), sizeof(dest_sock.sin_zero)); + dest_sock.sin_family = AF_INET; + dest_sock.sin_port = htons(atoi(server_port)); + dest_sock.sin_addr.s_addr = inet_addr2(server_name); + bzero(&(dest_sock.sin_zero), sizeof(dest_sock.sin_zero)); - if (connect( - sockfd, (sockaddr*) &dest_sock, - sizeof(struct sockaddr)) == -1) + if (connect( + sockfd, (sockaddr*) &dest_sock, + sizeof(struct sockaddr)) == -1) { t_print( TLS_CLIENT "failed to connect to %s:%s (errno=%d)\n", @@ -166,8 +161,8 @@ int create_socket(char* server_name, char* server_port) server_port, errno); ocall_close(&res, sockfd); - if (res != 0) - t_print(TLS_CLIENT "OCALL: error closing socket\n"); + if (res != 0) + t_print(TLS_CLIENT "OCALL: error closing socket\n"); sockfd = -1; goto done; } @@ -266,13 +261,13 @@ int launch_tls_client(char* server_name, char* server_port) done: if (client_socket != -1) - { + { ocall_close(&ret, client_socket); - if (ret != 0) - t_print(TLS_CLIENT "OCALL: error close socket\n"); - } + if (ret != 0) + t_print(TLS_CLIENT "OCALL: error close socket\n"); + } - if (ssl_session) + if (ssl_session) { SSL_shutdown(ssl_session); SSL_free(ssl_session); diff --git a/SampleCode/SampleAttestedTLS/client/host/host.cpp b/SampleCode/SampleAttestedTLS/client/host/host.cpp index bcdf0f38..b8efbb76 100644 --- a/SampleCode/SampleAttestedTLS/client/host/host.cpp +++ b/SampleCode/SampleAttestedTLS/client/host/host.cpp @@ -152,9 +152,9 @@ sgx_status_t initialize_enclave(const char *enclave_path) if (ret != SGX_SUCCESS) { - print_error_message(ret); - return ret; - } + print_error_message(ret); + return ret; + } return ret; } @@ -166,14 +166,8 @@ void terminate_enclave() int main(int argc, const char* argv[]) { - uint8_t* encrypted_msg = NULL; - size_t encrypted_msg_size = 0; sgx_status_t result = SGX_SUCCESS; int ret = 1; - uint8_t* pem_key = NULL; - size_t pem_key_size = 0; - uint8_t* remote_report = NULL; - size_t remote_report_size = 0; char* server_name = NULL; char* server_port = NULL; @@ -229,7 +223,7 @@ int main(int argc, const char* argv[]) printf("Host: launch TLS client to initiate TLS connection\n"); result = launch_tls_client(client_global_eid, &ret, server_name, server_port); - if (ret != 0) + if (result != SGX_SUCCESS || ret != 0) { printf("Host: launch_tls_client failed\n"); goto exit; @@ -237,7 +231,7 @@ int main(int argc, const char* argv[]) ret = 0; exit: - terminate_enclave(); + terminate_enclave(); printf("Host: %s \n", (ret == 0) ? "succeeded" : "failed"); return ret; diff --git a/SampleCode/SampleAttestedTLS/client/tls_client.edl b/SampleCode/SampleAttestedTLS/client/tls_client.edl index dadc3e36..74d71c63 100644 --- a/SampleCode/SampleAttestedTLS/client/tls_client.edl +++ b/SampleCode/SampleAttestedTLS/client/tls_client.edl @@ -32,17 +32,16 @@ enclave { from "sgx_tstdc.edl" import *; - from "enclave.edl" import *; - from "sgx_socket.edl" import *; - from "sgx_tsgxssl.edl" import *; - from "sgx_ttls.edl" import *; - from "sgx_pthread.edl" import *; + from "enclave.edl" import *; + from "sgx_socket.edl" import *; + from "sgx_tsgxssl.edl" import *; + from "sgx_ttls.edl" import *; + from "sgx_pthread.edl" import *; - include "sgx_ttls.h" - trusted { - public int launch_tls_client( - [in, string] char* server_name, - [in, string] char* server_port); + include "sgx_ttls.h" + trusted { + public int launch_tls_client( + [in, string] char* server_name, + [in, string] char* server_port); }; - }; diff --git a/SampleCode/SampleAttestedTLS/common/enclave.edl b/SampleCode/SampleAttestedTLS/common/enclave.edl index 9461ca0d..6e285407 100644 --- a/SampleCode/SampleAttestedTLS/common/enclave.edl +++ b/SampleCode/SampleAttestedTLS/common/enclave.edl @@ -38,7 +38,7 @@ enclave { */ untrusted { void ocall_print_string([in, string] const char *str); - int ocall_close(int fd); - void ocall_get_current_time([out] uint64_t *p_current_time); - }; + int ocall_close(int fd); + void ocall_get_current_time([out] uint64_t *p_current_time); + }; }; diff --git a/SampleCode/SampleAttestedTLS/common/openssl_utility.cpp b/SampleCode/SampleAttestedTLS/common/openssl_utility.cpp index 705f5ff5..e2db8bc2 100644 --- a/SampleCode/SampleAttestedTLS/common/openssl_utility.cpp +++ b/SampleCode/SampleAttestedTLS/common/openssl_utility.cpp @@ -29,7 +29,7 @@ sgx_status_t generate_certificate_and_pkey(X509*& certificate, EVP_PKEY*& pkey) { quote3_error_t qresult = SGX_QL_SUCCESS; - sgx_status_t result = SGX_ERROR_UNEXPECTED; + sgx_status_t result = SGX_ERROR_UNEXPECTED; uint8_t* output_certificate = NULL; size_t output_certificate_size = 0; uint8_t* private_key_buffer = nullptr; @@ -38,15 +38,15 @@ sgx_status_t generate_certificate_and_pkey(X509*& certificate, EVP_PKEY*& pkey) size_t public_key_buffer_size = 0; const unsigned char* certificate_buffer_ptr = nullptr; BIO* mem = nullptr; - int key_type = RSA_TYPE; + int key_type = RSA_TYPE; - if (key_type) { - t_print(" generating keys by EC P-384\n"); - } - else - { - t_print(" generating keys by RSA 3072\n"); - } + if (key_type) { + t_print(" generating keys by EC P-384\n"); + } + else + { + t_print(" generating keys by RSA 3072\n"); + } result = generate_key_pair( key_type, &public_key_buffer, &public_key_buffer_size, @@ -73,8 +73,8 @@ sgx_status_t generate_certificate_and_pkey(X509*& certificate, EVP_PKEY*& pkey) if (qresult != SGX_QL_SUCCESS || output_certificate == nullptr) { - if (output_certificate == nullptr) - t_print(" null certificate\n"); + if (output_certificate == nullptr) + t_print(" null certificate\n"); p_sgx_tls_qe_err_msg(qresult); goto done; } @@ -84,7 +84,7 @@ sgx_status_t generate_certificate_and_pkey(X509*& certificate, EVP_PKEY*& pkey) // data. sending certificate_buffer_ptr as argument will keep // output_certificate pointer undisturbed. - certificate_buffer_ptr = output_certificate; + certificate_buffer_ptr = output_certificate; if ((certificate = d2i_X509( nullptr, @@ -108,11 +108,10 @@ sgx_status_t generate_certificate_and_pkey(X509*& certificate, EVP_PKEY*& pkey) result = SGX_SUCCESS; done: - if (private_key_buffer) - free(private_key_buffer); - if (public_key_buffer) - free(public_key_buffer); + free(private_key_buffer); + if (public_key_buffer) + free(public_key_buffer); certificate_buffer_ptr = nullptr; if (mem) @@ -135,11 +134,11 @@ sgx_status_t load_tls_certificates_and_keys( goto exit; } - if (certificate == nullptr) - { - t_print("null cert\n"); - goto exit; - } + if (certificate == nullptr) + { + t_print("null cert\n"); + goto exit; + } if (!SSL_CTX_use_certificate(ctx, certificate)) { @@ -249,7 +248,7 @@ int read_from_session_peer( int bytes_read = 0; do { - int len = sizeof(buffer) - 1; + unsigned int len = sizeof(buffer) - 1; memset(buffer, 0, sizeof(buffer)); bytes_read = SSL_read(ssl_session, buffer, (size_t)len); diff --git a/SampleCode/SampleAttestedTLS/common/tcommon.cpp b/SampleCode/SampleAttestedTLS/common/tcommon.cpp index ee7093b4..5e13210c 100644 --- a/SampleCode/SampleAttestedTLS/common/tcommon.cpp +++ b/SampleCode/SampleAttestedTLS/common/tcommon.cpp @@ -53,5 +53,5 @@ void t_print(const char *fmt, ...) void t_time(time_t *current_t) { - ocall_get_current_time((uint64_t*)current_t); + ocall_get_current_time((uint64_t*)current_t); } diff --git a/SampleCode/SampleAttestedTLS/common/ucommon.cpp b/SampleCode/SampleAttestedTLS/common/ucommon.cpp index 45f7ace5..52a4591a 100644 --- a/SampleCode/SampleAttestedTLS/common/ucommon.cpp +++ b/SampleCode/SampleAttestedTLS/common/ucommon.cpp @@ -40,7 +40,7 @@ int ocall_close(int fd) { - return close(fd); + return close(fd); } void ocall_get_current_time(uint64_t *p_current_time) @@ -56,5 +56,5 @@ void ocall_get_current_time(uint64_t *p_current_time) void ocall_print_string(const char *str) { - printf("%s", str); + printf("%s", str); } diff --git a/SampleCode/SampleAttestedTLS/common/utility.cpp b/SampleCode/SampleAttestedTLS/common/utility.cpp index 1df12ec9..c3850b06 100644 --- a/SampleCode/SampleAttestedTLS/common/utility.cpp +++ b/SampleCode/SampleAttestedTLS/common/utility.cpp @@ -28,8 +28,8 @@ // // Generate_Key_Pair function: -// type1: RSA -// type2: EC-P384 +// type1: RSA +// type2: EC-P384 // currently all hardware independant // #include @@ -45,26 +45,29 @@ int get_pkey_by_rsa(EVP_PKEY *pk) { - int res = -1; - RSA* rsa = nullptr; + int res = -1; + RSA* rsa = nullptr; BIGNUM* e = nullptr; - e = BN_new(); - if (!e) + e = BN_new(); + if (!e) { t_print("BN_new failed\n"); + return res; + } res = BN_set_word(e, (BN_ULONG)RSA_F4); - if (!res) { + if (!res) { t_print("BN_set_word failed (%d)\n", res); return res; - } + } rsa = RSA_new(); if (!rsa) { t_print("RSA_new failed\n"); + res = -1; return res; - } + } res = RSA_generate_key_ex( rsa, @@ -73,16 +76,16 @@ int get_pkey_by_rsa(EVP_PKEY *pk) nullptr /* callback argument - not needed in this case */ ); - if (!res) - { + if (!res) + { t_print("RSA_generate_key failed (%d)\n", res); return res; - } - - // Assign RSA key to EVP_PKEY structure + } + + // Assign RSA key to EVP_PKEY structure EVP_PKEY_assign_RSA(pk, rsa); - return res; + return res; } int get_pkey_by_ec(EVP_PKEY *pk) @@ -93,15 +96,29 @@ int get_pkey_by_ec(EVP_PKEY *pk) ctx = EVP_PKEY_CTX_new_id(EVP_PKEY_EC, NULL); if (ctx == NULL) return res; - if (EVP_PKEY_keygen_init(ctx) <= 0) + res = EVP_PKEY_keygen_init(ctx); + if (res <= 0) + { + t_print("EC_generate_key failed (%d)\n", res); return res; - if (EVP_PKEY_CTX_set_ec_paramgen_curve_nid(ctx, NID_secp384r1) <= 0) + } + + res = EVP_PKEY_CTX_set_ec_paramgen_curve_nid(ctx, NID_secp384r1); + if (res <= 0) + { + t_print("EC_generate_key failed (%d)\n", res); return res; + } /* Generate key */ - if (EVP_PKEY_keygen(ctx, &pk) <= 0) + res = EVP_PKEY_keygen(ctx, &pk); + if (res <= 0) + { + t_print("EC_generate_key failed (%d)\n", res); return res; - return 0; + } + + return res; } @@ -121,110 +138,112 @@ sgx_status_t generate_key_pair( EVP_PKEY* pkey = nullptr; BIO* bio = nullptr; - pkey = EVP_PKEY_new(); + pkey = EVP_PKEY_new(); if (!pkey) + { t_print("EVP_PKEY_new failed\n"); + result = SGX_ERROR_UNEXPECTED; + goto done; + } - if (type != RSA_TYPE || type != EC_TYPE) + if (type != RSA_TYPE && type != EC_TYPE) { type = RSA_TYPE; // by default, we use RSA_TYPE } - switch(type) - { - case RSA_TYPE: - res = get_pkey_by_rsa(pkey); - break; - case EC_TYPE: - res = get_pkey_by_ec(pkey); - break; - } + switch(type) + { + case RSA_TYPE: + res = get_pkey_by_rsa(pkey); + break; + case EC_TYPE: + res = get_pkey_by_ec(pkey); + break; + } - if (!res) - { + if (res <= 0) + { t_print("get_pkey failed (%d)\n", res); result = SGX_ERROR_UNEXPECTED; goto done; - } - + } + // Allocate memory local_public_key = (uint8_t*)malloc(RSA_3072_PUBLIC_KEY_SIZE); - memset(local_public_key, 0x00, RSA_3072_PUBLIC_KEY_SIZE); - if (!local_public_key) - { - t_print("out-of-memory:calloc(local_public_key failed\n"); - result = SGX_ERROR_UNEXPECTED; - goto done; - } + if (!local_public_key) + { + t_print("out-of-memory:calloc(local_public_key failed\n"); + result = SGX_ERROR_OUT_OF_EPC; + goto done; + } + memset(local_public_key, 0x00, RSA_3072_PUBLIC_KEY_SIZE); - local_private_key = (uint8_t*)malloc(RSA_3072_PRIVATE_KEY_SIZE); - memset(local_private_key, 0x00, RSA_3072_PRIVATE_KEY_SIZE); + local_private_key = (uint8_t*)malloc(RSA_3072_PRIVATE_KEY_SIZE); if (!local_private_key) - { - t_print("out-of-memory: calloc(local_private_key) failed\n"); - result = SGX_ERROR_UNEXPECTED; - goto done; - } + { + t_print("out-of-memory: calloc(local_private_key) failed\n"); + result = SGX_ERROR_OUT_OF_EPC; + goto done; + } + memset(local_private_key, 0x00, RSA_3072_PRIVATE_KEY_SIZE); + // Write out the public/private key in PEM format for exchange with // other enclaves. - bio = BIO_new(BIO_s_mem()); - if (!bio) - { + bio = BIO_new(BIO_s_mem()); + if (!bio) + { t_print("BIO_new for local_public_key failed\n"); goto done; - } + } res = PEM_write_bio_PUBKEY(bio, pkey); if (!res) - { - t_print("PEM_write_bio_PUBKEY failed (%d)\n", res); - goto done; - } + { + t_print("PEM_write_bio_PUBKEY failed (%d)\n", res); + goto done; + } res = BIO_read(bio, local_public_key, RSA_3072_PUBLIC_KEY_SIZE); if (!res) - { - t_print("BIO_read public key failed (%d)\n", res); - goto done; - } + { + t_print("BIO_read public key failed (%d)\n", res); + goto done; + } BIO_free(bio); bio = nullptr; bio = BIO_new(BIO_s_mem()); if (!bio) - { - t_print("BIO_new for local_public_key failed\n"); - goto done; - } + { + t_print("BIO_new for local_public_key failed\n"); + goto done; + } res = PEM_write_bio_PrivateKey( bio, pkey, nullptr, nullptr, 0, nullptr, nullptr); if (!res) - { - t_print("PEM_write_bio_PrivateKey failed (%d)\n", res); - goto done; - } + { + t_print("PEM_write_bio_PrivateKey failed (%d)\n", res); + goto done; + } res = BIO_read(bio, local_private_key, RSA_3072_PRIVATE_KEY_SIZE); if (!res) - { - t_print("BIO_read private key failed (%d)\n", res); - goto done; - } + { + t_print("BIO_read private key failed (%d)\n", res); + goto done; + } - BIO_free(bio); + BIO_free(bio); bio = nullptr; *public_key = local_public_key; - //*public_key_size = RSA_3072_PUBLIC_KEY_SIZE; *private_key = local_private_key; - // *private_key_size = RSA_3072_PRIVATE_KEY_SIZE; - - *public_key_size = strlen(reinterpret_cast(local_public_key)) + 1; + *public_key_size = strlen(reinterpret_cast(local_public_key)) + 1; *private_key_size = strlen(reinterpret_cast(local_private_key)) + 1; - t_print("public_key_size %d, private_key_size %d\n", *public_key_size, *private_key_size); + t_print("public_key_size %d, private_key_size %d\n", *public_key_size, *private_key_size); result = SGX_SUCCESS; done: @@ -232,10 +251,12 @@ done: BIO_free(bio); if (pkey) EVP_PKEY_free(pkey); // When this is called, rsa is also freed - if (result != SGX_SUCCESS) + if (result != SGX_SUCCESS) { - free(local_public_key); - free(local_private_key); - } + if (local_public_key) + free(local_public_key); + if (local_private_key) + free(local_private_key); + } return result; } diff --git a/SampleCode/SampleAttestedTLS/common/verify_callback.cpp b/SampleCode/SampleAttestedTLS/common/verify_callback.cpp index 77b4b984..90e636ae 100644 --- a/SampleCode/SampleAttestedTLS/common/verify_callback.cpp +++ b/SampleCode/SampleAttestedTLS/common/verify_callback.cpp @@ -80,12 +80,12 @@ int verify_callback(int preverify_ok, X509_STORE_CTX* ctx) // convert a cert into a buffer in DER format der_len = i2d_X509(crt, nullptr); - if (der_len <= 0) { - PRINT(TLS_CLIENT "i2d_X509 failed(der_len=%d)\n", der_len); + if (der_len <= 0) { + PRINT(TLS_CLIENT "i2d_X509 failed(der_len=%d)\n", der_len); goto done; - } + } - buff = (unsigned char*)malloc(der_len); + buff = (unsigned char*)malloc(der_len); if (buff == nullptr) { PRINT(TLS_CLIENT "malloc failed (der_len=%d)\n", der_len); @@ -115,11 +115,11 @@ int verify_callback(int preverify_ok, X509_STORE_CTX* ctx) GETCURRTIME(¤t_time); // verify tls certificate - result = VERIFY_CALLBACK( - der, der_len, current_time, &qv_result, &sup_data, (uint32_t *)&sup_data_len); + result = VERIFY_CALLBACK( + der, der_len, current_time, &qv_result, &sup_data, (uint32_t *)&sup_data_len); // result != SGX_QL_SUCCESS means critical error - if (result != SGX_QL_SUCCESS) + if (result != SGX_QL_SUCCESS) { PRINT(TLS_CLIENT "Quote Verification Failed with result(%x) - \n", result); p_sgx_tls_qe_err_msg(result); @@ -136,10 +136,10 @@ int verify_callback(int preverify_ok, X509_STORE_CTX* ctx) } } - FREE_SUPDATA(sup_data); + FREE_SUPDATA(sup_data); PRINT(" verifying certificate end\n"); - ret = 1; + ret = 1; done: if (der) diff --git a/SampleCode/SampleAttestedTLS/non_enc_client/client.cpp b/SampleCode/SampleAttestedTLS/non_enc_client/client.cpp index 0f614bee..c7443646 100644 --- a/SampleCode/SampleAttestedTLS/non_enc_client/client.cpp +++ b/SampleCode/SampleAttestedTLS/non_enc_client/client.cpp @@ -54,7 +54,7 @@ int parse_arguments( { int ret = 1; const char* option = nullptr; - int param_len = 0; + unsigned int param_len = 0; if (argc != 3) goto print_usage; @@ -87,7 +87,7 @@ int communicate_with_server(SSL* ssl) unsigned char buf[200]; int ret = 1; int error = 0; - int len = 0; + unsigned int len = 0; int bytes_written = 0; int bytes_read = 0; @@ -121,7 +121,7 @@ int communicate_with_server(SSL* ssl) printf(TLS_CLIENT "Failed! SSL_read returned error=%d\n", error); ret = bytes_read; - break; + goto done; } printf(TLS_CLIENT " %d bytes read\n", bytes_read); @@ -143,10 +143,9 @@ int communicate_with_server(SSL* ssl) printf(TLS_CLIENT " received all the expected data from server\n\n"); ret = 0; + printf("Verified: the contents of server payload were expected\n\n"); break; } - printf("Verified: the contents of server payload were expected\n\n"); - } while (1); ret = 0; done: @@ -157,8 +156,6 @@ done: int create_socket(char* server_name, char* server_port) { int sockfd = -1; - char* addr_ptr = nullptr; - int port = 0; struct addrinfo hints, *dest_info, *curr_di; int res; @@ -227,7 +224,6 @@ done: int main(int argc, char** argv) { int ret = 1; - X509* cert = nullptr; SSL_CTX* ctx = nullptr; SSL* ssl = nullptr; int serversocket = 0; @@ -268,7 +264,7 @@ int main(int argc, char** argv) SSL_CTX_set_options(ctx, SSL_OP_NO_TLSv1); SSL_CTX_set_options(ctx, SSL_OP_NO_TLSv1_1); // specify the verify_callback for custom verification - SSL_CTX_set_verify(ctx, SSL_VERIFY_PEER, &verify_callback); + SSL_CTX_set_verify(ctx, SSL_VERIFY_PEER, &verify_callback); if ((ssl = SSL_new(ctx)) == nullptr) { @@ -290,7 +286,7 @@ int main(int argc, char** argv) goto done; } - printf( + printf( TLS_CLIENT "create a socket and initate a TCP connect to server: %s:%s " "\n", @@ -319,17 +315,14 @@ int main(int argc, char** argv) } // Free the structures we don't need anymore + ret = 0; +done: if (serversocket != -1) close(serversocket); - ret = 0; -done: if (ssl) SSL_free(ssl); - if (cert) - X509_free(cert); - if (ctx) SSL_CTX_free(ctx); diff --git a/SampleCode/SampleAttestedTLS/server/enc/openssl_server.cpp b/SampleCode/SampleAttestedTLS/server/enc/openssl_server.cpp index fb73d8d9..a81130dc 100644 --- a/SampleCode/SampleAttestedTLS/server/enc/openssl_server.cpp +++ b/SampleCode/SampleAttestedTLS/server/enc/openssl_server.cpp @@ -95,19 +95,19 @@ int handle_communication_until_done( int test_error = 1; waiting_for_connection_request: - struct sockaddr_in addr; + struct sockaddr_in addr; uint len = sizeof(addr); // reset ssl_session and client_socket_fd to prepare for the new TLS // connection if (client_socket_fd > 0) - { - ocall_close(&ret, client_socket_fd); - if (ret != 0) { - t_print(TLS_SERVER "OCALL: error closing client socket before starting a new TLS session.\n"); - goto exit; - } - } + { + ocall_close(&ret, client_socket_fd); + if (ret != 0) { + t_print(TLS_SERVER "OCALL: error closing client socket before starting a new TLS session.\n"); + goto exit; + } + } SSL_free(ssl_session); t_print(TLS_SERVER " waiting for client connection\n"); @@ -131,9 +131,9 @@ waiting_for_connection_request: // wait for a TLS/SSL client to initiate a TLS/SSL handshake - t_print(TLS_SERVER "initiating a passive connect SSL_accept\n"); - test_error = SSL_accept(ssl_session); - if (test_error <= 0) + t_print(TLS_SERVER "initiating a passive connect SSL_accept\n"); + test_error = SSL_accept(ssl_session); + if (test_error <= 0) { t_print(TLS_SERVER " SSL handshake failed, error(%d)(%d)\n", test_error, SSL_get_error(ssl_session, test_error)); @@ -169,7 +169,7 @@ int set_up_tls_server(char* server_port, bool keep_server_up) int ret = 0; int server_socket_fd; int client_socket_fd = -1; - int server_port_number; + unsigned int server_port_number; X509* certificate = nullptr; EVP_PKEY* pkey = nullptr; @@ -183,12 +183,12 @@ int set_up_tls_server(char* server_port, bool keep_server_up) goto exit; } - if (initalize_ssl_context(ssl_confctx, ssl_server_ctx) != SGX_SUCCESS) + if (initalize_ssl_context(ssl_confctx, ssl_server_ctx) != SGX_SUCCESS) { t_print(TLS_SERVER "unable to create a initialize SSL context\n "); goto exit; } - SSL_CTX_set_verify(ssl_server_ctx, SSL_VERIFY_PEER, &verify_callback); + SSL_CTX_set_verify(ssl_server_ctx, SSL_VERIFY_PEER, &verify_callback); if (load_tls_certificates_and_keys(ssl_server_ctx, certificate, pkey) != 0) { @@ -197,7 +197,7 @@ int set_up_tls_server(char* server_port, bool keep_server_up) goto exit; } - server_port_number = (uint16_t)atoi(server_port); // convert to char* to int + server_port_number = (unsigned int)atoi(server_port); // convert to char* to int if (create_listener_socket(server_port_number, server_socket_fd) != 0) { t_print(TLS_SERVER " unable to create listener socket on the server\n "); @@ -219,11 +219,11 @@ int set_up_tls_server(char* server_port, bool keep_server_up) exit: ocall_close(&ret, client_socket_fd); // close the socket connections - if (ret != 0) - t_print(TLS_SERVER "OCALL: error closing client socket\n"); + if (ret != 0) + t_print(TLS_SERVER "OCALL: error closing client socket\n"); ocall_close(&ret, server_socket_fd); - if (ret != 0) - t_print(TLS_SERVER "OCALL: error closing server socket\n"); + if (ret != 0) + t_print(TLS_SERVER "OCALL: error closing server socket\n"); if (ssl_session) { diff --git a/SampleCode/SampleAttestedTLS/server/host/host.cpp b/SampleCode/SampleAttestedTLS/server/host/host.cpp index 72e17ec3..5e21af2b 100644 --- a/SampleCode/SampleAttestedTLS/server/host/host.cpp +++ b/SampleCode/SampleAttestedTLS/server/host/host.cpp @@ -150,8 +150,8 @@ sgx_status_t initialize_enclave(const char *enclave_path) if (ret != SGX_SUCCESS) { print_error_message(ret); - return ret; - } + return ret; + } return ret; } @@ -218,7 +218,7 @@ read_port: printf("Host: calling setup_tls_server\n"); result = set_up_tls_server(server_global_eid, &ret, server_port, keep_server_up); - if (ret != 0) + if (result != SGX_SUCCESS || ret != 0) { printf("Host: setup_tls_server failed\n"); goto exit; diff --git a/SampleCode/SampleAttestedTLS/server/tls_server.edl b/SampleCode/SampleAttestedTLS/server/tls_server.edl index 15972407..38e25be4 100644 --- a/SampleCode/SampleAttestedTLS/server/tls_server.edl +++ b/SampleCode/SampleAttestedTLS/server/tls_server.edl @@ -30,15 +30,15 @@ */ enclave { - from "sgx_tstdc.edl" import *; - from "sgx_socket.edl" import *; - from "enclave.edl" import *; - from "sgx_tsgxssl.edl" import *; - from "sgx_ttls.edl" import *; - from "sgx_pthread.edl" import *; + from "sgx_tstdc.edl" import *; + from "sgx_socket.edl" import *; + from "enclave.edl" import *; + from "sgx_tsgxssl.edl" import *; + from "sgx_ttls.edl" import *; + from "sgx_pthread.edl" import *; - include "sgx_ttls.h" - trusted { + include "sgx_ttls.h" + trusted { public int set_up_tls_server([in, string] char* port, int keep_server_up); }; }; diff --git a/SampleCode/SampleAttestedTLS/sgx_socket/include/sgx_socket.edl b/SampleCode/SampleAttestedTLS/sgx_socket/include/sgx_socket.edl index 1252206b..2525a194 100644 --- a/SampleCode/SampleAttestedTLS/sgx_socket/include/sgx_socket.edl +++ b/SampleCode/SampleAttestedTLS/sgx_socket/include/sgx_socket.edl @@ -44,8 +44,8 @@ enclave { int u_connect (int fd, [in, size=len] const struct sockaddr *addr, socklen_t len) propagate_errno; ssize_t u_send (int fd, [in, size=n] const void *buf, size_t n, int flags) propagate_errno; - ssize_t u_recv (int fd, [out, size=n] void *buf, size_t n, int flags) propagate_errno; - int u_setsockopt (int fd, int level, int optname, [in, size=optlen] const void *optval, socklen_t optlen) propagate_errno; - int u_close(int fd); + ssize_t u_recv (int fd, [out, size=n] void *buf, size_t n, int flags) propagate_errno; + int u_setsockopt (int fd, int level, int optname, [in, size=optlen] const void *optval, socklen_t optlen) propagate_errno; + int u_close(int fd); }; }; diff --git a/SampleCode/SampleAttestedTLS/sgx_socket/trusted_sgx_socket.cpp b/SampleCode/SampleAttestedTLS/sgx_socket/trusted_sgx_socket.cpp index b4b55f57..71178c05 100644 --- a/SampleCode/SampleAttestedTLS/sgx_socket/trusted_sgx_socket.cpp +++ b/SampleCode/SampleAttestedTLS/sgx_socket/trusted_sgx_socket.cpp @@ -46,84 +46,84 @@ int socket(int domain, int type, int protocol) { - int ret = -1; - - if (u_socket(&ret, domain, type, protocol) == SGX_SUCCESS) - return ret; + int ret = -1; - return -1; + if (u_socket(&ret, domain, type, protocol) == SGX_SUCCESS) + return ret; + + return -1; } int connect (int sockfd, const struct sockaddr *servaddr, socklen_t addrlen) { - int ret = -1; + int ret = -1; - if (u_connect(&ret, sockfd, servaddr, addrlen) == SGX_SUCCESS) - return ret; + if (u_connect(&ret, sockfd, servaddr, addrlen) == SGX_SUCCESS) + return ret; - return -1; + return -1; } int bind(int sockfd, const struct sockaddr* servaddr, socklen_t addrlen) { - int ret = -1; - - if (u_bind(&ret, sockfd, servaddr, addrlen) == SGX_SUCCESS) - return ret; + int ret = -1; - return -1; + if (u_bind(&ret, sockfd, servaddr, addrlen) == SGX_SUCCESS) + return ret; + + return -1; } int listen(int sockfd, int backlog) { - int ret = -1; + int ret = -1; - if (u_listen(&ret, sockfd, backlog) == SGX_SUCCESS) - return ret; + if (u_listen(&ret, sockfd, backlog) == SGX_SUCCESS) + return ret; - return -1; + return -1; } int accept(int sockfd, struct sockaddr* addr, socklen_t *addrlen) { - int ret = -1; - socklen_t addrlen_in = 0; + int ret = -1; + socklen_t addrlen_in = 0; - if ((addr && !addrlen) || (addrlen && !addr)) - { - return -1; - } + if ((addr && !addrlen) || (addrlen && !addr)) + { + return -1; + } - if (addr && addrlen) - { - addrlen_in = *addrlen; - } + if (addr && addrlen) + { + addrlen_in = *addrlen; + } - if (u_accept(&ret, sockfd, addr, addrlen_in, addrlen) == SGX_SUCCESS) - return ret; + if (u_accept(&ret, sockfd, addr, addrlen_in, addrlen) == SGX_SUCCESS) + return ret; - return -1; + return -1; } ssize_t send(int sockfd, const void *buf, size_t nbytes, int flags) { - ssize_t ret = 0; + ssize_t ret = 0; - if (u_send(&ret, sockfd, buf, nbytes, flags) == SGX_SUCCESS) - return ret; + if (u_send(&ret, sockfd, buf, nbytes, flags) == SGX_SUCCESS) + return ret; - return -1; + return -1; } ssize_t recv(int fd, void *buf, size_t len, int flags) { - ssize_t ret = 0; + ssize_t ret = 0; - if (u_recv(&ret, fd, buf, len, flags) == SGX_SUCCESS) - return ret; + if (u_recv(&ret, fd, buf, len, flags) == SGX_SUCCESS) + return ret; - return -1; + return -1; } int setsockopt( @@ -154,9 +154,9 @@ int setsockopt( int close(int sockfd) { - int ret = -1; - if (u_close(&ret, sockfd) == SGX_SUCCESS) - return ret; + int ret = -1; + if (u_close(&ret, sockfd) == SGX_SUCCESS) + return ret; - return -1; + return -1; } diff --git a/SampleCode/SampleAttestedTLS/sgx_socket/untrusted_sgx_socket.cpp b/SampleCode/SampleAttestedTLS/sgx_socket/untrusted_sgx_socket.cpp index 0b2f60ab..ecbdf715 100644 --- a/SampleCode/SampleAttestedTLS/sgx_socket/untrusted_sgx_socket.cpp +++ b/SampleCode/SampleAttestedTLS/sgx_socket/untrusted_sgx_socket.cpp @@ -42,22 +42,22 @@ int u_socket(int domain, int type, int protocol) { - return socket(domain, type, protocol); + return socket(domain, type, protocol); } int u_connect(int sockfd, const struct sockaddr *servaddr, socklen_t addrlen) { - return connect(sockfd, servaddr, addrlen); + return connect(sockfd, servaddr, addrlen); } int u_bind(int fd, const struct sockaddr *addr, socklen_t len) { - return bind(fd, addr, len); + return bind(fd, addr, len); } int u_listen(int fd, int n) { - return listen(fd, n); + return listen(fd, n); } int u_accept( @@ -67,24 +67,24 @@ int u_accept( socklen_t *addrlen_out ) { - int ret = -1; - - if ((ret = accept(fd, addr, &addrlen_in)) != -1) - { - if (addrlen_out) - *addrlen_out = addrlen_in; - } - return ret; + int ret = -1; + + if ((ret = accept(fd, addr, &addrlen_in)) != -1) + { + if (addrlen_out) + *addrlen_out = addrlen_in; + } + return ret; } ssize_t u_send(int sockfd, const void *buf, size_t nbytes, int flags) { - return send(sockfd, buf, nbytes, flags); + return send(sockfd, buf, nbytes, flags); } ssize_t u_recv(int sockfd, void *buf, size_t nbytes, int flags) { - return recv(sockfd, buf, nbytes, flags); + return recv(sockfd, buf, nbytes, flags); } int u_setsockopt( @@ -95,15 +95,10 @@ int u_setsockopt( socklen_t optlen ) { - return setsockopt(sockfd, level, optname, optval, optlen); + return setsockopt(sockfd, level, optname, optval, optlen); } int u_close(int fd) { - return close(fd); + return close(fd); } - - - - - diff --git a/SampleCode/SampleDNNL/App/App.cpp b/SampleCode/SampleDNNL/App/App.cpp index 41c67528..cfb4f15f 100644 --- a/SampleCode/SampleDNNL/App/App.cpp +++ b/SampleCode/SampleDNNL/App/App.cpp @@ -134,6 +134,11 @@ static sgx_errlist_t sgx_errlist[] = { "Can't open enclave file.", NULL }, + { + SGX_ERROR_MEMORY_MAP_FAILURE, + "Failed to reserve memory for the enclave.", + NULL + }, }; /* Check error conditions for loading enclave */ diff --git a/SampleCode/SampleDNNL/Enclave/Enclave.cpp b/SampleCode/SampleDNNL/Enclave/Enclave.cpp index 97f0ae05..450dcbb8 100644 --- a/SampleCode/SampleDNNL/Enclave/Enclave.cpp +++ b/SampleCode/SampleDNNL/Enclave/Enclave.cpp @@ -39,7 +39,7 @@ using namespace std; -extern "C" void printf(const char *fmt, ...) +extern "C" int printf(const char *fmt, ...) { char buf[300] = {'\0'}; va_list ap; @@ -47,6 +47,8 @@ extern "C" void printf(const char *fmt, ...) vsnprintf(buf, BUFSIZ, fmt, ap); va_end(ap); ocall_print_string(buf); + + return 0; } diff --git a/SampleCode/SampleDNNL/Enclave/cpu_rnn_inference_f32_cpp.cpp b/SampleCode/SampleDNNL/Enclave/cpu_rnn_inference_f32_cpp.cpp index 3659f3fb..f8b3bec5 100644 --- a/SampleCode/SampleDNNL/Enclave/cpu_rnn_inference_f32_cpp.cpp +++ b/SampleCode/SampleDNNL/Enclave/cpu_rnn_inference_f32_cpp.cpp @@ -58,7 +58,7 @@ #include "dnnl.hpp" -extern "C" void printf(const char *fmt, ...); +extern "C" int printf(const char *fmt, ...); // MSVC doesn't support collapse clause in omp parallel diff --git a/SampleCode/SampleDNNL/Enclave/cpu_rnn_inference_int8_cpp.cpp b/SampleCode/SampleDNNL/Enclave/cpu_rnn_inference_int8_cpp.cpp index 73b4a098..ae33ce48 100644 --- a/SampleCode/SampleDNNL/Enclave/cpu_rnn_inference_int8_cpp.cpp +++ b/SampleCode/SampleDNNL/Enclave/cpu_rnn_inference_int8_cpp.cpp @@ -58,7 +58,7 @@ #include "dnnl.hpp" -extern "C" void printf(const char *fmt, ...); +extern "C" int printf(const char *fmt, ...); // MSVC doesn't support collapse clause in omp parallel diff --git a/SampleCode/SampleDNNL/Enclave/example_utils.hpp b/SampleCode/SampleDNNL/Enclave/example_utils.hpp index 00c47ab9..84eb4ec5 100644 --- a/SampleCode/SampleDNNL/Enclave/example_utils.hpp +++ b/SampleCode/SampleDNNL/Enclave/example_utils.hpp @@ -39,7 +39,7 @@ #include "dnnl.hpp" -extern "C" void printf(const char *fmt, ...); +extern "C" int printf(const char *fmt, ...); static dnnl::engine::kind parse_engine_kind( int argc, char **argv, int extra_args = 0) { diff --git a/SampleCode/SampleDNNL/Makefile b/SampleCode/SampleDNNL/Makefile index 89d1707b..8f740bb8 100644 --- a/SampleCode/SampleDNNL/Makefile +++ b/SampleCode/SampleDNNL/Makefile @@ -131,7 +131,7 @@ ifeq ($(CC_BELOW_4_9), 1) else Enclave_Compile_CFlags := -fstack-protector-strong endif -Enclave_Compile_CFlags += -nostdinc -ffreestanding -fvisibility=hidden -fpie -ffunction-sections -fdata-sections $(Enclave_Include_Paths) -fomit-frame-pointer +Enclave_Compile_CFlags += -nostdinc -ffreestanding -fvisibility=hidden -fpie -ffunction-sections -fdata-sections $(Enclave_Include_Paths) -fomit-frame-pointer -fno-builtin-printf Enclave_Compile_CXXFlags := -nostdinc++ $(Enclave_Compile_CFlags) -fomit-frame-pointer # Enable the security flags diff --git a/SampleCode/SampleEnclave/App/App.cpp b/SampleCode/SampleEnclave/App/App.cpp index 6ac49c8b..8aa10da9 100644 --- a/SampleCode/SampleEnclave/App/App.cpp +++ b/SampleCode/SampleEnclave/App/App.cpp @@ -128,6 +128,11 @@ static sgx_errlist_t sgx_errlist[] = { "Can't open enclave file.", NULL }, + { + SGX_ERROR_MEMORY_MAP_FAILURE, + "Failed to reserve memory for the enclave.", + NULL + }, }; /* Check error conditions for loading enclave */ diff --git a/SampleCode/SampleEnclave/Enclave/Edger8rSyntax/Arrays.cpp b/SampleCode/SampleEnclave/Enclave/Edger8rSyntax/Arrays.cpp index 4548547f..cca3fac6 100644 --- a/SampleCode/SampleEnclave/Enclave/Edger8rSyntax/Arrays.cpp +++ b/SampleCode/SampleEnclave/Enclave/Edger8rSyntax/Arrays.cpp @@ -34,6 +34,7 @@ #include "sgx_trts.h" #include "../Enclave.h" #include "Enclave_t.h" +#include /* ecall_array_user_check: * [user_check] parameter does not perfrom copy operations. @@ -45,7 +46,12 @@ void ecall_array_user_check(int arr[4]) for (int i = 0; i < 4; i++) { assert(arr[i] == i); - arr[i] = 3 - i; + /* Below code performs as arr[i] = (3 - i) + * It writes 4 bytes to untrusted memory, not 8 bytes aligned. + * So we need to use memcpy_verw() for security consideration. + * */ + int tmp = 3 - i; + memcpy_verw(&arr[i], &tmp, sizeof(int)); } } @@ -97,6 +103,11 @@ void ecall_array_isary(array_t arr) int n = sizeof(array_t)/sizeof(arr[0]); for (int i = 0; i < n; i++) { assert(arr[i] == i); - arr[i] = (n - 1 - i); + /* Below code performs as arr[i] = (n - 1 - i); + * It writes 4 bytes to untrusted memory, not 8 bytes aligned. + * So we need to use memcpy_verw() for security consideration. + * */ + int tmp = n -1 - i; + memcpy_verw(&arr[i], &tmp, sizeof(int)); } } diff --git a/SampleCode/SampleEnclave/Enclave/Edger8rSyntax/Pointers.cpp b/SampleCode/SampleEnclave/Enclave/Edger8rSyntax/Pointers.cpp index 21c9dcaa..ec60b1ed 100644 --- a/SampleCode/SampleEnclave/Enclave/Edger8rSyntax/Pointers.cpp +++ b/SampleCode/SampleEnclave/Enclave/Edger8rSyntax/Pointers.cpp @@ -85,7 +85,7 @@ size_t ecall_pointer_user_check(void* val, size_t sz) val, len, (unsigned int)sum); /* modify outside memory directly */ - memcpy(val, "SGX_SUCCESS", len > 12 ? 12 : len); + memcpy_verw(val, "SGX_SUCCESS", len > 12 ? 12 : len); return len; } diff --git a/SampleCode/SampleEnclaveGMIPP/App/App.cpp b/SampleCode/SampleEnclaveGMIPP/App/App.cpp index 9e951ae1..8b2123c0 100644 --- a/SampleCode/SampleEnclaveGMIPP/App/App.cpp +++ b/SampleCode/SampleEnclaveGMIPP/App/App.cpp @@ -129,6 +129,11 @@ static sgx_errlist_t sgx_errlist[] = { "Can't open enclave file.", NULL }, + { + SGX_ERROR_MEMORY_MAP_FAILURE, + "Failed to reserve memory for the enclave.", + NULL + }, }; /* Check error conditions for loading enclave */ diff --git a/SampleCode/SampleEnclavePCL/App/App.cpp b/SampleCode/SampleEnclavePCL/App/App.cpp index 092c68f1..42d3c64b 100644 --- a/SampleCode/SampleEnclavePCL/App/App.cpp +++ b/SampleCode/SampleEnclavePCL/App/App.cpp @@ -158,6 +158,11 @@ static sgx_errlist_t sgx_errlist[] = { "PCL sealed key GUID mismatch.", NULL }, + { + SGX_ERROR_MEMORY_MAP_FAILURE, + "Failed to reserve memory for the enclave.", + NULL + }, }; /* Check error conditions for loading enclave */ diff --git a/SampleCode/SampleEnclavePCL/Enclave/Edger8rSyntax/Arrays.cpp b/SampleCode/SampleEnclavePCL/Enclave/Edger8rSyntax/Arrays.cpp index 4548547f..cca3fac6 100644 --- a/SampleCode/SampleEnclavePCL/Enclave/Edger8rSyntax/Arrays.cpp +++ b/SampleCode/SampleEnclavePCL/Enclave/Edger8rSyntax/Arrays.cpp @@ -34,6 +34,7 @@ #include "sgx_trts.h" #include "../Enclave.h" #include "Enclave_t.h" +#include /* ecall_array_user_check: * [user_check] parameter does not perfrom copy operations. @@ -45,7 +46,12 @@ void ecall_array_user_check(int arr[4]) for (int i = 0; i < 4; i++) { assert(arr[i] == i); - arr[i] = 3 - i; + /* Below code performs as arr[i] = (3 - i) + * It writes 4 bytes to untrusted memory, not 8 bytes aligned. + * So we need to use memcpy_verw() for security consideration. + * */ + int tmp = 3 - i; + memcpy_verw(&arr[i], &tmp, sizeof(int)); } } @@ -97,6 +103,11 @@ void ecall_array_isary(array_t arr) int n = sizeof(array_t)/sizeof(arr[0]); for (int i = 0; i < n; i++) { assert(arr[i] == i); - arr[i] = (n - 1 - i); + /* Below code performs as arr[i] = (n - 1 - i); + * It writes 4 bytes to untrusted memory, not 8 bytes aligned. + * So we need to use memcpy_verw() for security consideration. + * */ + int tmp = n -1 - i; + memcpy_verw(&arr[i], &tmp, sizeof(int)); } } diff --git a/SampleCode/SampleEnclavePCL/Enclave/Edger8rSyntax/Pointers.cpp b/SampleCode/SampleEnclavePCL/Enclave/Edger8rSyntax/Pointers.cpp index 6f059438..804e0225 100644 --- a/SampleCode/SampleEnclavePCL/Enclave/Edger8rSyntax/Pointers.cpp +++ b/SampleCode/SampleEnclavePCL/Enclave/Edger8rSyntax/Pointers.cpp @@ -29,68 +29,72 @@ * */ - /* Test Pointer Auttributes */ -#include #include +#include -#include "sgx_trts.h" #include "../Enclave.h" #include "Enclave_t.h" +#include "sgx_lfence.h" +#include "sgx_trts.h" /* checksum_internal: * get simple checksum of input buffer and length */ -int32_t checksum_internal(char *buf, size_t count) +int32_t checksum_internal(char* buf, size_t count) { register int32_t sum = 0; - int16_t *ptr = (int16_t *)buf; + int16_t* ptr = (int16_t*)buf; /* Main summing loop */ - while(count > 1) { + while (count > 1) { sum = sum + *ptr++; count = count - 2; } /* Add left-over byte, if any */ - if (count > 0) - sum = sum + *((char *)ptr); + if (count > 0) { + sum = sum + *((char*)ptr); + } - return ~sum; + return ~sum; } /* ecall_pointer_user_check, ecall_pointer_in, ecall_pointer_out, ecall_pointer_in_out: * The root ECALLs to test [in], [out], [user_check] attributes. */ -size_t ecall_pointer_user_check(void *val, size_t sz) +size_t ecall_pointer_user_check(void* val, size_t sz) { /* check if the buffer is allocated outside */ if (sgx_is_outside_enclave(val, sz) != 1) abort(); - char tmp[100] = {0}; - size_t len = sz>100?100:sz; - + /*fence after sgx_is_outside_enclave check*/ + sgx_lfence(); + + char tmp[100] = { 0 }; + size_t len = sz > 100 ? 100 : sz; + /* copy the memory into the enclave to make sure 'val' * is not being changed in checksum_internal() */ memcpy(tmp, val, len); - - int32_t sum = checksum_internal((char *)tmp, len); - printf("Checksum(0x%p, %zu) = 0x%x\n", - val, len, (unsigned int)sum); - - /* modify outside memory directly */ - memcpy(val, "SGX_SUCCESS", len>12?12:len); - return len; + int32_t sum = checksum_internal((char*)tmp, len); + printf("Checksum(0x%p, %zu) = 0x%x\n", + val, len, (unsigned int)sum); + + /* modify outside memory directly */ + memcpy_verw(val, "SGX_SUCCESS", len > 12 ? 12 : len); + + return len; } /* ecall_pointer_in: * the buffer of val is copied to the enclave. */ -void ecall_pointer_in(int *val) +void ecall_pointer_in(int* val) { if (sgx_is_within_enclave(val, sizeof(int)) != 1) abort(); @@ -100,7 +104,7 @@ void ecall_pointer_in(int *val) /* ecall_pointer_out: * the buffer of val is copied to the untrusted side. */ -void ecall_pointer_out(int *val) +void ecall_pointer_out(int* val) { if (sgx_is_within_enclave(val, sizeof(int)) != 1) abort(); @@ -111,7 +115,7 @@ void ecall_pointer_out(int *val) /* ecall_pointer_in_out: * the buffer of val is double-copied. */ -void ecall_pointer_in_out(int *val) +void ecall_pointer_in_out(int* val) { if (sgx_is_within_enclave(val, sizeof(int)) != 1) abort(); @@ -154,7 +158,7 @@ void ocall_pointer_attr(void) /* ecall_pointer_string: * [string] defines a string. */ -void ecall_pointer_string(char *str) +void ecall_pointer_string(char* str) { strncpy(str, "0987654321", strlen(str)); } @@ -162,17 +166,17 @@ void ecall_pointer_string(char *str) /* ecall_pointer_string_const: * const [string] defines a string that cannot be modified. */ -void ecall_pointer_string_const(const char *str) +void ecall_pointer_string_const(const char* str) { char* temp = new char[strlen(str)]; strncpy(temp, str, strlen(str)); - delete []temp; + delete[] temp; } /* ecall_pointer_size: * 'len' needs to be specified to tell Edger8r the length of 'str'. */ -void ecall_pointer_size(void *ptr, size_t len) +void ecall_pointer_size(void* ptr, size_t len) { strncpy((char*)ptr, "0987654321", len); } @@ -180,9 +184,9 @@ void ecall_pointer_size(void *ptr, size_t len) /* ecall_pointer_count: * 'cnt' needs to be specified to tell Edger8r the number of elements in 'arr'. */ -void ecall_pointer_count(int *arr, size_t count) +void ecall_pointer_count(int* arr, size_t count) { - int cnt = (int) count; + int cnt = (int)count; for (int i = (cnt - 1); i >= 0; i--) arr[i] = (cnt - 1 - i); } @@ -195,4 +199,3 @@ void ecall_pointer_isptr_readonly(buffer_t buf, size_t len) { strncpy((char*)buf, "0987654321", len); } - diff --git a/SampleCode/SampleEnclavePCL/Enclave/Enclave.cpp b/SampleCode/SampleEnclavePCL/Enclave/Enclave.cpp index efa0eb49..0d06c3cb 100644 --- a/SampleCode/SampleEnclavePCL/Enclave/Enclave.cpp +++ b/SampleCode/SampleEnclavePCL/Enclave/Enclave.cpp @@ -40,7 +40,7 @@ * printf: * Invokes OCALL to display the enclave buffer to the terminal. */ -void printf(const char *fmt, ...) +int printf(const char *fmt, ...) { char buf[BUFSIZ] = {'\0'}; va_list ap; @@ -48,4 +48,5 @@ void printf(const char *fmt, ...) vsnprintf(buf, BUFSIZ, fmt, ap); va_end(ap); ocall_print_string(buf); + return 0; } diff --git a/SampleCode/SampleEnclavePCL/Enclave/Enclave.h b/SampleCode/SampleEnclavePCL/Enclave/Enclave.h index 8520ef0f..b0e648fa 100644 --- a/SampleCode/SampleEnclavePCL/Enclave/Enclave.h +++ b/SampleCode/SampleEnclavePCL/Enclave/Enclave.h @@ -40,7 +40,7 @@ extern "C" { #endif -void printf(const char *fmt, ...); +int printf(const char *fmt, ...); #if defined(__cplusplus) } diff --git a/SampleCode/SealUnseal/App/ErrorSupport.cpp b/SampleCode/SealUnseal/App/ErrorSupport.cpp index d8904428..8b456a87 100644 --- a/SampleCode/SealUnseal/App/ErrorSupport.cpp +++ b/SampleCode/SealUnseal/App/ErrorSupport.cpp @@ -50,6 +50,7 @@ static sgx_errlist_t sgx_errlist[] = { {SGX_ERROR_OUT_OF_EPC, "Out of EPC memory."}, {SGX_ERROR_NO_DEVICE, "Invalid SGX device."}, {SGX_ERROR_MEMORY_MAP_CONFLICT, "Memory map conflicted."}, + {SGX_ERROR_MEMORY_MAP_FAILURE, "Failed to reserve memory for the enclave."}, {SGX_ERROR_INVALID_METADATA, "Invalid encalve metadata."}, {SGX_ERROR_DEVICE_BUSY, "SGX device is busy."}, {SGX_ERROR_INVALID_VERSION, "Enclave metadata version is invalid."}, diff --git a/SampleCode/Switchless/App/App.cpp b/SampleCode/Switchless/App/App.cpp index e86b49b4..4f05c198 100644 --- a/SampleCode/Switchless/App/App.cpp +++ b/SampleCode/Switchless/App/App.cpp @@ -132,6 +132,11 @@ static sgx_errlist_t sgx_errlist[] = { "Can't open enclave file.", NULL }, + { + SGX_ERROR_MEMORY_MAP_FAILURE, + "Failed to reserve memory for the enclave.", + NULL + }, }; /* Check error conditions for loading enclave */ diff --git a/common/inc/internal/global_data.h b/common/inc/internal/global_data.h index 02800f33..6fdec938 100644 --- a/common/inc/internal/global_data.h +++ b/common/inc/internal/global_data.h @@ -56,6 +56,7 @@ typedef struct _global_data_t sys_word_t rsrv_executable; sys_word_t thread_policy; sys_word_t tcs_max_num; + sys_word_t tcs_num; thread_data_t td_template; uint8_t tcs_template[TCS_TEMPLATE_SIZE]; uint32_t layout_entry_num; diff --git a/common/inc/internal/se_version.h b/common/inc/internal/se_version.h index 86939109..25b86551 100644 --- a/common/inc/internal/se_version.h +++ b/common/inc/internal/se_version.h @@ -31,25 +31,25 @@ #ifndef _SE_VERSION_H_ #define _SE_VERSION_H_ -#define STRFILEVER "2.16.100.1" +#define STRFILEVER "2.17.100.2" #define SGX_MAJOR_VERSION 2 -#define SGX_MINOR_VERSION 16 +#define SGX_MINOR_VERSION 17 #define SGX_REVISION_VERSION 100 #define MAKE_VERSION_UINT(major,minor,rev) (((uint64_t)major)<<32 | ((uint64_t)minor) << 16 | rev) #define VERSION_UINT MAKE_VERSION_UINT(SGX_MAJOR_VERSION, SGX_MINOR_VERSION, SGX_REVISION_VERSION) #define COPYRIGHT "Copyright (C) 2022 Intel Corporation" -#define UAE_SERVICE_VERSION "2.3.214.1" -#define URTS_VERSION "1.1.118.1" -#define ENCLAVE_COMMON_VERSION "1.1.121.1" -#define LAUNCH_VERSION "1.0.116.1" -#define EPID_VERSION "1.0.116.1" -#define QUOTE_EX_VERSION "1.1.116.1" +#define UAE_SERVICE_VERSION "2.3.215.2" +#define URTS_VERSION "1.1.119.2" +#define ENCLAVE_COMMON_VERSION "1.1.122.2" +#define LAUNCH_VERSION "1.0.117.2" +#define EPID_VERSION "1.0.117.2" +#define QUOTE_EX_VERSION "1.1.117.2" -#define PCE_VERSION "1.16.100.0" -#define LE_VERSION "1.16.100.0" -#define QE_VERSION "1.16.100.0" -#define PVE_VERSION "1.16.100.0" +#define PCE_VERSION "1.17.100.2" +#define LE_VERSION "1.17.100.2" +#define QE_VERSION "1.17.100.2" +#define PVE_VERSION "1.17.100.2" #endif diff --git a/common/inc/sgx_error.h b/common/inc/sgx_error.h index 1a410cad..4df71697 100644 --- a/common/inc/sgx_error.h +++ b/common/inc/sgx_error.h @@ -61,7 +61,7 @@ typedef enum _status_t SGX_ERROR_NDEBUG_ENCLAVE = SGX_MK_ERROR(0x2004), /* The enclave is signed as product enclave, and can not be created as debuggable enclave. */ SGX_ERROR_OUT_OF_EPC = SGX_MK_ERROR(0x2005), /* Not enough EPC is available to load the enclave */ SGX_ERROR_NO_DEVICE = SGX_MK_ERROR(0x2006), /* Can't open SGX device */ - SGX_ERROR_MEMORY_MAP_CONFLICT= SGX_MK_ERROR(0x2007), /* Page mapping failed in driver */ + SGX_ERROR_MEMORY_MAP_CONFLICT= SGX_MK_ERROR(0x2007), /* Page mapping failed in driver. Deprecated */ SGX_ERROR_INVALID_METADATA = SGX_MK_ERROR(0x2009), /* The metadata is incorrect. */ SGX_ERROR_DEVICE_BUSY = SGX_MK_ERROR(0x200c), /* Device is busy, mostly EINIT failed. */ SGX_ERROR_INVALID_VERSION = SGX_MK_ERROR(0x200d), /* Metadata version is inconsistent between uRTS and sgx_sign or uRTS is incompatible with current platform. */ diff --git a/common/inc/tlibc/mbusafecrt.h b/common/inc/tlibc/mbusafecrt.h index 466c5504..100c0300 100644 --- a/common/inc/tlibc/mbusafecrt.h +++ b/common/inc/tlibc/mbusafecrt.h @@ -74,7 +74,9 @@ extern int _vswprintf_s( WCHAR* string, size_t sizeInWords, const WCHAR* format, extern int _vsnwprintf_s( WCHAR* string, size_t sizeInWords, size_t count, const WCHAR* format, va_list arglist ); extern errno_t memcpy_s( void * dst, size_t sizeInBytes, const void * src, size_t count ); +extern errno_t memcpy_verw_s( void * dst, size_t sizeInBytes, const void * src, size_t count ); extern errno_t memmove_s( void * dst, size_t sizeInBytes, const void * src, size_t count ); +extern errno_t memmove_verw_s( void * dst, size_t sizeInBytes, const void * src, size_t count ); #ifdef __cplusplus } diff --git a/common/inc/tlibc/string.h b/common/inc/tlibc/string.h index c8e458f4..5f2ff225 100644 --- a/common/inc/tlibc/string.h +++ b/common/inc/tlibc/string.h @@ -61,8 +61,11 @@ __BEGIN_DECLS void * _TLIBC_CDECL_ memchr(const void *, int, size_t); int _TLIBC_CDECL_ memcmp(const void *, const void *, size_t); void * _TLIBC_CDECL_ memcpy(void *, const void *, size_t); +void * _TLIBC_CDECL_ memcpy_verw(void *, const void *, size_t); void * _TLIBC_CDECL_ memmove(void *, const void *, size_t); +void * _TLIBC_CDECL_ memmove_verw(void *, const void *, size_t); void * _TLIBC_CDECL_ memset(void *, int, size_t); +void * _TLIBC_CDECL_ memset_verw(void *, int, size_t); char * _TLIBC_CDECL_ strchr(const char *, int); int _TLIBC_CDECL_ strcmp(const char *, const char *); int _TLIBC_CDECL_ strcoll(const char *, const char *); @@ -80,6 +83,7 @@ char * _TLIBC_CDECL_ strtok(char *, const char *); size_t _TLIBC_CDECL_ strxfrm(char *, const char *, size_t); size_t _TLIBC_CDECL_ strlcpy(char *, const char *, size_t); errno_t _TLIBC_CDECL_ memset_s(void *s, size_t smax, int c, size_t n); +errno_t _TLIBC_CDECL_ memset_verw_s(void *s, size_t smax, int c, size_t n); /* * Deprecated C99. diff --git a/download_prebuilt.sh b/download_prebuilt.sh index fa992a4e..677d47d3 100755 --- a/download_prebuilt.sh +++ b/download_prebuilt.sh @@ -33,11 +33,11 @@ top_dir=`dirname $0` out_dir=$top_dir -optlib_name=optimized_libs_2.16.tar.gz -ae_file_name=prebuilt_ae_2.16.tar.gz +optlib_name=optimized_libs_2.17.tar.gz +ae_file_name=prebuilt_ae_2.17.tar.gz binutils_file_name=as.ld.objdump.r4.tar.gz -checksum_file=SHA256SUM_prebuilt_2.16.cfg -server_url_path=https://download.01.org/intel-sgx/sgx-linux/2.16 +checksum_file=SHA256SUM_prebuilt_2.17.cfg +server_url_path=https://download.01.org/intel-sgx/sgx-linux/2.17 server_optlib_url=$server_url_path/$optlib_name server_ae_url=$server_url_path/$ae_file_name server_binutils_url=$server_url_path/$binutils_file_name diff --git a/external/dcap_source b/external/dcap_source index e84bf420..05013882 160000 --- a/external/dcap_source +++ b/external/dcap_source @@ -1 +1 @@ -Subproject commit e84bf4209ed99a8c69a6a2de55fcd50cffd61766 +Subproject commit 0501388250cd24549d3c8dfd06e27608bd034565 diff --git a/external/ippcp_internal/0001-IPP-crypto-for-SGX_psw_dcap.patch b/external/ippcp_internal/0001-IPP-crypto-for-SGX_psw_dcap.patch new file mode 100644 index 00000000..ba7a0178 --- /dev/null +++ b/external/ippcp_internal/0001-IPP-crypto-for-SGX_psw_dcap.patch @@ -0,0 +1,41 @@ +From 2e183ac7a9ee7405d8ba8433e930f7fb8057c176 Mon Sep 17 00:00:00 2001 +From: Zhang Lili +Date: Wed, 4 Aug 2021 16:29:26 +0800 +Subject: [PATCH] IPP crypto for SGX. + +Signed-off-by: Zhang Lili +--- + CMakeLists.txt | 3 +++ + sources/cmake/linux/GNU8.2.0.cmake | 2 +- + 2 files changed, 4 insertions(+), 1 deletion(-) + +diff --git a/CMakeLists.txt b/CMakeLists.txt +index f750c7b..1bf6305 100644 +--- a/CMakeLists.txt ++++ b/CMakeLists.txt +@@ -20,6 +20,9 @@ + + cmake_minimum_required(VERSION 3.12) + ++set(SGX_PROGRAM_SEARCH_PATH) ++LIST(APPEND CMAKE_PROGRAM_PATH "/usr/local/bin/" ${SGX_PROGRAM_SEARCH_PATH} ...) ++ + include("${CMAKE_CURRENT_SOURCE_DIR}/sources/cmake/ippcp-utils.cmake") + ippcp_getlibversion("${CMAKE_CURRENT_SOURCE_DIR}/include/ippversion.h") + if ((NOT DEFINED IPPCP_VERSION_MAJOR) OR +diff --git a/sources/cmake/linux/GNU8.2.0.cmake b/sources/cmake/linux/GNU8.2.0.cmake +index 24d7e0f..a8be309 100644 +--- a/sources/cmake/linux/GNU8.2.0.cmake ++++ b/sources/cmake/linux/GNU8.2.0.cmake +@@ -96,7 +96,7 @@ if(${ARCH} MATCHES "ia32") + endif(${ARCH} MATCHES "ia32") + + # Optimization level = 3, no-debug definition (turns off asserts), warnings=errors +-set (CMAKE_C_FLAGS_RELEASE " -O3 -DNDEBUG -Werror") ++set (CMAKE_C_FLAGS_RELEASE " -O3 -DNDEBUG ") + + set(w7_opt "${w7_opt} -march=pentium4 -msse2") + set(s8_opt "${s8_opt} -march=core2 -mssse3") +-- +2.35.1 + diff --git a/external/ippcp_internal/Makefile.psw_dcap b/external/ippcp_internal/Makefile.psw_dcap new file mode 100644 index 00000000..3f526996 --- /dev/null +++ b/external/ippcp_internal/Makefile.psw_dcap @@ -0,0 +1,74 @@ +# +# Copyright (C) 2011-2020 Intel Corporation. All rights reserved. +# +# Redistribution and use in source and binary forms, with or without +# modification, are permitted provided that the following conditions +# are met: +# +# * Redistributions of source code must retain the above copyright +# notice, this list of conditions and the following disclaimer. +# * Redistributions in binary form must reproduce the above copyright +# notice, this list of conditions and the following disclaimer in +# the documentation and/or other materials provided with the +# distribution. +# * Neither the name of Intel Corporation nor the names of its +# contributors may be used to endorse or promote products derived +# from this software without specific prior written permission. +# +# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS +# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT +# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR +# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT +# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, +# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT +# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, +# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY +# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT +# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE +# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. +# +# + +include ../../buildenv.mk + +DIR = $(CURDIR) + +IPP_CONFIG = -Bbuild -DCMAKE_VERBOSE_MAKEFILE=on + +# Ignore the CMAKE C/C++ compiler check to avoid conflicts with mitigation options +IPP_CONFIG += -DCMAKE_C_COMPILER_WORKS=TRUE -DCMAKE_CXX_COMPILER_WORKS=TRUE +IPP_SOURCE = ipp-crypto +ARCH = intel64 +IPP_CONFIG += -DARCH=$(ARCH) + +ENC_FLAGS = $(patsubst -fpie, -fpic, $(ENCLAVE_CFLAGS)) +# ipp-crypto requires system header files +ENC_CFLAGS = $(patsubst -nostdinc, , $(ENC_FLAGS)) +ENC_CXXFLAGS = $(ENC_CFLAGS) + +IPP_CONFIG += -DCMAKE_C_FLAGS="$(ENC_CFLAGS)" +IPP_CONFIG += -DCMAKE_CXX_FLAGS="$(ENC_CXXFLAGS)" + +IPP_CONFIG += -DSGX_PROGRAM_SEARCH_PATH="$(EXT_BINUTILS_DIR)" + +SUB_DIR = no_mitigation +OUT_DIR = lib/linux/$(ARCH)/$(SUB_DIR)/ + + +.PHONY: all build_ipp +all: build_ipp + # copy the built out lib, header files and license to the target folder + $(MKDIR) $(OUT_DIR) + $(CP) ipp-crypto/build/.build/RELEASE/lib/libippcp.a $(OUT_DIR) + $(CP) ipp-crypto/include/* ./inc/ + patch ipp-crypto/include/ippcp.h -i ./inc/ippcp21u3.patch -o ./inc/ippcp.h + $(MKDIR) license + $(CP) ipp-crypto/LICENSE ./license/ + +build_ipp: + cd $(IPP_SOURCE) && cmake CMakeLists.txt $(IPP_CONFIG) && cd build && make ippcp_s + + +.PHONY: clean +clean: + $(RM) -rf ipp-crypto/build diff --git a/external/ippcp_internal/inc/sgx_ippcp.h b/external/ippcp_internal/inc/sgx_ippcp.h new file mode 100644 index 00000000..18d45279 --- /dev/null +++ b/external/ippcp_internal/inc/sgx_ippcp.h @@ -0,0 +1,569 @@ +/* + * Copyright (C) 2011-2021 Intel Corporation. All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * + * * Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * * Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in + * the documentation and/or other materials provided with the + * distribution. + * * Neither the name of Intel Corporation nor the names of its + * contributors may be used to endorse or promote products derived + * from this software without specific prior written permission. + * + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS + * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT + * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR + * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT + * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, + * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT + * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, + * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY + * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT + * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE + * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + * + */ + + + +#ifndef _SGX_IPPCP_H_ +#define _SGX_IPPCP_H_ + +#ifdef __cplusplus +extern "C" { +#endif + +#ifndef NULL +#ifdef __cplusplus +#define NULL 0 +#else +#define NULL ((void *)0) +#endif +#endif + + #define ippcpGetLibVersion sgx_disp_ippcpGetLibVersion + #define ippsDESGetSize sgx_disp_ippsDESGetSize + #define ippsDESInit sgx_disp_ippsDESInit + #define ippsDESPack sgx_disp_ippsDESPack + #define ippsDESUnpack sgx_disp_ippsDESUnpack + #define ippsTDESEncryptECB sgx_disp_ippsTDESEncryptECB + #define ippsTDESDecryptECB sgx_disp_ippsTDESDecryptECB + #define ippsTDESEncryptCBC sgx_disp_ippsTDESEncryptCBC + #define ippsTDESDecryptCBC sgx_disp_ippsTDESDecryptCBC + #define ippsTDESEncryptCFB sgx_disp_ippsTDESEncryptCFB + #define ippsTDESDecryptCFB sgx_disp_ippsTDESDecryptCFB + #define ippsTDESEncryptOFB sgx_disp_ippsTDESEncryptOFB + #define ippsTDESDecryptOFB sgx_disp_ippsTDESDecryptOFB + #define ippsTDESEncryptCTR sgx_disp_ippsTDESEncryptCTR + #define ippsTDESDecryptCTR sgx_disp_ippsTDESDecryptCTR + #define ippsAESGetSize sgx_disp_ippsAESGetSize + #define ippsAESInit sgx_disp_ippsAESInit + #define ippsAESSetKey sgx_disp_ippsAESSetKey + #define ippsAESPack sgx_disp_ippsAESPack + #define ippsAESUnpack sgx_disp_ippsAESUnpack + #define ippsAESEncryptECB sgx_disp_ippsAESEncryptECB + #define ippsAESDecryptECB sgx_disp_ippsAESDecryptECB + #define ippsAESEncryptCBC sgx_disp_ippsAESEncryptCBC + #define ippsAESEncryptCBC_CS1 sgx_disp_ippsAESEncryptCBC_CS1 + #define ippsAESEncryptCBC_CS2 sgx_disp_ippsAESEncryptCBC_CS2 + #define ippsAESEncryptCBC_CS3 sgx_disp_ippsAESEncryptCBC_CS3 + #define ippsAESDecryptCBC sgx_disp_ippsAESDecryptCBC + #define ippsAESDecryptCBC_CS1 sgx_disp_ippsAESDecryptCBC_CS1 + #define ippsAESDecryptCBC_CS2 sgx_disp_ippsAESDecryptCBC_CS2 + #define ippsAESDecryptCBC_CS3 sgx_disp_ippsAESDecryptCBC_CS3 + #define ippsAESEncryptCFB sgx_disp_ippsAESEncryptCFB + #define ippsAESDecryptCFB sgx_disp_ippsAESDecryptCFB + #define ippsAESEncryptOFB sgx_disp_ippsAESEncryptOFB + #define ippsAESDecryptOFB sgx_disp_ippsAESDecryptOFB + #define ippsAESEncryptCTR sgx_disp_ippsAESEncryptCTR + #define ippsAESDecryptCTR sgx_disp_ippsAESDecryptCTR + #define ippsAESEncryptXTS_Direct sgx_disp_ippsAESEncryptXTS_Direct + #define ippsAESDecryptXTS_Direct sgx_disp_ippsAESDecryptXTS_Direct + #define ippsAES_EncryptCFB16_MB sgx_disp_ippsAES_EncryptCFB16_MB + #define ippsSMS4GetSize sgx_disp_ippsSMS4GetSize + #define ippsSMS4Init sgx_disp_ippsSMS4Init + #define ippsSMS4SetKey sgx_disp_ippsSMS4SetKey + #define ippsSMS4EncryptECB sgx_disp_ippsSMS4EncryptECB + #define ippsSMS4DecryptECB sgx_disp_ippsSMS4DecryptECB + #define ippsSMS4EncryptCBC sgx_disp_ippsSMS4EncryptCBC + #define ippsSMS4EncryptCBC_CS1 sgx_disp_ippsSMS4EncryptCBC_CS1 + #define ippsSMS4EncryptCBC_CS2 sgx_disp_ippsSMS4EncryptCBC_CS2 + #define ippsSMS4EncryptCBC_CS3 sgx_disp_ippsSMS4EncryptCBC_CS3 + #define ippsSMS4DecryptCBC sgx_disp_ippsSMS4DecryptCBC + #define ippsSMS4DecryptCBC_CS1 sgx_disp_ippsSMS4DecryptCBC_CS1 + #define ippsSMS4DecryptCBC_CS2 sgx_disp_ippsSMS4DecryptCBC_CS2 + #define ippsSMS4DecryptCBC_CS3 sgx_disp_ippsSMS4DecryptCBC_CS3 + #define ippsSMS4EncryptCFB sgx_disp_ippsSMS4EncryptCFB + #define ippsSMS4DecryptCFB sgx_disp_ippsSMS4DecryptCFB + #define ippsSMS4EncryptOFB sgx_disp_ippsSMS4EncryptOFB + #define ippsSMS4DecryptOFB sgx_disp_ippsSMS4DecryptOFB + #define ippsSMS4EncryptCTR sgx_disp_ippsSMS4EncryptCTR + #define ippsSMS4DecryptCTR sgx_disp_ippsSMS4DecryptCTR + #define ippsSMS4_CCMGetSize sgx_disp_ippsSMS4_CCMGetSize + #define ippsSMS4_CCMInit sgx_disp_ippsSMS4_CCMInit + #define ippsSMS4_CCMMessageLen sgx_disp_ippsSMS4_CCMMessageLen + #define ippsSMS4_CCMTagLen sgx_disp_ippsSMS4_CCMTagLen + #define ippsSMS4_CCMStart sgx_disp_ippsSMS4_CCMStart + #define ippsSMS4_CCMEncrypt sgx_disp_ippsSMS4_CCMEncrypt + #define ippsSMS4_CCMDecrypt sgx_disp_ippsSMS4_CCMDecrypt + #define ippsSMS4_CCMGetTag sgx_disp_ippsSMS4_CCMGetTag + #define ippsAES_CCMGetSize sgx_disp_ippsAES_CCMGetSize + #define ippsAES_CCMInit sgx_disp_ippsAES_CCMInit + #define ippsAES_CCMMessageLen sgx_disp_ippsAES_CCMMessageLen + #define ippsAES_CCMTagLen sgx_disp_ippsAES_CCMTagLen + #define ippsAES_CCMStart sgx_disp_ippsAES_CCMStart + #define ippsAES_CCMEncrypt sgx_disp_ippsAES_CCMEncrypt + #define ippsAES_CCMDecrypt sgx_disp_ippsAES_CCMDecrypt + #define ippsAES_CCMGetTag sgx_disp_ippsAES_CCMGetTag + #define ippsAES_GCMGetSize sgx_disp_ippsAES_GCMGetSize + #define ippsAES_GCMInit sgx_disp_ippsAES_GCMInit + #define ippsAES_GCMReset sgx_disp_ippsAES_GCMReset + #define ippsAES_GCMProcessIV sgx_disp_ippsAES_GCMProcessIV + #define ippsAES_GCMProcessAAD sgx_disp_ippsAES_GCMProcessAAD + #define ippsAES_GCMStart sgx_disp_ippsAES_GCMStart + #define ippsAES_GCMEncrypt sgx_disp_ippsAES_GCMEncrypt + #define ippsAES_GCMDecrypt sgx_disp_ippsAES_GCMDecrypt + #define ippsAES_GCMGetTag sgx_disp_ippsAES_GCMGetTag + #define ippsAES_XTSGetSize sgx_disp_ippsAES_XTSGetSize + #define ippsAES_XTSInit sgx_disp_ippsAES_XTSInit + #define ippsAES_XTSEncrypt sgx_disp_ippsAES_XTSEncrypt + #define ippsAES_XTSDecrypt sgx_disp_ippsAES_XTSDecrypt + #define ippsAES_S2V_CMAC sgx_disp_ippsAES_S2V_CMAC + #define ippsAES_SIVEncrypt sgx_disp_ippsAES_SIVEncrypt + #define ippsAES_SIVDecrypt sgx_disp_ippsAES_SIVDecrypt + #define ippsAES_CMACGetSize sgx_disp_ippsAES_CMACGetSize + #define ippsAES_CMACInit sgx_disp_ippsAES_CMACInit + #define ippsAES_CMACUpdate sgx_disp_ippsAES_CMACUpdate + #define ippsAES_CMACFinal sgx_disp_ippsAES_CMACFinal + #define ippsAES_CMACGetTag sgx_disp_ippsAES_CMACGetTag + #define ippsARCFourCheckKey sgx_disp_ippsARCFourCheckKey + #define ippsARCFourGetSize sgx_disp_ippsARCFourGetSize + #define ippsARCFourInit sgx_disp_ippsARCFourInit + #define ippsARCFourReset sgx_disp_ippsARCFourReset + #define ippsARCFourPack sgx_disp_ippsARCFourPack + #define ippsARCFourUnpack sgx_disp_ippsARCFourUnpack + #define ippsARCFourEncrypt sgx_disp_ippsARCFourEncrypt + #define ippsARCFourDecrypt sgx_disp_ippsARCFourDecrypt + #define ippsSHA1GetSize sgx_disp_ippsSHA1GetSize + #define ippsSHA1Init sgx_disp_ippsSHA1Init + #define ippsSHA1Duplicate sgx_disp_ippsSHA1Duplicate + #define ippsSHA1Pack sgx_disp_ippsSHA1Pack + #define ippsSHA1Unpack sgx_disp_ippsSHA1Unpack + #define ippsSHA1Update sgx_disp_ippsSHA1Update + #define ippsSHA1GetTag sgx_disp_ippsSHA1GetTag + #define ippsSHA1Final sgx_disp_ippsSHA1Final + #define ippsSHA1MessageDigest sgx_disp_ippsSHA1MessageDigest + #define ippsSHA224GetSize sgx_disp_ippsSHA224GetSize + #define ippsSHA224Init sgx_disp_ippsSHA224Init + #define ippsSHA224Duplicate sgx_disp_ippsSHA224Duplicate + #define ippsSHA224Pack sgx_disp_ippsSHA224Pack + #define ippsSHA224Unpack sgx_disp_ippsSHA224Unpack + #define ippsSHA224Update sgx_disp_ippsSHA224Update + #define ippsSHA224GetTag sgx_disp_ippsSHA224GetTag + #define ippsSHA224Final sgx_disp_ippsSHA224Final + #define ippsSHA224MessageDigest sgx_disp_ippsSHA224MessageDigest + #define ippsSHA256GetSize sgx_disp_ippsSHA256GetSize + #define ippsSHA256Init sgx_disp_ippsSHA256Init + #define ippsSHA256Duplicate sgx_disp_ippsSHA256Duplicate + #define ippsSHA256Pack sgx_disp_ippsSHA256Pack + #define ippsSHA256Unpack sgx_disp_ippsSHA256Unpack + #define ippsSHA256Update sgx_disp_ippsSHA256Update + #define ippsSHA256GetTag sgx_disp_ippsSHA256GetTag + #define ippsSHA256Final sgx_disp_ippsSHA256Final + #define ippsSHA256MessageDigest sgx_disp_ippsSHA256MessageDigest + #define ippsSHA384GetSize sgx_disp_ippsSHA384GetSize + #define ippsSHA384Init sgx_disp_ippsSHA384Init + #define ippsSHA384Duplicate sgx_disp_ippsSHA384Duplicate + #define ippsSHA384Pack sgx_disp_ippsSHA384Pack + #define ippsSHA384Unpack sgx_disp_ippsSHA384Unpack + #define ippsSHA384Update sgx_disp_ippsSHA384Update + #define ippsSHA384GetTag sgx_disp_ippsSHA384GetTag + #define ippsSHA384Final sgx_disp_ippsSHA384Final + #define ippsSHA384MessageDigest sgx_disp_ippsSHA384MessageDigest + #define ippsSHA512GetSize sgx_disp_ippsSHA512GetSize + #define ippsSHA512Init sgx_disp_ippsSHA512Init + #define ippsSHA512Duplicate sgx_disp_ippsSHA512Duplicate + #define ippsSHA512Pack sgx_disp_ippsSHA512Pack + #define ippsSHA512Unpack sgx_disp_ippsSHA512Unpack + #define ippsSHA512Update sgx_disp_ippsSHA512Update + #define ippsSHA512GetTag sgx_disp_ippsSHA512GetTag + #define ippsSHA512Final sgx_disp_ippsSHA512Final + #define ippsSHA512MessageDigest sgx_disp_ippsSHA512MessageDigest + #define ippsMD5GetSize sgx_disp_ippsMD5GetSize + #define ippsMD5Init sgx_disp_ippsMD5Init + #define ippsMD5Duplicate sgx_disp_ippsMD5Duplicate + #define ippsMD5Pack sgx_disp_ippsMD5Pack + #define ippsMD5Unpack sgx_disp_ippsMD5Unpack + #define ippsMD5Update sgx_disp_ippsMD5Update + #define ippsMD5GetTag sgx_disp_ippsMD5GetTag + #define ippsMD5Final sgx_disp_ippsMD5Final + #define ippsMD5MessageDigest sgx_disp_ippsMD5MessageDigest + #define ippsSM3GetSize sgx_disp_ippsSM3GetSize + #define ippsSM3Init sgx_disp_ippsSM3Init + #define ippsSM3Duplicate sgx_disp_ippsSM3Duplicate + #define ippsSM3Pack sgx_disp_ippsSM3Pack + #define ippsSM3Unpack sgx_disp_ippsSM3Unpack + #define ippsSM3Update sgx_disp_ippsSM3Update + #define ippsSM3GetTag sgx_disp_ippsSM3GetTag + #define ippsSM3Final sgx_disp_ippsSM3Final + #define ippsSM3MessageDigest sgx_disp_ippsSM3MessageDigest + #define ippsHashGetSize sgx_disp_ippsHashGetSize + #define ippsHashInit sgx_disp_ippsHashInit + #define ippsHashPack sgx_disp_ippsHashPack + #define ippsHashUnpack sgx_disp_ippsHashUnpack + #define ippsHashDuplicate sgx_disp_ippsHashDuplicate + #define ippsHashUpdate sgx_disp_ippsHashUpdate + #define ippsHashGetTag sgx_disp_ippsHashGetTag + #define ippsHashFinal sgx_disp_ippsHashFinal + #define ippsHashMessage sgx_disp_ippsHashMessage + #define ippsHashMethod_MD5 sgx_disp_ippsHashMethod_MD5 + #define ippsHashMethod_SM3 sgx_disp_ippsHashMethod_SM3 + #define ippsHashMethod_SHA1 sgx_disp_ippsHashMethod_SHA1 + #define ippsHashMethod_SHA1_NI sgx_disp_ippsHashMethod_SHA1_NI + #define ippsHashMethod_SHA1_TT sgx_disp_ippsHashMethod_SHA1_TT + #define ippsHashMethod_SHA256 sgx_disp_ippsHashMethod_SHA256 + #define ippsHashMethod_SHA256_NI sgx_disp_ippsHashMethod_SHA256_NI + #define ippsHashMethod_SHA256_TT sgx_disp_ippsHashMethod_SHA256_TT + #define ippsHashMethod_SHA224 sgx_disp_ippsHashMethod_SHA224 + #define ippsHashMethod_SHA224_NI sgx_disp_ippsHashMethod_SHA224_NI + #define ippsHashMethod_SHA224_TT sgx_disp_ippsHashMethod_SHA224_TT + #define ippsHashMethod_SHA512 sgx_disp_ippsHashMethod_SHA512 + #define ippsHashMethod_SHA384 sgx_disp_ippsHashMethod_SHA384 + #define ippsHashMethod_SHA512_256 sgx_disp_ippsHashMethod_SHA512_256 + #define ippsHashMethod_SHA512_224 sgx_disp_ippsHashMethod_SHA512_224 + #define ippsHashMethodGetSize sgx_disp_ippsHashMethodGetSize + #define ippsHashMethodSet_MD5 sgx_disp_ippsHashMethodSet_MD5 + #define ippsHashMethodSet_SM3 sgx_disp_ippsHashMethodSet_SM3 + #define ippsHashMethodSet_SHA1 sgx_disp_ippsHashMethodSet_SHA1 + #define ippsHashMethodSet_SHA1_NI sgx_disp_ippsHashMethodSet_SHA1_NI + #define ippsHashMethodSet_SHA1_TT sgx_disp_ippsHashMethodSet_SHA1_TT + #define ippsHashMethodSet_SHA256 sgx_disp_ippsHashMethodSet_SHA256 + #define ippsHashMethodSet_SHA256_NI sgx_disp_ippsHashMethodSet_SHA256_NI + #define ippsHashMethodSet_SHA256_TT sgx_disp_ippsHashMethodSet_SHA256_TT + #define ippsHashMethodSet_SHA224 sgx_disp_ippsHashMethodSet_SHA224 + #define ippsHashMethodSet_SHA224_NI sgx_disp_ippsHashMethodSet_SHA224_NI + #define ippsHashMethodSet_SHA224_TT sgx_disp_ippsHashMethodSet_SHA224_TT + #define ippsHashMethodSet_SHA512 sgx_disp_ippsHashMethodSet_SHA512 + #define ippsHashMethodSet_SHA384 sgx_disp_ippsHashMethodSet_SHA384 + #define ippsHashMethodSet_SHA512_256 sgx_disp_ippsHashMethodSet_SHA512_256 + #define ippsHashMethodSet_SHA512_224 sgx_disp_ippsHashMethodSet_SHA512_224 + #define ippsHashGetSize_rmf sgx_disp_ippsHashGetSize_rmf + #define ippsHashInit_rmf sgx_disp_ippsHashInit_rmf + #define ippsHashPack_rmf sgx_disp_ippsHashPack_rmf + #define ippsHashUnpack_rmf sgx_disp_ippsHashUnpack_rmf + #define ippsHashDuplicate_rmf sgx_disp_ippsHashDuplicate_rmf + #define ippsHashUpdate_rmf sgx_disp_ippsHashUpdate_rmf + #define ippsHashGetTag_rmf sgx_disp_ippsHashGetTag_rmf + #define ippsHashFinal_rmf sgx_disp_ippsHashFinal_rmf + #define ippsHashMessage_rmf sgx_disp_ippsHashMessage_rmf + #define ippsHashMethodGetInfo sgx_disp_ippsHashMethodGetInfo + #define ippsHashGetInfo_rmf sgx_disp_ippsHashGetInfo_rmf + #define ippsMGF sgx_disp_ippsMGF + #define ippsMGF1_rmf sgx_disp_ippsMGF1_rmf + #define ippsMGF2_rmf sgx_disp_ippsMGF2_rmf + #define ippsHMAC_GetSize sgx_disp_ippsHMAC_GetSize + #define ippsHMAC_Init sgx_disp_ippsHMAC_Init + #define ippsHMAC_Pack sgx_disp_ippsHMAC_Pack + #define ippsHMAC_Unpack sgx_disp_ippsHMAC_Unpack + #define ippsHMAC_Duplicate sgx_disp_ippsHMAC_Duplicate + #define ippsHMAC_Update sgx_disp_ippsHMAC_Update + #define ippsHMAC_Final sgx_disp_ippsHMAC_Final + #define ippsHMAC_GetTag sgx_disp_ippsHMAC_GetTag + #define ippsHMAC_Message sgx_disp_ippsHMAC_Message + #define ippsHMACGetSize_rmf sgx_disp_ippsHMACGetSize_rmf + #define ippsHMACInit_rmf sgx_disp_ippsHMACInit_rmf + #define ippsHMACPack_rmf sgx_disp_ippsHMACPack_rmf + #define ippsHMACUnpack_rmf sgx_disp_ippsHMACUnpack_rmf + #define ippsHMACDuplicate_rmf sgx_disp_ippsHMACDuplicate_rmf + #define ippsHMACUpdate_rmf sgx_disp_ippsHMACUpdate_rmf + #define ippsHMACFinal_rmf sgx_disp_ippsHMACFinal_rmf + #define ippsHMACGetTag_rmf sgx_disp_ippsHMACGetTag_rmf + #define ippsHMACMessage_rmf sgx_disp_ippsHMACMessage_rmf + #define ippsBigNumGetSize sgx_disp_ippsBigNumGetSize + #define ippsBigNumInit sgx_disp_ippsBigNumInit + #define ippsCmpZero_BN sgx_disp_ippsCmpZero_BN + #define ippsCmp_BN sgx_disp_ippsCmp_BN + #define ippsGetSize_BN sgx_disp_ippsGetSize_BN + #define ippsSet_BN sgx_disp_ippsSet_BN + #define ippsGet_BN sgx_disp_ippsGet_BN + #define ippsRef_BN sgx_disp_ippsRef_BN + #define ippsExtGet_BN sgx_disp_ippsExtGet_BN + #define ippsAdd_BN sgx_disp_ippsAdd_BN + #define ippsSub_BN sgx_disp_ippsSub_BN + #define ippsMul_BN sgx_disp_ippsMul_BN + #define ippsMAC_BN_I sgx_disp_ippsMAC_BN_I + #define ippsDiv_BN sgx_disp_ippsDiv_BN + #define ippsMod_BN sgx_disp_ippsMod_BN + #define ippsGcd_BN sgx_disp_ippsGcd_BN + #define ippsModInv_BN sgx_disp_ippsModInv_BN + #define ippsSetOctString_BN sgx_disp_ippsSetOctString_BN + #define ippsGetOctString_BN sgx_disp_ippsGetOctString_BN + #define ippsMontGetSize sgx_disp_ippsMontGetSize + #define ippsMontInit sgx_disp_ippsMontInit + #define ippsMontSet sgx_disp_ippsMontSet + #define ippsMontGet sgx_disp_ippsMontGet + #define ippsMontForm sgx_disp_ippsMontForm + #define ippsMontMul sgx_disp_ippsMontMul + #define ippsMontExp sgx_disp_ippsMontExp + #define ippsPRNGGetSize sgx_disp_ippsPRNGGetSize + #define ippsPRNGInit sgx_disp_ippsPRNGInit + #define ippsPRNGSetModulus sgx_disp_ippsPRNGSetModulus + #define ippsPRNGSetH0 sgx_disp_ippsPRNGSetH0 + #define ippsPRNGSetAugment sgx_disp_ippsPRNGSetAugment + #define ippsPRNGSetSeed sgx_disp_ippsPRNGSetSeed + #define ippsPRNGGetSeed sgx_disp_ippsPRNGGetSeed + #define ippsPRNGen sgx_disp_ippsPRNGen + #define ippsPRNGen_BN sgx_disp_ippsPRNGen_BN + #define ippsPRNGenRDRAND sgx_disp_ippsPRNGenRDRAND + #define ippsPRNGenRDRAND_BN sgx_disp_ippsPRNGenRDRAND_BN + #define ippsTRNGenRDSEED sgx_disp_ippsTRNGenRDSEED + #define ippsTRNGenRDSEED_BN sgx_disp_ippsTRNGenRDSEED_BN + #define ippsPrimeGetSize sgx_disp_ippsPrimeGetSize + #define ippsPrimeInit sgx_disp_ippsPrimeInit + #define ippsPrimeGen sgx_disp_ippsPrimeGen + #define ippsPrimeTest sgx_disp_ippsPrimeTest + #define ippsPrimeGen_BN sgx_disp_ippsPrimeGen_BN + #define ippsPrimeTest_BN sgx_disp_ippsPrimeTest_BN + #define ippsPrimeGet sgx_disp_ippsPrimeGet + #define ippsPrimeGet_BN sgx_disp_ippsPrimeGet_BN + #define ippsPrimeSet sgx_disp_ippsPrimeSet + #define ippsPrimeSet_BN sgx_disp_ippsPrimeSet_BN + #define ippsRSA_GetSizePublicKey sgx_disp_ippsRSA_GetSizePublicKey + #define ippsRSA_InitPublicKey sgx_disp_ippsRSA_InitPublicKey + #define ippsRSA_SetPublicKey sgx_disp_ippsRSA_SetPublicKey + #define ippsRSA_GetPublicKey sgx_disp_ippsRSA_GetPublicKey + #define ippsRSA_GetSizePrivateKeyType1 sgx_disp_ippsRSA_GetSizePrivateKeyType1 + #define ippsRSA_InitPrivateKeyType1 sgx_disp_ippsRSA_InitPrivateKeyType1 + #define ippsRSA_SetPrivateKeyType1 sgx_disp_ippsRSA_SetPrivateKeyType1 + #define ippsRSA_GetPrivateKeyType1 sgx_disp_ippsRSA_GetPrivateKeyType1 + #define ippsRSA_GetSizePrivateKeyType2 sgx_disp_ippsRSA_GetSizePrivateKeyType2 + #define ippsRSA_InitPrivateKeyType2 sgx_disp_ippsRSA_InitPrivateKeyType2 + #define ippsRSA_SetPrivateKeyType2 sgx_disp_ippsRSA_SetPrivateKeyType2 + #define ippsRSA_GetPrivateKeyType2 sgx_disp_ippsRSA_GetPrivateKeyType2 + #define ippsRSA_GetBufferSizePublicKey sgx_disp_ippsRSA_GetBufferSizePublicKey + #define ippsRSA_GetBufferSizePrivateKey sgx_disp_ippsRSA_GetBufferSizePrivateKey + #define ippsRSA_Encrypt sgx_disp_ippsRSA_Encrypt + #define ippsRSA_Decrypt sgx_disp_ippsRSA_Decrypt + #define ippsRSA_GenerateKeys sgx_disp_ippsRSA_GenerateKeys + #define ippsRSA_ValidateKeys sgx_disp_ippsRSA_ValidateKeys + #define ippsRSAEncrypt_OAEP sgx_disp_ippsRSAEncrypt_OAEP + #define ippsRSADecrypt_OAEP sgx_disp_ippsRSADecrypt_OAEP + #define ippsRSAEncrypt_OAEP_rmf sgx_disp_ippsRSAEncrypt_OAEP_rmf + #define ippsRSADecrypt_OAEP_rmf sgx_disp_ippsRSADecrypt_OAEP_rmf + #define ippsRSAEncrypt_PKCSv15 sgx_disp_ippsRSAEncrypt_PKCSv15 + #define ippsRSADecrypt_PKCSv15 sgx_disp_ippsRSADecrypt_PKCSv15 + #define ippsRSASign_PSS sgx_disp_ippsRSASign_PSS + #define ippsRSAVerify_PSS sgx_disp_ippsRSAVerify_PSS + #define ippsRSASign_PSS_rmf sgx_disp_ippsRSASign_PSS_rmf + #define ippsRSAVerify_PSS_rmf sgx_disp_ippsRSAVerify_PSS_rmf + #define ippsRSASign_PKCS1v15 sgx_disp_ippsRSASign_PKCS1v15 + #define ippsRSAVerify_PKCS1v15 sgx_disp_ippsRSAVerify_PKCS1v15 + #define ippsRSASign_PKCS1v15_rmf sgx_disp_ippsRSASign_PKCS1v15_rmf + #define ippsRSAVerify_PKCS1v15_rmf sgx_disp_ippsRSAVerify_PKCS1v15_rmf + #define ippsDLGetResultString sgx_disp_ippsDLGetResultString + #define ippsDLPGetSize sgx_disp_ippsDLPGetSize + #define ippsDLPInit sgx_disp_ippsDLPInit + #define ippsDLPPack sgx_disp_ippsDLPPack + #define ippsDLPUnpack sgx_disp_ippsDLPUnpack + #define ippsDLPSet sgx_disp_ippsDLPSet + #define ippsDLPGet sgx_disp_ippsDLPGet + #define ippsDLPSetDP sgx_disp_ippsDLPSetDP + #define ippsDLPGetDP sgx_disp_ippsDLPGetDP + #define ippsDLPGenKeyPair sgx_disp_ippsDLPGenKeyPair + #define ippsDLPPublicKey sgx_disp_ippsDLPPublicKey + #define ippsDLPValidateKeyPair sgx_disp_ippsDLPValidateKeyPair + #define ippsDLPSetKeyPair sgx_disp_ippsDLPSetKeyPair + #define ippsDLPSignDSA sgx_disp_ippsDLPSignDSA + #define ippsDLPVerifyDSA sgx_disp_ippsDLPVerifyDSA + #define ippsDLPSharedSecretDH sgx_disp_ippsDLPSharedSecretDH + #define ippsDLPGenerateDSA sgx_disp_ippsDLPGenerateDSA + #define ippsDLPValidateDSA sgx_disp_ippsDLPValidateDSA + #define ippsDLPGenerateDH sgx_disp_ippsDLPGenerateDH + #define ippsDLPValidateDH sgx_disp_ippsDLPValidateDH + #define ippsECCGetResultString sgx_disp_ippsECCGetResultString + #define ippsECCPGetSize sgx_disp_ippsECCPGetSize + #define ippsECCPGetSizeStd128r1 sgx_disp_ippsECCPGetSizeStd128r1 + #define ippsECCPGetSizeStd128r2 sgx_disp_ippsECCPGetSizeStd128r2 + #define ippsECCPGetSizeStd192r1 sgx_disp_ippsECCPGetSizeStd192r1 + #define ippsECCPGetSizeStd224r1 sgx_disp_ippsECCPGetSizeStd224r1 + #define ippsECCPGetSizeStd256r1 sgx_disp_ippsECCPGetSizeStd256r1 + #define ippsECCPGetSizeStd384r1 sgx_disp_ippsECCPGetSizeStd384r1 + #define ippsECCPGetSizeStd521r1 sgx_disp_ippsECCPGetSizeStd521r1 + #define ippsECCPGetSizeStdSM2 sgx_disp_ippsECCPGetSizeStdSM2 + #define ippsECCPInit sgx_disp_ippsECCPInit + #define ippsECCPInitStd128r1 sgx_disp_ippsECCPInitStd128r1 + #define ippsECCPInitStd128r2 sgx_disp_ippsECCPInitStd128r2 + #define ippsECCPInitStd192r1 sgx_disp_ippsECCPInitStd192r1 + #define ippsECCPInitStd224r1 sgx_disp_ippsECCPInitStd224r1 + #define ippsECCPInitStd256r1 sgx_disp_ippsECCPInitStd256r1 + #define ippsECCPInitStd384r1 sgx_disp_ippsECCPInitStd384r1 + #define ippsECCPInitStd521r1 sgx_disp_ippsECCPInitStd521r1 + #define ippsECCPInitStdSM2 sgx_disp_ippsECCPInitStdSM2 + #define ippsECCPSet sgx_disp_ippsECCPSet + #define ippsECCPSetStd sgx_disp_ippsECCPSetStd + #define ippsECCPSetStd128r1 sgx_disp_ippsECCPSetStd128r1 + #define ippsECCPSetStd128r2 sgx_disp_ippsECCPSetStd128r2 + #define ippsECCPSetStd192r1 sgx_disp_ippsECCPSetStd192r1 + #define ippsECCPSetStd224r1 sgx_disp_ippsECCPSetStd224r1 + #define ippsECCPSetStd256r1 sgx_disp_ippsECCPSetStd256r1 + #define ippsECCPSetStd384r1 sgx_disp_ippsECCPSetStd384r1 + #define ippsECCPSetStd521r1 sgx_disp_ippsECCPSetStd521r1 + #define ippsECCPSetStdSM2 sgx_disp_ippsECCPSetStdSM2 + #define ippsECCPBindGxyTblStd192r1 sgx_disp_ippsECCPBindGxyTblStd192r1 + #define ippsECCPBindGxyTblStd224r1 sgx_disp_ippsECCPBindGxyTblStd224r1 + #define ippsECCPBindGxyTblStd256r1 sgx_disp_ippsECCPBindGxyTblStd256r1 + #define ippsECCPBindGxyTblStd384r1 sgx_disp_ippsECCPBindGxyTblStd384r1 + #define ippsECCPBindGxyTblStd521r1 sgx_disp_ippsECCPBindGxyTblStd521r1 + #define ippsECCPBindGxyTblStdSM2 sgx_disp_ippsECCPBindGxyTblStdSM2 + #define ippsECCPGet sgx_disp_ippsECCPGet + #define ippsECCPGetOrderBitSize sgx_disp_ippsECCPGetOrderBitSize + #define ippsECCPValidate sgx_disp_ippsECCPValidate + #define ippsECCPPointGetSize sgx_disp_ippsECCPPointGetSize + #define ippsECCPPointInit sgx_disp_ippsECCPPointInit + #define ippsECCPSetPoint sgx_disp_ippsECCPSetPoint + #define ippsECCPSetPointAtInfinity sgx_disp_ippsECCPSetPointAtInfinity + #define ippsECCPGetPoint sgx_disp_ippsECCPGetPoint + #define ippsECCPCheckPoint sgx_disp_ippsECCPCheckPoint + #define ippsECCPComparePoint sgx_disp_ippsECCPComparePoint + #define ippsECCPNegativePoint sgx_disp_ippsECCPNegativePoint + #define ippsECCPAddPoint sgx_disp_ippsECCPAddPoint + #define ippsECCPMulPointScalar sgx_disp_ippsECCPMulPointScalar + #define ippsECCPGenKeyPair sgx_disp_ippsECCPGenKeyPair + #define ippsECCPPublicKey sgx_disp_ippsECCPPublicKey + #define ippsECCPValidateKeyPair sgx_disp_ippsECCPValidateKeyPair + #define ippsECCPSetKeyPair sgx_disp_ippsECCPSetKeyPair + #define ippsECCPSharedSecretDH sgx_disp_ippsECCPSharedSecretDH + #define ippsECCPSharedSecretDHC sgx_disp_ippsECCPSharedSecretDHC + #define ippsECCPSignDSA sgx_disp_ippsECCPSignDSA + #define ippsECCPVerifyDSA sgx_disp_ippsECCPVerifyDSA + #define ippsECCPSignNR sgx_disp_ippsECCPSignNR + #define ippsECCPVerifyNR sgx_disp_ippsECCPVerifyNR + #define ippsECCPSignSM2 sgx_disp_ippsECCPSignSM2 + #define ippsECCPVerifySM2 sgx_disp_ippsECCPVerifySM2 + #define ippsGFpGetSize sgx_disp_ippsGFpGetSize + #define ippsGFpInitArbitrary sgx_disp_ippsGFpInitArbitrary + #define ippsGFpInitFixed sgx_disp_ippsGFpInitFixed + #define ippsGFpInit sgx_disp_ippsGFpInit + #define ippsGFpMethod_p192r1 sgx_disp_ippsGFpMethod_p192r1 + #define ippsGFpMethod_p224r1 sgx_disp_ippsGFpMethod_p224r1 + #define ippsGFpMethod_p256r1 sgx_disp_ippsGFpMethod_p256r1 + #define ippsGFpMethod_p384r1 sgx_disp_ippsGFpMethod_p384r1 + #define ippsGFpMethod_p521r1 sgx_disp_ippsGFpMethod_p521r1 + #define ippsGFpMethod_p256sm2 sgx_disp_ippsGFpMethod_p256sm2 + #define ippsGFpMethod_p256bn sgx_disp_ippsGFpMethod_p256bn + #define ippsGFpMethod_p256 sgx_disp_ippsGFpMethod_p256 + #define ippsGFpMethod_pArb sgx_disp_ippsGFpMethod_pArb + #define ippsGFpxGetSize sgx_disp_ippsGFpxGetSize + #define ippsGFpxInit sgx_disp_ippsGFpxInit + #define ippsGFpxInitBinomial sgx_disp_ippsGFpxInitBinomial + #define ippsGFpxMethod_binom2_epid2 sgx_disp_ippsGFpxMethod_binom2_epid2 + #define ippsGFpxMethod_binom3_epid2 sgx_disp_ippsGFpxMethod_binom3_epid2 + #define ippsGFpxMethod_binom2 sgx_disp_ippsGFpxMethod_binom2 + #define ippsGFpxMethod_binom3 sgx_disp_ippsGFpxMethod_binom3 + #define ippsGFpxMethod_binom sgx_disp_ippsGFpxMethod_binom + #define ippsGFpxMethod_com sgx_disp_ippsGFpxMethod_com + #define ippsGFpScratchBufferSize sgx_disp_ippsGFpScratchBufferSize + #define ippsGFpElementGetSize sgx_disp_ippsGFpElementGetSize + #define ippsGFpElementInit sgx_disp_ippsGFpElementInit + #define ippsGFpSetElement sgx_disp_ippsGFpSetElement + #define ippsGFpSetElementRegular sgx_disp_ippsGFpSetElementRegular + #define ippsGFpSetElementOctString sgx_disp_ippsGFpSetElementOctString + #define ippsGFpSetElementRandom sgx_disp_ippsGFpSetElementRandom + #define ippsGFpSetElementHash sgx_disp_ippsGFpSetElementHash + #define ippsGFpSetElementHash_rmf sgx_disp_ippsGFpSetElementHash_rmf + #define ippsGFpCpyElement sgx_disp_ippsGFpCpyElement + #define ippsGFpGetElement sgx_disp_ippsGFpGetElement + #define ippsGFpGetElementOctString sgx_disp_ippsGFpGetElementOctString + #define ippsGFpCmpElement sgx_disp_ippsGFpCmpElement + #define ippsGFpIsZeroElement sgx_disp_ippsGFpIsZeroElement + #define ippsGFpIsUnityElement sgx_disp_ippsGFpIsUnityElement + #define ippsGFpConj sgx_disp_ippsGFpConj + #define ippsGFpNeg sgx_disp_ippsGFpNeg + #define ippsGFpInv sgx_disp_ippsGFpInv + #define ippsGFpSqrt sgx_disp_ippsGFpSqrt + #define ippsGFpSqr sgx_disp_ippsGFpSqr + #define ippsGFpAdd sgx_disp_ippsGFpAdd + #define ippsGFpSub sgx_disp_ippsGFpSub + #define ippsGFpMul sgx_disp_ippsGFpMul + #define ippsGFpExp sgx_disp_ippsGFpExp + #define ippsGFpMultiExp sgx_disp_ippsGFpMultiExp + #define ippsGFpAdd_PE sgx_disp_ippsGFpAdd_PE + #define ippsGFpSub_PE sgx_disp_ippsGFpSub_PE + #define ippsGFpMul_PE sgx_disp_ippsGFpMul_PE + #define ippsGFpGetInfo sgx_disp_ippsGFpGetInfo + #define ippsGFpECGetSize sgx_disp_ippsGFpECGetSize + #define ippsGFpECInit sgx_disp_ippsGFpECInit + #define ippsGFpECSet sgx_disp_ippsGFpECSet + #define ippsGFpECSetSubgroup sgx_disp_ippsGFpECSetSubgroup + #define ippsGFpECInitStd128r1 sgx_disp_ippsGFpECInitStd128r1 + #define ippsGFpECInitStd128r2 sgx_disp_ippsGFpECInitStd128r2 + #define ippsGFpECInitStd192r1 sgx_disp_ippsGFpECInitStd192r1 + #define ippsGFpECInitStd224r1 sgx_disp_ippsGFpECInitStd224r1 + #define ippsGFpECInitStd256r1 sgx_disp_ippsGFpECInitStd256r1 + #define ippsGFpECInitStd384r1 sgx_disp_ippsGFpECInitStd384r1 + #define ippsGFpECInitStd521r1 sgx_disp_ippsGFpECInitStd521r1 + #define ippsGFpECInitStdSM2 sgx_disp_ippsGFpECInitStdSM2 + #define ippsGFpECInitStdBN256 sgx_disp_ippsGFpECInitStdBN256 + #define ippsGFpECBindGxyTblStd192r1 sgx_disp_ippsGFpECBindGxyTblStd192r1 + #define ippsGFpECBindGxyTblStd224r1 sgx_disp_ippsGFpECBindGxyTblStd224r1 + #define ippsGFpECBindGxyTblStd256r1 sgx_disp_ippsGFpECBindGxyTblStd256r1 + #define ippsGFpECBindGxyTblStd384r1 sgx_disp_ippsGFpECBindGxyTblStd384r1 + #define ippsGFpECBindGxyTblStd521r1 sgx_disp_ippsGFpECBindGxyTblStd521r1 + #define ippsGFpECBindGxyTblStdSM2 sgx_disp_ippsGFpECBindGxyTblStdSM2 + #define ippsGFpECGet sgx_disp_ippsGFpECGet + #define ippsGFpECGetSubgroup sgx_disp_ippsGFpECGetSubgroup + #define ippsGFpECScratchBufferSize sgx_disp_ippsGFpECScratchBufferSize + #define ippsGFpECVerify sgx_disp_ippsGFpECVerify + #define ippsGFpECPointGetSize sgx_disp_ippsGFpECPointGetSize + #define ippsGFpECPointInit sgx_disp_ippsGFpECPointInit + #define ippsGFpECSetPointAtInfinity sgx_disp_ippsGFpECSetPointAtInfinity + #define ippsGFpECSetPoint sgx_disp_ippsGFpECSetPoint + #define ippsGFpECSetPointRegular sgx_disp_ippsGFpECSetPointRegular + #define ippsGFpECSetPointRandom sgx_disp_ippsGFpECSetPointRandom + #define ippsGFpECMakePoint sgx_disp_ippsGFpECMakePoint + #define ippsGFpECSetPointHash sgx_disp_ippsGFpECSetPointHash + #define ippsGFpECSetPointHashBackCompatible sgx_disp_ippsGFpECSetPointHashBackCompatible + #define ippsGFpECSetPointHash_rmf sgx_disp_ippsGFpECSetPointHash_rmf + #define ippsGFpECSetPointHashBackCompatible_rmf sgx_disp_ippsGFpECSetPointHashBackCompatible_rmf + #define ippsGFpECGetPoint sgx_disp_ippsGFpECGetPoint + #define ippsGFpECGetPointRegular sgx_disp_ippsGFpECGetPointRegular + #define ippsGFpECSetPointOctString sgx_disp_ippsGFpECSetPointOctString + #define ippsGFpECGetPointOctString sgx_disp_ippsGFpECGetPointOctString + #define ippsGFpECTstPoint sgx_disp_ippsGFpECTstPoint + #define ippsGFpECTstPointInSubgroup sgx_disp_ippsGFpECTstPointInSubgroup + #define ippsGFpECCpyPoint sgx_disp_ippsGFpECCpyPoint + #define ippsGFpECCmpPoint sgx_disp_ippsGFpECCmpPoint + #define ippsGFpECNegPoint sgx_disp_ippsGFpECNegPoint + #define ippsGFpECAddPoint sgx_disp_ippsGFpECAddPoint + #define ippsGFpECMulPoint sgx_disp_ippsGFpECMulPoint + #define ippsGFpECPrivateKey sgx_disp_ippsGFpECPrivateKey + #define ippsGFpECPublicKey sgx_disp_ippsGFpECPublicKey + #define ippsGFpECTstKeyPair sgx_disp_ippsGFpECTstKeyPair + #define ippsGFpECSharedSecretDH sgx_disp_ippsGFpECSharedSecretDH + #define ippsGFpECSharedSecretDHC sgx_disp_ippsGFpECSharedSecretDHC + #define ippsGFpECSignDSA sgx_disp_ippsGFpECSignDSA + #define ippsGFpECVerifyDSA sgx_disp_ippsGFpECVerifyDSA + #define ippsGFpECSignNR sgx_disp_ippsGFpECSignNR + #define ippsGFpECVerifyNR sgx_disp_ippsGFpECVerifyNR + #define ippsGFpECSignSM2 sgx_disp_ippsGFpECSignSM2 + #define ippsGFpECVerifySM2 sgx_disp_ippsGFpECVerifySM2 + #define ippsGFpECGetInfo_GF sgx_disp_ippsGFpECGetInfo_GF + #define ippsGFpECESGetSize_SM2 sgx_disp_ippsGFpECESGetSize_SM2 + #define ippsGFpECESInit_SM2 sgx_disp_ippsGFpECESInit_SM2 + #define ippsGFpECESSetKey_SM2 sgx_disp_ippsGFpECESSetKey_SM2 + #define ippsGFpECESStart_SM2 sgx_disp_ippsGFpECESStart_SM2 + #define ippsGFpECESEncrypt_SM2 sgx_disp_ippsGFpECESEncrypt_SM2 + #define ippsGFpECESDecrypt_SM2 sgx_disp_ippsGFpECESDecrypt_SM2 + #define ippsGFpECESFinal_SM2 sgx_disp_ippsGFpECESFinal_SM2 + #define ippsGFpECESGetBuffersSize_SM2 sgx_disp_ippsGFpECESGetBuffersSize_SM2 + + +#ifdef __cplusplus +} +#endif +#endif diff --git a/external/protobuf/Makefile b/external/protobuf/Makefile index 88eedc72..b556b279 100644 --- a/external/protobuf/Makefile +++ b/external/protobuf/Makefile @@ -70,7 +70,7 @@ ifeq ($(shell git rev-parse --is-inside-work-tree), true) git submodule update -f --init $(PB_DIR) else $(RM) -r $(PB_DIR)/ - git clone https://github.com/protocolbuffers/protobuf.git -b v3.14.0 --depth 1 $(PB_DIR) + git clone https://github.com/protocolbuffers/protobuf.git -b 3.20.x --depth 1 $(PB_DIR) endif @@ -78,11 +78,11 @@ $(LIBPB): $(CHECK_SOURCE) ifeq ("$(wildcard $(PB_DIR)/cmake/libsgx_protobuf.cmake)", "") cd $(PB_DIR) && git apply ../sgx_protobuf.patch&& cd .. endif - $(MKDIR) protobuf_code/final_tlibPB/build && cd protobuf_code/final_tlibPB/build && cmake $(PB_CONFIG) -Dprotobuf_BUILD_PROTOC_BINARIES=FALSE -Dprotobuf_BUILD_TESTS=FALSE -DProtobuf_LITE_LIBRARIES=FALSE -DSGX=TRUE ../../cmake && make + $(MKDIR) protobuf_code/final_tlibPB/build && cd protobuf_code/final_tlibPB/build && cmake $(PB_CONFIG) -Dprotobuf_BUILD_TESTS=FALSE -DSGX=TRUE ../../cmake && make libprotobuf ifeq ($(BUILD_PROTOC), 1) $(PROTOCPB): $(CHECK_SOURCE) - $(MKDIR) protobuf_code/final_protocPB/build && cd protobuf_code/final_protocPB/build && cmake -Dprotobuf_BUILD_PROTOC_BINARIES=TRUE -Dprotobuf_BUILD_TESTS=FALSE -DSGX=FALSE ../../cmake && make + $(MKDIR) protobuf_code/final_protocPB/build && cd protobuf_code/final_protocPB/build && cmake -Dprotobuf_BUILD_TESTS=FALSE -DSGX=FALSE -DCMAKE_SKIP_RPATH=TRUE ../../cmake && make protoc endif .PHONY: clean diff --git a/external/protobuf/protobuf_code b/external/protobuf/protobuf_code index 2514f0bd..6e9e6036 160000 --- a/external/protobuf/protobuf_code +++ b/external/protobuf/protobuf_code @@ -1 +1 @@ -Subproject commit 2514f0bd7da7e2af1bed4c5d1b84f031c4d12c10 +Subproject commit 6e9e60367d8744e86856590d8ea0e793c61deeec diff --git a/external/protobuf/sgx_protobuf.patch b/external/protobuf/sgx_protobuf.patch index 5a3cf597..d2c8e9d9 100644 --- a/external/protobuf/sgx_protobuf.patch +++ b/external/protobuf/sgx_protobuf.patch @@ -1,41 +1,41 @@ -From 1fd736c2c796b7ff475a0e26c28acb6a48eb9b5e Mon Sep 17 00:00:00 2001 +From b309912dc33756a51d49af062ba883790d206f14 Mon Sep 17 00:00:00 2001 From: yanxue -Date: Wed, 16 Feb 2022 16:44:18 +0800 +Date: Fri, 6 May 2022 16:04:12 +0800 Subject: [PATCH] Enable Protobuf in SGX --- cmake/CMakeLists.txt | 31 +++- - cmake/libsgx_protobuf.cmake | 137 ++++++++++++++++++ + cmake/libsgx_protobuf.cmake | 140 ++++++++++++++++++ configure.ac | 2 +- - src/google/protobuf/compiler/cpp/cpp_file.cc | 2 + - src/google/protobuf/generated_message_util.cc | 10 ++ - src/google/protobuf/io/coded_stream.h | 4 + - .../protobuf/io/zero_copy_stream_impl.cc | 8 +- + .../protobuf/io/zero_copy_stream_impl.cc | 6 + .../protobuf/io/zero_copy_stream_impl.h | 4 +- - src/google/protobuf/message_lite.cc | 7 +- - src/google/protobuf/message_lite.h | 9 +- - src/google/protobuf/stubs/common.cc | 17 +++ + src/google/protobuf/map.h | 12 ++ + src/google/protobuf/message_lite.cc | 4 + + src/google/protobuf/message_lite.h | 4 + + src/google/protobuf/port_def.inc | 2 +- + src/google/protobuf/repeated_ptr_field.h | 2 +- + src/google/protobuf/stubs/common.cc | 16 ++ src/google/protobuf/stubs/int128.cc | 4 + src/google/protobuf/stubs/int128.h | 4 + - src/google/protobuf/stubs/port.h | 4 + + src/google/protobuf/stubs/port.h | 6 +- src/google/protobuf/stubs/status.cc | 4 + src/google/protobuf/stubs/status.h | 2 + - src/google/protobuf/stubs/stringpiece.cc | 4 + + src/google/protobuf/stubs/stringpiece.cc | 5 +- src/google/protobuf/stubs/stringpiece.h | 2 + src/google/protobuf/stubs/strutil.cc | 35 +++++ src/google/protobuf/stubs/time.cc | 4 + - src/google/protobuf/text_format.cc | 3 + + src/google/protobuf/text_format.cc | 4 + .../protobuf/util/delimited_message_util.cc | 2 + .../protobuf/util/delimited_message_util.h | 7 +- src/google/protobuf/util/time_util.h | 4 + - 24 files changed, 296 insertions(+), 14 deletions(-) + 24 files changed, 292 insertions(+), 14 deletions(-) create mode 100644 cmake/libsgx_protobuf.cmake diff --git a/cmake/CMakeLists.txt b/cmake/CMakeLists.txt -index 52661f522..1d8a2d71a 100644 +index ac92442a1..98e459eb3 100644 --- a/cmake/CMakeLists.txt +++ b/cmake/CMakeLists.txt -@@ -19,6 +19,13 @@ endif() +@@ -23,6 +23,13 @@ endif() # Project project(protobuf C CXX) @@ -49,7 +49,7 @@ index 52661f522..1d8a2d71a 100644 # Add c++11 flags if (CYGWIN) set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -std=gnu++11") -@@ -230,10 +237,20 @@ endif (MSVC) +@@ -277,10 +284,20 @@ endif (MSVC) get_filename_component(protobuf_source_dir ${protobuf_SOURCE_DIR} PATH) @@ -74,7 +74,7 @@ index 52661f522..1d8a2d71a 100644 if (MSVC) # Add the "lib" prefix for generated .lib outputs. -@@ -249,7 +266,11 @@ if (protobuf_UNICODE) +@@ -296,7 +313,11 @@ if (protobuf_UNICODE) endif (protobuf_UNICODE) include(libprotobuf-lite.cmake) @@ -89,10 +89,10 @@ index 52661f522..1d8a2d71a 100644 endif (protobuf_BUILD_LIBPROTOC) diff --git a/cmake/libsgx_protobuf.cmake b/cmake/libsgx_protobuf.cmake new file mode 100644 -index 000000000..262129e49 +index 000000000..2d5b33da5 --- /dev/null +++ b/cmake/libsgx_protobuf.cmake -@@ -0,0 +1,137 @@ +@@ -0,0 +1,140 @@ +set(libprotobuf_files + ${protobuf_source_dir}/src/google/protobuf/any.cc + ${protobuf_source_dir}/src/google/protobuf/any.pb.cc @@ -107,13 +107,15 @@ index 000000000..262129e49 + ${protobuf_source_dir}/src/google/protobuf/empty.pb.cc + ${protobuf_source_dir}/src/google/protobuf/extension_set_heavy.cc + ${protobuf_source_dir}/src/google/protobuf/field_mask.pb.cc ++ ${protobuf_source_dir}/src/google/protobuf/generated_message_bases.cc + ${protobuf_source_dir}/src/google/protobuf/generated_message_reflection.cc -+ ${protobuf_source_dir}/src/google/protobuf/generated_message_table_driven.cc ++ ${protobuf_source_dir}/src/google/protobuf/generated_message_tctable_full.cc + #${protobuf_source_dir}/src/google/protobuf/io/gzip_stream.cc + ${protobuf_source_dir}/src/google/protobuf/io/printer.cc + ${protobuf_source_dir}/src/google/protobuf/io/tokenizer.cc + ${protobuf_source_dir}/src/google/protobuf/map_field.cc + ${protobuf_source_dir}/src/google/protobuf/message.cc ++ ${protobuf_source_dir}/src/google/protobuf/reflection_internal.h + ${protobuf_source_dir}/src/google/protobuf/reflection_ops.cc + ${protobuf_source_dir}/src/google/protobuf/service.cc + ${protobuf_source_dir}/src/google/protobuf/source_context.pb.cc @@ -138,7 +140,6 @@ index 000000000..262129e49 + ${protobuf_source_dir}/src/google/protobuf/util/internal/protostream_objectsource.cc + ${protobuf_source_dir}/src/google/protobuf/util/internal/protostream_objectwriter.cc + ${protobuf_source_dir}/src/google/protobuf/util/internal/type_info.cc -+ ${protobuf_source_dir}/src/google/protobuf/util/internal/type_info_test_helper.cc + ${protobuf_source_dir}/src/google/protobuf/util/internal/utility.cc + ${protobuf_source_dir}/src/google/protobuf/util/json_util.cc + ${protobuf_source_dir}/src/google/protobuf/util/message_differencer.cc @@ -149,7 +150,6 @@ index 000000000..262129e49 +) + +set(libprotobuf_includes -+ ${protobuf_source_dir}/src/google/protobuf/any.h + ${protobuf_source_dir}/src/google/protobuf/any.pb.h + ${protobuf_source_dir}/src/google/protobuf/api.pb.h + #${protobuf_source_dir}/src/google/protobuf/compiler/importer.h @@ -160,18 +160,24 @@ index 000000000..262129e49 + ${protobuf_source_dir}/src/google/protobuf/duration.pb.h + ${protobuf_source_dir}/src/google/protobuf/dynamic_message.h + ${protobuf_source_dir}/src/google/protobuf/empty.pb.h ++ ${protobuf_source_dir}/src/google/protobuf/field_access_listener.h + ${protobuf_source_dir}/src/google/protobuf/field_mask.pb.h ++ ${protobuf_source_dir}/src/google/protobuf/generated_enum_reflection.h ++ ${protobuf_source_dir}/src/google/protobuf/generated_message_bases.h + ${protobuf_source_dir}/src/google/protobuf/generated_message_reflection.h + #${protobuf_source_dir}/src/google/protobuf/io/gzip_stream.h + ${protobuf_source_dir}/src/google/protobuf/io/printer.h + ${protobuf_source_dir}/src/google/protobuf/io/tokenizer.h ++ ${protobuf_source_dir}/src/google/protobuf/map_entry.h + ${protobuf_source_dir}/src/google/protobuf/map_field.h ++ ${protobuf_source_dir}/src/google/protobuf/map_field_inl.h + ${protobuf_source_dir}/src/google/protobuf/message.h ++ ${protobuf_source_dir}/src/google/protobuf/metadata.h ++ ${protobuf_source_dir}/src/google/protobuf/reflection.h + ${protobuf_source_dir}/src/google/protobuf/reflection_ops.h + ${protobuf_source_dir}/src/google/protobuf/service.h + ${protobuf_source_dir}/src/google/protobuf/source_context.pb.h + ${protobuf_source_dir}/src/google/protobuf/struct.pb.h -+ ${protobuf_source_dir}/src/google/protobuf/stubs/substitute.h + ${protobuf_source_dir}/src/google/protobuf/text_format.h + ${protobuf_source_dir}/src/google/protobuf/timestamp.pb.h + ${protobuf_source_dir}/src/google/protobuf/type.pb.h @@ -179,29 +185,16 @@ index 000000000..262129e49 + ${protobuf_source_dir}/src/google/protobuf/util/delimited_message_util.h + ${protobuf_source_dir}/src/google/protobuf/util/field_comparator.h + ${protobuf_source_dir}/src/google/protobuf/util/field_mask_util.h -+ ${protobuf_source_dir}/src/google/protobuf/util/internal/datapiece.h -+ ${protobuf_source_dir}/src/google/protobuf/util/internal/default_value_objectwriter.h -+ ${protobuf_source_dir}/src/google/protobuf/util/internal/error_listener.h -+ ${protobuf_source_dir}/src/google/protobuf/util/internal/field_mask_utility.h -+ ${protobuf_source_dir}/src/google/protobuf/util/internal/json_escaping.h -+ ${protobuf_source_dir}/src/google/protobuf/util/internal/json_objectwriter.h -+ ${protobuf_source_dir}/src/google/protobuf/util/internal/json_stream_parser.h -+ ${protobuf_source_dir}/src/google/protobuf/util/internal/object_writer.h -+ ${protobuf_source_dir}/src/google/protobuf/util/internal/proto_writer.h -+ ${protobuf_source_dir}/src/google/protobuf/util/internal/protostream_objectsource.h -+ ${protobuf_source_dir}/src/google/protobuf/util/internal/protostream_objectwriter.h -+ ${protobuf_source_dir}/src/google/protobuf/util/internal/type_info.h -+ ${protobuf_source_dir}/src/google/protobuf/util/internal/type_info_test_helper.h -+ ${protobuf_source_dir}/src/google/protobuf/util/internal/utility.h + ${protobuf_source_dir}/src/google/protobuf/util/json_util.h + ${protobuf_source_dir}/src/google/protobuf/util/message_differencer.h + ${protobuf_source_dir}/src/google/protobuf/util/time_util.h ++ ${protobuf_source_dir}/src/google/protobuf/util/type_resolver.h + ${protobuf_source_dir}/src/google/protobuf/util/type_resolver_util.h + ${protobuf_source_dir}/src/google/protobuf/wire_format.h + ${protobuf_source_dir}/src/google/protobuf/wrappers.pb.h +) + -+if (MSVC) ++if (CMAKE_CXX_COMPILER_ID STREQUAL "MSVC") +set(libprotobuf_rc_files + ${CMAKE_CURRENT_BINARY_DIR}/version.rc +) @@ -209,29 +202,39 @@ index 000000000..262129e49 + +add_library(libprotobuf ${protobuf_SHARED_OR_STATIC} + ${libprotobuf_lite_files} ${libprotobuf_files} ${libprotobuf_includes} ${libprotobuf_rc_files}) -+target_link_libraries(libprotobuf ${CMAKE_THREAD_LIBS_INIT}) ++if(protobuf_HAVE_LD_VERSION_SCRIPT) ++ if(${CMAKE_VERSION} VERSION_GREATER 3.13 OR ${CMAKE_VERSION} VERSION_EQUAL 3.13) ++ target_link_options(libprotobuf PRIVATE -Wl,--version-script=${protobuf_source_dir}/src/libprotobuf.map) ++ elseif(protobuf_BUILD_SHARED_LIBS) ++ target_link_libraries(libprotobuf PRIVATE -Wl,--version-script=${protobuf_source_dir}/src/libprotobuf.map) ++ endif() ++ set_target_properties(libprotobuf PROPERTIES ++ LINK_DEPENDS ${protobuf_source_dir}/src/libprotobuf.map) ++endif() ++target_link_libraries(libprotobuf PRIVATE ${CMAKE_THREAD_LIBS_INIT}) +if(protobuf_WITH_ZLIB) -+ target_link_libraries(libprotobuf ${ZLIB_LIBRARIES}) ++ target_link_libraries(libprotobuf PRIVATE ${ZLIB_LIBRARIES}) +endif() +if(protobuf_LINK_LIBATOMIC) -+ target_link_libraries(libprotobuf atomic) ++ target_link_libraries(libprotobuf PRIVATE atomic) +endif() +if(${CMAKE_SYSTEM_NAME} STREQUAL "Android") -+ target_link_libraries(libprotobuf log) ++ target_link_libraries(libprotobuf PRIVATE log) +endif() +target_include_directories(libprotobuf PUBLIC ${protobuf_source_dir}/src) -+if(MSVC AND protobuf_BUILD_SHARED_LIBS) ++if(protobuf_BUILD_SHARED_LIBS) + target_compile_definitions(libprotobuf + PUBLIC PROTOBUF_USE_DLLS + PRIVATE LIBPROTOBUF_EXPORTS) +endif() +set_target_properties(libprotobuf PROPERTIES + VERSION ${protobuf_VERSION} ++ SOVERSION 31 + OUTPUT_NAME ${LIB_PREFIX}protobuf + DEBUG_POSTFIX "${protobuf_DEBUG_POSTFIX}") +add_library(protobuf::libprotobuf ALIAS libprotobuf) diff --git a/configure.ac b/configure.ac -index eb70a76e1..3402990f8 100644 +index 5de1ce20a..712fa41d5 100644 --- a/configure.ac +++ b/configure.ac @@ -106,7 +106,7 @@ ACX_CHECK_SUNCC @@ -243,88 +246,11 @@ index eb70a76e1..3402990f8 100644 # Check whether the linker supports version scripts AC_MSG_CHECKING([whether the linker supports version scripts]) -diff --git a/src/google/protobuf/compiler/cpp/cpp_file.cc b/src/google/protobuf/compiler/cpp/cpp_file.cc -index 875beec9f..732b0e915 100644 ---- a/src/google/protobuf/compiler/cpp/cpp_file.cc -+++ b/src/google/protobuf/compiler/cpp/cpp_file.cc -@@ -75,6 +75,8 @@ std::string GetSortKey(const FileDescriptor& val) { - - template <> - std::string GetSortKey(const SCC& val) { -+ if (val.GetRepresentative() == nullptr) -+ return std::string(""); - return val.GetRepresentative()->full_name(); - } - -diff --git a/src/google/protobuf/generated_message_util.cc b/src/google/protobuf/generated_message_util.cc -index f1f6f8833..b02f91d0d 100644 ---- a/src/google/protobuf/generated_message_util.cc -+++ b/src/google/protobuf/generated_message_util.cc -@@ -39,7 +39,11 @@ - #ifndef GOOGLE_PROTOBUF_SUPPORT_WINDOWS_XP - // We're only using this as a standard way for getting the thread id. - // We're not using any thread functionality. -+#ifndef PB_ENABLE_SGX - #include // NOLINT -+#else -+#include -+#endif - #endif // #ifndef GOOGLE_PROTOBUF_SUPPORT_WINDOWS_XP - - #include -@@ -762,6 +766,7 @@ void InitSCC_DFS(SCCInfoBase* scc) { - } // namespace - - void InitSCCImpl(SCCInfoBase* scc) { -+#ifndef PB_ENABLE_SGX - static WrappedMutex mu{GOOGLE_PROTOBUF_LINKER_INITIALIZED}; - // Either the default in case no initialization is running or the id of the - // thread that is currently initializing. -@@ -785,11 +790,15 @@ void InitSCCImpl(SCCInfoBase* scc) { - SCCInfoBase::kRunning); - return; - } -+#endif//PB_ENABLE_SGX - InitProtobufDefaults(); -+#ifndef PB_ENABLE_SGX - mu.Lock(); - runner.store(me, std::memory_order_relaxed); -+#endif //PB_ENABLE_SGX - InitSCC_DFS(scc); - -+#ifndef PB_ENABLE_SGX - #ifndef GOOGLE_PROTOBUF_SUPPORT_WINDOWS_XP - runner.store(std::thread::id{}, std::memory_order_relaxed); - #else -@@ -797,6 +806,7 @@ void InitSCCImpl(SCCInfoBase* scc) { - #endif // #ifndef GOOGLE_PROTOBUF_SUPPORT_WINDOWS_XP - - mu.Unlock(); -+#endif //PB_ENABLE_SGX - } - - } // namespace internal -diff --git a/src/google/protobuf/io/coded_stream.h b/src/google/protobuf/io/coded_stream.h -index 0fff1782c..431a1c994 100644 ---- a/src/google/protobuf/io/coded_stream.h -+++ b/src/google/protobuf/io/coded_stream.h -@@ -131,7 +131,11 @@ - #pragma runtime_checks("c", off) - #endif - #else -+#ifndef PB_ENABLE_SGX - #include // __BYTE_ORDER -+#else -+#include -+#endif //PB_ENABLE_SGX - #if ((defined(__LITTLE_ENDIAN__) && !defined(__BIG_ENDIAN__)) || \ - (defined(__BYTE_ORDER) && __BYTE_ORDER == __LITTLE_ENDIAN)) && \ - !defined(PROTOBUF_DISABLE_LITTLE_ENDIAN_OPT_FOR_TEST) diff --git a/src/google/protobuf/io/zero_copy_stream_impl.cc b/src/google/protobuf/io/zero_copy_stream_impl.cc -index 52617e9ef..08de285a3 100644 +index c66bc862a..1fee728cd 100644 --- a/src/google/protobuf/io/zero_copy_stream_impl.cc +++ b/src/google/protobuf/io/zero_copy_stream_impl.cc -@@ -33,15 +33,20 @@ +@@ -33,15 +33,19 @@ // Sanjay Ghemawat, Jeff Dean, and others. #ifndef _MSC_VER @@ -338,14 +264,13 @@ index 52617e9ef..08de285a3 100644 #include #include -+ +#ifndef PB_ENABLE_SGX #include +#endif //PB_ENABLE_SGX #include #include -@@ -67,6 +72,7 @@ using google::protobuf::io::win32::read; +@@ -67,6 +71,7 @@ using google::protobuf::io::win32::read; using google::protobuf::io::win32::write; #endif @@ -353,20 +278,19 @@ index 52617e9ef..08de285a3 100644 namespace { // EINTR sucks. -@@ -298,7 +304,7 @@ bool OstreamOutputStream::CopyingOstreamOutputStream::Write(const void* buffer, +@@ -304,6 +309,7 @@ bool OstreamOutputStream::CopyingOstreamOutputStream::Write(const void* buffer, output_->write(reinterpret_cast(buffer), size); return output_->good(); } -- +#endif //PB_ENABLE_SGX + // =================================================================== - ConcatenatingInputStream::ConcatenatingInputStream( diff --git a/src/google/protobuf/io/zero_copy_stream_impl.h b/src/google/protobuf/io/zero_copy_stream_impl.h -index 0206e3887..1f0b19ce3 100644 +index a385992f2..57e261954 100644 --- a/src/google/protobuf/io/zero_copy_stream_impl.h +++ b/src/google/protobuf/io/zero_copy_stream_impl.h -@@ -53,7 +53,7 @@ +@@ -54,7 +54,7 @@ namespace google { namespace protobuf { namespace io { @@ -375,7 +299,7 @@ index 0206e3887..1f0b19ce3 100644 // =================================================================== // A ZeroCopyInputStream which reads from a file descriptor. -@@ -282,7 +282,7 @@ class PROTOBUF_EXPORT OstreamOutputStream : public ZeroCopyOutputStream { +@@ -290,7 +290,7 @@ class PROTOBUF_EXPORT OstreamOutputStream PROTOBUF_FUTURE_FINAL GOOGLE_DISALLOW_EVIL_CONSTRUCTORS(OstreamOutputStream); }; @@ -384,29 +308,60 @@ index 0206e3887..1f0b19ce3 100644 // =================================================================== // A ZeroCopyInputStream which reads from several other streams in sequence. +diff --git a/src/google/protobuf/map.h b/src/google/protobuf/map.h +index 09d03b812..4e78bdc59 100644 +--- a/src/google/protobuf/map.h ++++ b/src/google/protobuf/map.h +@@ -69,6 +69,11 @@ + // Must be included last. + #include + ++#ifdef PB_ENABLE_SGX ++#include "sgx_trts.h" ++#include "sgx_error.h" ++#endif //PB_ENABLE_SGX ++ + namespace google { + namespace protobuf { + +@@ -1093,9 +1098,16 @@ class Map { + // iOS, tvOS, watchOS, etc). + s += mach_absolute_time(); + #elif defined(__x86_64__) && defined(__GNUC__) ++#ifndef PB_ENABLE_SGX + uint32_t hi, lo; + asm volatile("rdtsc" : "=a"(lo), "=d"(hi)); + s += ((static_cast(hi) << 32) | lo); ++#else ++ uint64_t random_num; ++ if (SGX_SUCCESS != sgx_read_rand((unsigned char *)&random_num, sizeof(uint64_t))) ++ abort(); ++ s += random_num; ++#endif //PB_ENABLE_SGX + #elif defined(__aarch64__) && defined(__GNUC__) + // There is no rdtsc on ARMv8. CNTVCT_EL0 is the virtual counter of the + // system timer. It runs at a different frequency than the CPU's, but is diff --git a/src/google/protobuf/message_lite.cc b/src/google/protobuf/message_lite.cc -index 0e8599147..c533c9f3e 100644 +index 3a1b67bf6..5d540ed68 100644 --- a/src/google/protobuf/message_lite.cc +++ b/src/google/protobuf/message_lite.cc -@@ -272,7 +272,7 @@ bool MessageLite::ParsePartialFromZeroCopyStream( - io::ZeroCopyInputStream* input) { +@@ -265,6 +265,7 @@ bool MessageLite::ParsePartialFromZeroCopyStream( return ParseFrom(input); } -- + +#ifndef PB_ENABLE_SGX bool MessageLite::ParseFromFileDescriptor(int file_descriptor) { io::FileInputStream input(file_descriptor); return ParseFromZeroCopyStream(&input) && input.GetErrno() == 0; -@@ -292,7 +292,7 @@ bool MessageLite::ParsePartialFromIstream(std::istream* input) { +@@ -284,6 +285,7 @@ bool MessageLite::ParsePartialFromIstream(std::istream* input) { io::IstreamInputStream zero_copy_input(input); return ParsePartialFromZeroCopyStream(&zero_copy_input) && input->eof(); } -- +#endif //PB_ENABLE_SGX + bool MessageLite::MergePartialFromBoundedZeroCopyStream( io::ZeroCopyInputStream* input, int size) { - return ParseFrom(internal::BoundedZCIS{input, size}); -@@ -422,6 +422,7 @@ bool MessageLite::SerializePartialToZeroCopyStream( +@@ -414,6 +416,7 @@ bool MessageLite::SerializePartialToZeroCopyStream( return true; } @@ -414,52 +369,72 @@ index 0e8599147..c533c9f3e 100644 bool MessageLite::SerializeToFileDescriptor(int file_descriptor) const { io::FileOutputStream output(file_descriptor); return SerializeToZeroCopyStream(&output) && output.Flush(); -@@ -444,7 +445,7 @@ bool MessageLite::SerializePartialToOstream(std::ostream* output) const { +@@ -436,6 +439,7 @@ bool MessageLite::SerializePartialToOstream(std::ostream* output) const { io::OstreamOutputStream zero_copy_output(output); return SerializePartialToZeroCopyStream(&zero_copy_output); } -- +#endif //PB_ENABLE_SGX + bool MessageLite::AppendToString(std::string* output) const { GOOGLE_DCHECK(IsInitialized()) << InitializationErrorMessage("serialize", *this); - return AppendPartialToString(output); diff --git a/src/google/protobuf/message_lite.h b/src/google/protobuf/message_lite.h -index a76c16e5a..cc6291162 100644 +index 1c22f894e..69006e686 100644 --- a/src/google/protobuf/message_lite.h +++ b/src/google/protobuf/message_lite.h -@@ -310,11 +310,15 @@ class PROTOBUF_EXPORT MessageLite { +@@ -254,11 +254,13 @@ class PROTOBUF_EXPORT MessageLite { int file_descriptor); // Parse a protocol buffer from a C++ istream. If successful, the entire // input will be consumed. +#ifndef PB_ENABLE_SGX PROTOBUF_ATTRIBUTE_REINITIALIZES bool ParseFromIstream(std::istream* input); -+#endif // Like ParseFromIstream(), but accepts messages that are missing // required fields. -+#ifndef PB_ENABLE_SGX PROTOBUF_ATTRIBUTE_REINITIALIZES bool ParsePartialFromIstream( std::istream* input); -+#endif ++#endif //PB_ENABLE_SGX // Read a protocol buffer from the given zero-copy input stream, expecting // the message to be exactly "size" bytes long. If successful, exactly // this many bytes will have been consumed from the input. -@@ -415,10 +419,13 @@ class PROTOBUF_EXPORT MessageLite { +@@ -359,9 +361,11 @@ class PROTOBUF_EXPORT MessageLite { bool SerializePartialToFileDescriptor(int file_descriptor) const; // Serialize the message and write it to the given C++ ostream. All // required fields must be set. +#ifndef PB_ENABLE_SGX bool SerializeToOstream(std::ostream* output) const; -+#endif // Like SerializeToOstream(), but allows missing required fields. -+#ifndef PB_ENABLE_SGX bool SerializePartialToOstream(std::ostream* output) const; -- -+#endif ++#endif //PB_ENABLE_SGX + // Like SerializeToString(), but appends to the data to the string's // existing contents. All required fields must be set. - bool AppendToString(std::string* output) const; +diff --git a/src/google/protobuf/port_def.inc b/src/google/protobuf/port_def.inc +index 31ab3b159..cadbf1645 100644 +--- a/src/google/protobuf/port_def.inc ++++ b/src/google/protobuf/port_def.inc +@@ -608,7 +608,7 @@ + (!defined(__APPLE__) && __clang_major__ >= 12)) + #define PROTOBUF_CONSTINIT [[clang::require_constant_initialization]] + #define PROTOBUF_CONSTEXPR constexpr +-#elif PROTOBUF_GNUC_MIN(12, 0) ++#elif PROTOBUF_GNUC_MIN(13, 0) + #define PROTOBUF_CONSTINIT __constinit + #define PROTOBUF_CONSTEXPR constexpr + #else +diff --git a/src/google/protobuf/repeated_ptr_field.h b/src/google/protobuf/repeated_ptr_field.h +index e81b2c7e4..205d3b287 100644 +--- a/src/google/protobuf/repeated_ptr_field.h ++++ b/src/google/protobuf/repeated_ptr_field.h +@@ -749,7 +749,7 @@ class GenericTypeHandler { + static inline GenericType* New(Arena* arena, GenericType&& value) { + return Arena::Create(arena, std::move(value)); + } +- static inline GenericType* NewFromPrototype(const GenericType* prototype, ++ static inline GenericType* NewFromPrototype(const GenericType* /*prototype*/, + Arena* arena = nullptr) { + return New(arena); + } diff --git a/src/google/protobuf/stubs/common.cc b/src/google/protobuf/stubs/common.cc -index bc150f56a..c7be73d57 100644 +index 82d46531f..203a0cffe 100644 --- a/src/google/protobuf/stubs/common.cc +++ b/src/google/protobuf/stubs/common.cc @@ -35,7 +35,11 @@ @@ -474,7 +449,7 @@ index bc150f56a..c7be73d57 100644 #include #ifdef _WIN32 -@@ -161,6 +165,9 @@ inline void DefaultLogHandler(LogLevel level, const char* filename, int line, +@@ -157,6 +161,9 @@ inline void DefaultLogHandler(LogLevel level, const char* filename, int line, } #else @@ -484,7 +459,7 @@ index bc150f56a..c7be73d57 100644 void DefaultLogHandler(LogLevel level, const char* filename, int line, const std::string& message) { if (level < GOOGLE_PROTOBUF_MIN_LOG_LEVEL) { -@@ -170,9 +177,15 @@ void DefaultLogHandler(LogLevel level, const char* filename, int line, +@@ -166,9 +173,14 @@ void DefaultLogHandler(LogLevel level, const char* filename, int line, // We use fprintf() instead of cerr because we want this to work at static // initialization time. @@ -496,11 +471,10 @@ index bc150f56a..c7be73d57 100644 + printf("[libprotobuf %s %s:%d] %s\n", level_names[level], filename, line, + message.c_str()); +#endif //PB_ENABLE_SGX -+ } #endif -@@ -205,9 +218,13 @@ LogMessage& LogMessage::operator<<(const util::Status& status) { +@@ -201,9 +213,13 @@ LogMessage& LogMessage::operator<<(const util::Status& status) { } LogMessage& LogMessage::operator<<(const uint128& value) { @@ -515,7 +489,7 @@ index bc150f56a..c7be73d57 100644 } diff --git a/src/google/protobuf/stubs/int128.cc b/src/google/protobuf/stubs/int128.cc -index 2119e6550..68968760e 100644 +index b60722def..0a4c96c3a 100644 --- a/src/google/protobuf/stubs/int128.cc +++ b/src/google/protobuf/stubs/int128.cc @@ -31,7 +31,9 @@ @@ -528,7 +502,7 @@ index 2119e6550..68968760e 100644 #include #include -@@ -125,6 +127,7 @@ uint128& uint128::operator%=(const uint128& divisor) { +@@ -123,6 +125,7 @@ uint128& uint128::operator%=(const uint128& divisor) { return *this; } @@ -536,7 +510,7 @@ index 2119e6550..68968760e 100644 std::ostream& operator<<(std::ostream& o, const uint128& b) { std::ios_base::fmtflags flags = o.flags(); -@@ -187,6 +190,7 @@ std::ostream& operator<<(std::ostream& o, const uint128& b) { +@@ -186,6 +189,7 @@ std::ostream& operator<<(std::ostream& o, const uint128& b) { // Stream the final representation in a single "<<" call. return o << rep; } @@ -573,25 +547,31 @@ index dc70d96eb..bfca3bfc6 100644 // Methods to access low and high pieces of 128-bit value. // Defined externally from uint128 to facilitate conversion diff --git a/src/google/protobuf/stubs/port.h b/src/google/protobuf/stubs/port.h -index 0fcee6891..8e017b735 100644 +index 045e25d89..8eb363834 100644 --- a/src/google/protobuf/stubs/port.h +++ b/src/google/protobuf/stubs/port.h -@@ -57,9 +57,13 @@ - #pragma runtime_checks("c", off) - #endif - #else -+#ifndef PB_ENABLE_SGX - #include // __BYTE_ORDER - #if defined(__OpenBSD__) - #include -+#else -+ #include -+#endif //PB_ENABLE_SGX - #endif - #if ((defined(__LITTLE_ENDIAN__) && !defined(__BIG_ENDIAN__)) || \ - (defined(__BYTE_ORDER) && __BYTE_ORDER == __LITTLE_ENDIAN) || \ +@@ -84,7 +84,8 @@ + #include + #elif defined(__APPLE__) + #include +-#elif defined(__linux__) || defined(__ANDROID__) || defined(__CYGWIN__) ++//#elif defined(__linux__) || defined(__ANDROID__) || defined(__CYGWIN__) ++#elif defined(__GLIBC__) || defined(__BIONIC__) || defined(__CYGWIN__) //for SGX + #include // IWYU pragma: export + #endif + +@@ -248,7 +249,8 @@ inline void GOOGLE_UNALIGNED_STORE64(void *p, uint64 v) { + #define bswap_32(x) OSSwapInt32(x) + #define bswap_64(x) OSSwapInt64(x) + +-#elif !defined(__linux__) && !defined(__ANDROID__) && !defined(__CYGWIN__) ++//#elif !defined(__linux__) && !defined(__ANDROID__) && !defined(__CYGWIN__) ++#elif !defined(__GLIBC__) && !defined(__BIONIC__) && !defined(__CYGWIN__) //for SGX + + #ifndef bswap_16 + static inline uint16 bswap_16(uint16 x) { diff --git a/src/google/protobuf/stubs/status.cc b/src/google/protobuf/stubs/status.cc -index 03b37c365..f53c1781e 100644 +index f5c0fa48f..3c134fde6 100644 --- a/src/google/protobuf/stubs/status.cc +++ b/src/google/protobuf/stubs/status.cc @@ -29,7 +29,9 @@ @@ -604,9 +584,9 @@ index 03b37c365..f53c1781e 100644 #include #include #include -@@ -124,10 +126,12 @@ std::string Status::ToString() const { - } - } +@@ -123,10 +125,12 @@ std::string Status::ToString() const { + + Status OkStatus() { return Status(); } +#ifndef PB_ENABLE_SGX std::ostream& operator<<(std::ostream& os, const Status& x) { @@ -615,28 +595,28 @@ index 03b37c365..f53c1781e 100644 } +#endif //PB_ENABLE_SGX - } // namespace util - } // namespace protobuf + bool IsAborted(const Status& status) { + return status.code() == StatusCode::kAborted; diff --git a/src/google/protobuf/stubs/status.h b/src/google/protobuf/stubs/status.h -index bededad54..2d82c8c76 100644 +index c858cf623..ee72b6c6a 100644 --- a/src/google/protobuf/stubs/status.h +++ b/src/google/protobuf/stubs/status.h -@@ -113,8 +113,10 @@ class PROTOBUF_EXPORT Status { - std::string error_message_; - }; +@@ -101,8 +101,10 @@ class PROTOBUF_EXPORT Status { + // usage of `OkStatus()` when constructing such an OK status. + PROTOBUF_EXPORT Status OkStatus(); +#ifndef PB_ENABLE_SGX // Prints a human-readable representation of 'x' to 'os'. PROTOBUF_EXPORT std::ostream& operator<<(std::ostream& os, const Status& x); +#endif //PB_ENABLE_SGX - } // namespace util - } // namespace protobuf + // These convenience functions return `true` if a given status matches the + // `StatusCode` error code of its associated function. diff --git a/src/google/protobuf/stubs/stringpiece.cc b/src/google/protobuf/stubs/stringpiece.cc -index 353c78cad..1ed4546ba 100644 +index 71880464c..f6801cf4d 100644 --- a/src/google/protobuf/stubs/stringpiece.cc +++ b/src/google/protobuf/stubs/stringpiece.cc -@@ -33,16 +33,20 @@ +@@ -33,18 +33,21 @@ #include #include #include @@ -648,6 +628,8 @@ index 353c78cad..1ed4546ba 100644 namespace google { namespace protobuf { + namespace stringpiece_internal { +- +#ifndef PB_ENABLE_SGX std::ostream& operator<<(std::ostream& o, StringPiece piece) { o.write(piece.data(), piece.size()); @@ -655,13 +637,13 @@ index 353c78cad..1ed4546ba 100644 } +#endif //PB_ENABLE_SGX - // Out-of-line error path. void StringPiece::LogFatalSizeTooBig(size_t size, const char* details) { + GOOGLE_LOG(FATAL) << "size too big: " << size << " details: " << details; diff --git a/src/google/protobuf/stubs/stringpiece.h b/src/google/protobuf/stubs/stringpiece.h -index fbcb20afc..afd567eed 100644 +index c63e25b25..0122672a9 100644 --- a/src/google/protobuf/stubs/stringpiece.h +++ b/src/google/protobuf/stubs/stringpiece.h -@@ -423,8 +423,10 @@ inline bool operator>=(StringPiece x, StringPiece y) { +@@ -375,8 +375,10 @@ inline bool operator>=(StringPiece x, StringPiece y) { return !(x < y); } @@ -670,10 +652,10 @@ index fbcb20afc..afd567eed 100644 extern std::ostream& operator<<(std::ostream& o, StringPiece piece); +#endif //PB_ENABLE_SGX - namespace internal { - // StringPiece is not a POD and can not be used in an union (pre C++11). We + } // namespace stringpiece_internal + diff --git a/src/google/protobuf/stubs/strutil.cc b/src/google/protobuf/stubs/strutil.cc -index 2ecdb2bf7..4944f6380 100644 +index 7c84cac2e..776001f8a 100644 --- a/src/google/protobuf/stubs/strutil.cc +++ b/src/google/protobuf/stubs/strutil.cc @@ -39,6 +39,9 @@ @@ -694,7 +676,7 @@ index 2ecdb2bf7..4944f6380 100644 sprintf(dest + used, (use_hex ? "\\x%02x" : "\\%03o"), static_cast(*src)); +#else -+ snprintf(dest + used, dest_len - used, ++ snprintf(dest + used, dest_len - used, + (use_hex ? "\\x%02x" : "\\%03o"), + static_cast(*src)); +#endif //PB_ENABLE_SGX @@ -703,7 +685,7 @@ index 2ecdb2bf7..4944f6380 100644 } else { @@ -1246,6 +1255,7 @@ char* DoubleToBuffer(double value, char* buffer) { // this assert. - GOOGLE_COMPILE_ASSERT(DBL_DIG < 20, DBL_DIG_is_too_big); + static_assert(DBL_DIG < 20, "DBL_DIG_is_too_big"); +#ifndef PB_ENABLE_SGX if (value == std::numeric_limits::infinity()) { @@ -730,7 +712,7 @@ index 2ecdb2bf7..4944f6380 100644 snprintf(buffer, kDoubleToBufferSize, "%.*g", DBL_DIG, value); @@ -1364,6 +1386,7 @@ char* FloatToBuffer(float value, char* buffer) { // this assert. - GOOGLE_COMPILE_ASSERT(FLT_DIG < 10, FLT_DIG_is_too_big); + static_assert(FLT_DIG < 10, "FLT_DIG_is_too_big"); +#ifndef PB_ENABLE_SGX if (value == std::numeric_limits::infinity()) { @@ -772,21 +754,22 @@ index 922be76d1..4efb2e85e 100644 } diff --git a/src/google/protobuf/text_format.cc b/src/google/protobuf/text_format.cc -index f47d4e8d0..afd178c6f 100644 +index 880b16dde..8cd82000b 100644 --- a/src/google/protobuf/text_format.cc +++ b/src/google/protobuf/text_format.cc -@@ -63,6 +63,9 @@ - #include - #include +@@ -67,6 +67,10 @@ + + #define DEBUG_STRING_SILENT_MARKER "\t " +#ifdef PB_ENABLE_SGX +extern "C" int printf(const char* fmt, ...); +#endif //PB_ENABLE_SGX - ++ namespace google { namespace protobuf { + diff --git a/src/google/protobuf/util/delimited_message_util.cc b/src/google/protobuf/util/delimited_message_util.cc -index 425dc2cfd..d07637d3b 100644 +index 80cab309b..c97790c68 100644 --- a/src/google/protobuf/util/delimited_message_util.cc +++ b/src/google/protobuf/util/delimited_message_util.cc @@ -38,6 +38,7 @@ namespace google { @@ -806,7 +789,7 @@ index 425dc2cfd..d07637d3b 100644 bool ParseDelimitedFromCodedStream(MessageLite* message, io::CodedInputStream* input, diff --git a/src/google/protobuf/util/delimited_message_util.h b/src/google/protobuf/util/delimited_message_util.h -index d3f7dbe8a..4fe6fd190 100644 +index 78625cf2f..c3c11cb1b 100644 --- a/src/google/protobuf/util/delimited_message_util.h +++ b/src/google/protobuf/util/delimited_message_util.h @@ -34,8 +34,9 @@ @@ -820,7 +803,7 @@ index d3f7dbe8a..4fe6fd190 100644 #include #include -@@ -63,11 +64,13 @@ namespace util { +@@ -64,11 +65,13 @@ namespace util { // then parse it. As a result, they may read past the end of the delimited // message. There is no way for them to push the extra data back into the // underlying source, so instead you must keep using the same stream object. @@ -834,7 +817,7 @@ index d3f7dbe8a..4fe6fd190 100644 // Read a single size-delimited message from the given stream. Delimited // format allows a single file or stream to contain multiple messages, -@@ -81,8 +84,10 @@ bool PROTOBUF_EXPORT SerializeDelimitedToOstream(const MessageLite& message, +@@ -82,8 +85,10 @@ bool PROTOBUF_EXPORT SerializeDelimitedToOstream(const MessageLite& message, // otherwise it will be set false. Note that these methods return false // on EOF, but they also return false on other errors, so |clean_eof| is // needed to distinguish a clean end from errors. @@ -846,10 +829,10 @@ index d3f7dbe8a..4fe6fd190 100644 bool PROTOBUF_EXPORT ParseDelimitedFromCodedStream(MessageLite* message, io::CodedInputStream* input, diff --git a/src/google/protobuf/util/time_util.h b/src/google/protobuf/util/time_util.h -index 95063fc49..084c996a1 100644 +index 95cc64520..6d7c44775 100644 --- a/src/google/protobuf/util/time_util.h +++ b/src/google/protobuf/util/time_util.h -@@ -43,10 +43,14 @@ struct timeval { +@@ -44,10 +44,14 @@ struct timeval { int64 tv_usec; /* and microseconds */ }; #else diff --git a/external/sgxssl/prepare_sgxssl.sh b/external/sgxssl/prepare_sgxssl.sh index 5d0be144..1f68d58f 100755 --- a/external/sgxssl/prepare_sgxssl.sh +++ b/external/sgxssl/prepare_sgxssl.sh @@ -32,16 +32,16 @@ top_dir="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )" openssl_out_dir=$top_dir/openssl_source -openssl_ver=1.1.1m +openssl_ver=1.1.1o openssl_ver_name=openssl-$openssl_ver sgxssl_github_archive=https://github.com/intel/intel-sgx-ssl/archive -sgxssl_file_name=lin_2.16_1.1.1m_update +sgxssl_file_name=lin_2.17_1.1.1o build_script=$top_dir/Linux/build_openssl.sh server_url_path=https://www.openssl.org/source full_openssl_url=$server_url_path/old/1.1.1/$openssl_ver_name.tar.gz -sgxssl_chksum=46d3e6113da446f0fb250d9ca3b73f06b4fbc4e8f552c98f5de0865ee38caffc -openssl_chksum=f89199be8b23ca45fc7cb9f1d8d3ee67312318286ad030f5316aca6462db6c96 +sgxssl_chksum=f0ed7bd37b45fd2350ec835a9c56b5590554e13b94471a38d3379054448a6d4b +openssl_chksum=9384a2b0570dd80358841464677115df785edb941c71211f75076d72fe6b438f rm -f check_sum_sgxssl.txt check_sum_openssl.txt if [ ! -f $build_script ]; then wget $sgxssl_github_archive/$sgxssl_file_name.zip -P $top_dir || exit 1 diff --git a/linux/installer/bin/install-sgx-psw.bin.tmpl b/linux/installer/bin/install-sgx-psw.bin.tmpl index 243d379c..36fea100 100755 --- a/linux/installer/bin/install-sgx-psw.bin.tmpl +++ b/linux/installer/bin/install-sgx-psw.bin.tmpl @@ -80,7 +80,7 @@ if [ -d "$INSTALL_PATH" ]; then exit 4 fi -PATH=/usr/bin:/bin +PATH=/usr/sbin:/usr/bin:/sbin:/bin umask 022 PSWPKG=`mktemp -t sgx-psw-pkg.XXXXXX` diff --git a/linux/installer/common/libsgx-enclave-common/94-sgx-enclave.rules b/linux/installer/common/libsgx-enclave-common/94-sgx-enclave.rules new file mode 100644 index 00000000..825da7ab --- /dev/null +++ b/linux/installer/common/libsgx-enclave-common/94-sgx-enclave.rules @@ -0,0 +1,2 @@ +# Only for systemd which supports https://github.com/systemd/systemd/pull/18944/files +SUBSYSTEM=="misc",KERNEL=="sgx_enclave",SYMLINK+="sgx/enclave" diff --git a/linux/installer/common/libsgx-enclave-common/BOMs/libsgx-enclave-common.txt b/linux/installer/common/libsgx-enclave-common/BOMs/libsgx-enclave-common.txt index d8393c99..599dffa8 100644 --- a/linux/installer/common/libsgx-enclave-common/BOMs/libsgx-enclave-common.txt +++ b/linux/installer/common/libsgx-enclave-common/BOMs/libsgx-enclave-common.txt @@ -1,4 +1,5 @@ DeliveryName InstallName FileCheckSum FileFeature FileOwner /build/linux/libsgx_enclave_common.so /lib/libsgx_enclave_common.so 0 main STP /linux/installer/common/libsgx-enclave-common/91-sgx-enclave.rules /etc/udev/rules.d/91-sgx-enclave.rules 0 main STP +/linux/installer/common/libsgx-enclave-common/94-sgx-enclave.rules /etc/udev/rules.d/94-sgx-enclave.rules 0 main STP /linux/installer/common/libsgx-enclave-common/remount-dev-exec.service /usr/lib/systemd/system/remount-dev-exec.service 0 main STP diff --git a/linux/installer/common/libsgx-enclave-common/Makefile b/linux/installer/common/libsgx-enclave-common/Makefile index d0ea287d..3c939a3a 100644 --- a/linux/installer/common/libsgx-enclave-common/Makefile +++ b/linux/installer/common/libsgx-enclave-common/Makefile @@ -37,6 +37,12 @@ PACKAGES=$(notdir $(wildcard $(PACKAGE_ROOT_FOLDER)/*)) USR_LIB_PATH=/usr/$(notdir $(shell gcc -print-multi-os-directory))/$(shell dpkg-architecture -qDEB_HOST_MULTIARCH 2> /dev/null) USR_INC_PATH=/usr/$(INC_DIR) +ifeq ($(shell LD_PRELOAD= stat -c "%G" /dev/sgx_enclave 2>/dev/null),sgx) +SGX_UDEV_RULE_DEL=/etc/udev/rules.d/91-sgx-enclave.rules +else +SGX_UDEV_RULE_DEL=/etc/udev/rules.d/94-sgx-enclave.rules +endif + ECL_VER=1.0.0 SPLIT_VERSION=$(word $2,$(subst ., ,$1)) @@ -48,6 +54,7 @@ install: $(PACKAGES) ln -fs libsgx_enclave_common.so.$(ECL_VER) libsgx_enclave_common.so.$(call SPLIT_VERSION,$(ECL_VER),1) cd $(shell readlink -m $(DESTDIR)/$(ENCLAVE_COMMON_DEV_PACKAGE_NAME)/$(USR_LIB_PATH)) && \ ln -fs libsgx_enclave_common.so.$(call SPLIT_VERSION,$(ECL_VER),1) libsgx_enclave_common.so + rm -f $(DESTDIR)/$(ENCLAVE_COMMON_PACKAGE_NAME)/$(SGX_UDEV_RULE_DEL) $(PACKAGES): install -d $(shell readlink -m $(DESTDIR)/$@) diff --git a/linux/installer/common/psw-dcap/BOM_install/sgx-dcap-pccs.txt b/linux/installer/common/psw-dcap/BOM_install/sgx-dcap-pccs.txt index bc91befb..d70745c9 100644 --- a/linux/installer/common/psw-dcap/BOM_install/sgx-dcap-pccs.txt +++ b/linux/installer/common/psw-dcap/BOM_install/sgx-dcap-pccs.txt @@ -67,7 +67,6 @@ DeliveryName InstallName FileCheckSum FileFeature FileOwner /external/dcap_source/QuoteGeneration/pccs/x509/x509.js /x509/x509.js 0 main STP /external/dcap_source/QuoteGeneration/pccs/install.sh /install.sh 0 main STP /external/dcap_source/QuoteGeneration/pccs/package.json /package.json 0 main STP -/external/dcap_source/QuoteGeneration/pccs/npm-shrinkwrap.json /npm-shrinkwrap.json 0 main STP /external/dcap_source/QuoteGeneration/pccs/pccs_server.js /pccs_server.js 0 main STP /external/dcap_source/QuoteGeneration/pccs/pccs.service /pccs.service 0 main STP /external/dcap_source/QuoteGeneration/pccs/startup.sh /startup.sh 0 main STP diff --git a/linux/installer/common/psw-dcap/BOM_source/psw-dcap-tarball.txt b/linux/installer/common/psw-dcap/BOM_source/psw-dcap-tarball.txt index ceb1b72a..04318821 100644 --- a/linux/installer/common/psw-dcap/BOM_source/psw-dcap-tarball.txt +++ b/linux/installer/common/psw-dcap/BOM_source/psw-dcap-tarball.txt @@ -17,3 +17,4 @@ DeliveryName InstallName FileCheckSum FileFeature FileOwner /linux/installer/rpm/psw-dcap/build.sh /linux/installer/rpm/psw-dcap/build.sh 0 main STP /linux/installer/rpm/psw-dcap/clean.sh /linux/installer/rpm/psw-dcap/clean.sh 0 main STP /linux/installer/rpm/psw-dcap/psw-dcap.spec.tmpl /linux/installer/rpm/psw-dcap/psw-dcap.spec.tmpl 0 main STP +/external/ippcp_internal/Makefile.psw_dcap /external/ippcp_internal/Makefile 0 main STP diff --git a/linux/installer/common/psw/BOMs/psw_base.txt b/linux/installer/common/psw/BOMs/psw_base.txt index 193def27..10f8087f 100644 --- a/linux/installer/common/psw/BOMs/psw_base.txt +++ b/linux/installer/common/psw/BOMs/psw_base.txt @@ -23,8 +23,8 @@ DeliveryName InstallName FileCheckSum FileFeature FileOwner /build/linux/libsgx_pve.signed.so /package/aesm/libsgx_pve.signed.so.1 0 main STP /build/linux/libsgx_qe.signed.so /package/aesm/libsgx_qe.signed.so.1 0 main STP /build/linux/libsgx_pce.signed.so /package/aesm/libsgx_pce.signed.so.1 0 main STP -/build/linux/libsgx_qe3.signed.so /package/aesm/libsgx_qe3.signed.so.1 0 main STP -/build/linux/libsgx_id_enclave.signed.so /package/aesm/libsgx_id_enclave.signed.so.1 0 main STP +/external/dcap_source/QuoteGeneration/psw/ae/data/prebuilt/libsgx_qe3.signed.so /package/aesm/libsgx_qe3.signed.so.1 0 main STP +/external/dcap_source/QuoteGeneration/psw/ae/data/prebuilt/libsgx_id_enclave.signed.so /package/aesm/libsgx_id_enclave.signed.so.1 0 main STP /linux/installer/common/psw/install.sh /scripts/install.sh 0 main STP /linux/installer/common/psw/Makefile /Makefile 0 main STP /psw/ae/aesm_service/config/network/aesmd.conf /package/aesm/conf/aesmd.conf 0 main STP diff --git a/linux/installer/common/sdk/BOMs/sdk_base.txt b/linux/installer/common/sdk/BOMs/sdk_base.txt index c9e5f348..cce9ec1d 100644 --- a/linux/installer/common/sdk/BOMs/sdk_base.txt +++ b/linux/installer/common/sdk/BOMs/sdk_base.txt @@ -92,6 +92,7 @@ DeliveryName InstallName FileCheckSum FileFeature FileOwner /external/dcap_source/QuoteGeneration/quote_wrapper/common/inc/sgx_ql_lib_common.h /package/include/./sgx_ql_lib_common.h 0 main STP /external/dcap_source/QuoteGeneration/pce_wrapper/inc/sgx_pce.h /package/include/./sgx_pce.h 0 main STP /external/dcap_source/QuoteGeneration/quote_wrapper/common/inc/sgx_quote_3.h /package/include/./sgx_quote_3.h 0 main STP +/external/dcap_source/QuoteGeneration/quote_wrapper/common/inc/sgx_quote_4.h /package/include/./sgx_quote_4.h 0 main STP /external/dcap_source/QuoteGeneration/quote_wrapper/common/inc/sgx_ql_quote.h /package/include/./sgx_ql_quote.h 0 main STP /external/dcap_source/QuoteVerification/QvE/Include/sgx_qve_header.h /package/include/./sgx_qve_header.h 0 main STP /external/dcap_source/QuoteVerification/dcap_tvl/sgx_dcap_tvl.h /package/include/./sgx_dcap_tvl.h 0 main STP @@ -116,7 +117,7 @@ DeliveryName InstallName FileCheckSum FileFeature FileOwner /SampleCode/LocalAttestation/App/UntrustedEnclaveMessageExchange.cpp /package/SampleCode/LocalAttestation/App/UntrustedEnclaveMessageExchange.cpp 0 main STP /SampleCode/LocalAttestation/App/UntrustedEnclaveMessageExchange.h /package/SampleCode/LocalAttestation/App/UntrustedEnclaveMessageExchange.h 0 main STP /SampleCode/LocalAttestation/buildenv.mk /package/SampleCode/LocalAttestation/buildenv.mk 0 main STP -/SampleCode/LocalAttestation/EnclaveInitiator/datatypes.h /SampleCode/LocalAttestation/EnclaveInitiator/datatypes.h 0 main STP +/SampleCode/LocalAttestation/EnclaveInitiator/datatypes.h /package/SampleCode/LocalAttestation/EnclaveInitiator/datatypes.h 0 main STP /SampleCode/LocalAttestation/EnclaveInitiator/EnclaveInitiator.config.xml /package/SampleCode/LocalAttestation/EnclaveInitiator/EnclaveInitiator.config.xml 0 main STP /SampleCode/LocalAttestation/EnclaveInitiator/EnclaveInitiator.cpp /package/SampleCode/LocalAttestation/EnclaveInitiator/EnclaveInitiator.cpp 0 main STP /SampleCode/LocalAttestation/EnclaveInitiator/EnclaveInitiator.edl /package/SampleCode/LocalAttestation/EnclaveInitiator/EnclaveInitiator.edl 0 main STP @@ -539,6 +540,10 @@ DeliveryName InstallName FileCheckSum FileFeature FileOwner /sdk/tlibcxx/include/utility /package/include/libcxx/utility 0 main STP /sdk/tlibcxx/include/valarray /package/include/libcxx/valarray 0 main STP /sdk/tlibcxx/include/vector /package/include/libcxx/vector 0 main STP +/external/protobuf/protobuf_code/src/google/protobuf/arenaz_sampler.h /package/include/tprotobuf/google/protobuf/arenaz_sampler.h 0 main STP +/external/protobuf/protobuf_code/src/google/protobuf/inlined_string_field.h /package/include/tprotobuf/google/protobuf/inlined_string_field.h 0 main STP +/external/protobuf/protobuf_code/src/google/protobuf/repeated_ptr_field.h /package/include/tprotobuf/google/protobuf/repeated_ptr_field.h 0 main STP +/external/protobuf/protobuf_code/src/google/protobuf/explicitly_constructed.h /package/include/tprotobuf/google/protobuf/explicitly_constructed.h 0 main STP /external/protobuf/protobuf_code/src/google/protobuf/any.h /package/include/tprotobuf/google/protobuf/any.h 0 main STP /external/protobuf/protobuf_code/src/google/protobuf/any.pb.h /package/include/tprotobuf/google/protobuf/any.pb.h 0 main STP /external/protobuf/protobuf_code/src/google/protobuf/api.pb.h /package/include/tprotobuf/google/protobuf/api.pb.h 0 main STP @@ -556,7 +561,6 @@ DeliveryName InstallName FileCheckSum FileFeature FileOwner /external/protobuf/protobuf_code/src/google/protobuf/generated_enum_reflection.h /package/include/tprotobuf/google/protobuf/generated_enum_reflection.h 0 main STP /external/protobuf/protobuf_code/src/google/protobuf/generated_enum_util.h /package/include/tprotobuf/google/protobuf/generated_enum_util.h 0 main STP /external/protobuf/protobuf_code/src/google/protobuf/generated_message_reflection.h /package/include/tprotobuf/google/protobuf/generated_message_reflection.h 0 main STP -/external/protobuf/protobuf_code/src/google/protobuf/generated_message_table_driven.h /package/include/tprotobuf/google/protobuf/generated_message_table_driven.h 0 main STP /external/protobuf/protobuf_code/src/google/protobuf/generated_message_util.h /package/include/tprotobuf/google/protobuf/generated_message_util.h 0 main STP /external/protobuf/protobuf_code/src/google/protobuf/has_bits.h /package/include/tprotobuf/google/protobuf/has_bits.h 0 main STP /external/protobuf/protobuf_code/src/google/protobuf/implicit_weak_message.h /package/include/tprotobuf/google/protobuf/implicit_weak_message.h 0 main STP diff --git a/linux/installer/common/sdk/Makefile b/linux/installer/common/sdk/Makefile index 987bc3f6..28388a85 100644 --- a/linux/installer/common/sdk/Makefile +++ b/linux/installer/common/sdk/Makefile @@ -42,57 +42,54 @@ SDK_LIB_INSTALL_PATH=$(shell readlink -m $(DESTDIR)/$(SDK_LIB_PATH)) USR_LIB_PATH=$(shell readlink -m /usr/$(or $(notdir $(shell gcc -print-multi-os-directory 2> /dev/null)),$(if $(wildcard /usr/lib64/.*),lib64),lib)/$(shell dpkg-architecture -qDEB_HOST_MULTIARCH 2> /dev/null)) USR_LIB_INSTALL_PATH=$(shell readlink -m $(DESTDIR)/$(USR_LIB_PATH)) USR_BIN_INSTALL_PATH=$(shell readlink -m $(DESTDIR)/usr/bin) +SOURCE_INSTALL_SGX_GDB=$(SOURCE_INSTALL_PATH)/bin/sgx-gdb -default: - +.PHONY: install install: install_source install_script install_gdb install_library install_pkgconfig update_pkgconfig +.PHONY: install_source install_source: #for all format - install -d $(SOURCE_INSTALL_PATH) - cp -r $(SOURCE_FOLDER)/* $(SOURCE_INSTALL_PATH) + @install -d $(SOURCE_INSTALL_PATH) + @cp -r $(SOURCE_FOLDER)/* $(SOURCE_INSTALL_PATH) +.PHONY: install_script install_script: #for bin format ifeq ($(INSTALLER_FORMAT),BIN) - install -d $(SCRIPTS_INSTALL_PATH) - install $(SCRIPTS_FOLDER)/* $(SCRIPTS_INSTALL_PATH) + @install -d $(SCRIPTS_INSTALL_PATH) + @install $(SCRIPTS_FOLDER)/* $(SCRIPTS_INSTALL_PATH) endif +.PHONY: install_gdb install_gdb: - @sed -i "s#@SDK_LIB_PATH@#$(SDK_LIB_PATH)#" $(SOURCE_INSTALL_PATH)/bin/sgx-gdb - chmod +x $(SOURCE_INSTALL_PATH)/bin/sgx-gdb + @sed -i "s#@SDK_LIB_PATH@#$(SDK_LIB_PATH)#" $(SOURCE_INSTALL_SGX_GDB) + @chmod +x $(SOURCE_INSTALL_SGX_GDB) ifneq ($(INSTALLER_FORMAT),BIN) - install -d $(USR_BIN_INSTALL_PATH) - mv $(SOURCE_INSTALL_PATH)/bin/sgx-gdb $(USR_BIN_INSTALL_PATH) + @install -d $(USR_BIN_INSTALL_PATH) + @mv $(SOURCE_INSTALL_SGX_GDB) $(USR_BIN_INSTALL_PATH) endif +.PHONY: install_library install_library: #for deb & rpm format ifneq ($(INSTALLER_FORMAT),BIN) - install -d $(USR_LIB_INSTALL_PATH) - mv $(SDK_LIB_INSTALL_PATH)/libsgx_uae_service_sim.so $(USR_LIB_INSTALL_PATH) - mv $(SDK_LIB_INSTALL_PATH)/libsgx_urts_sim.so $(USR_LIB_INSTALL_PATH) + @install -d $(USR_LIB_INSTALL_PATH) + @mv $(wildcard $(SDK_LIB_INSTALL_PATH)/*_sim.so) $(USR_LIB_INSTALL_PATH) endif +.PHONY: install_pkgconfig install_pkgconfig: #for deb & rpm format ifneq ($(INSTALLER_FORMAT),BIN) - install -d $(USR_LIB_INSTALL_PATH)/pkgconfig - mv $(SOURCE_INSTALL_PATH)/pkgconfig/libsgx_uae_service_sim.pc $(USR_LIB_INSTALL_PATH)/pkgconfig - mv $(SOURCE_INSTALL_PATH)/pkgconfig/libsgx_urts_sim.pc $(USR_LIB_INSTALL_PATH)/pkgconfig - mv $(SOURCE_INSTALL_PATH)/pkgconfig/libsgx_uae_service.pc $(USR_LIB_INSTALL_PATH)/pkgconfig - mv $(SOURCE_INSTALL_PATH)/pkgconfig/libsgx_urts.pc $(USR_LIB_INSTALL_PATH)/pkgconfig - @sed -i "s#\(libdir=\).*#\1$(USR_LIB_PATH)#" $(USR_LIB_INSTALL_PATH)/pkgconfig/libsgx_uae_service_sim.pc - @sed -i "s#\(libdir=\).*#\1$(USR_LIB_PATH)#" $(USR_LIB_INSTALL_PATH)/pkgconfig/libsgx_urts_sim.pc - rm -fr $(SOURCE_INSTALL_PATH)/pkgconfig + @install -d $(USR_LIB_INSTALL_PATH)/pkgconfig + @mv $(SOURCE_INSTALL_PATH)/pkgconfig $(USR_LIB_INSTALL_PATH) endif -update_pkgconfig: #for bin format +.PHONY: update_pkgconfig +update_pkgconfig: ifeq ($(INSTALLER_FORMAT),BIN) - @sed -i "s#\(prefix=\).*#\1$(SOURCE_INSTALL_PATH)#" $(SOURCE_INSTALL_PATH)/pkgconfig/libsgx_uae_service_sim.pc - @sed -i "s#\(prefix=\).*#\1$(SOURCE_INSTALL_PATH)#" $(SOURCE_INSTALL_PATH)/pkgconfig/libsgx_urts_sim.pc - @sed -i "s#\(prefix=\).*#\1$(SOURCE_INSTALL_PATH)#" $(SOURCE_INSTALL_PATH)/pkgconfig/libsgx_uae_service.pc - @sed -i "s#\(prefix=\).*#\1$(SOURCE_INSTALL_PATH)#" $(SOURCE_INSTALL_PATH)/pkgconfig/libsgx_urts.pc + @sed -i "s#\(prefix=\).*#\1$(SOURCE_INSTALL_PATH)#" \ + $(wildcard $(SOURCE_INSTALL_PATH)/pkgconfig/*.pc) else - @sed -i "s#\(prefix=\).*#\1$(SOURCE_PATH)#" $(USR_LIB_INSTALL_PATH)/pkgconfig/libsgx_uae_service_sim.pc - @sed -i "s#\(prefix=\).*#\1$(SOURCE_PATH)#" $(USR_LIB_INSTALL_PATH)/pkgconfig/libsgx_urts_sim.pc - @sed -i "s#\(prefix=\).*#\1$(SOURCE_PATH)#" $(USR_LIB_INSTALL_PATH)/pkgconfig/libsgx_uae_service.pc - @sed -i "s#\(prefix=\).*#\1$(SOURCE_PATH)#" $(USR_LIB_INSTALL_PATH)/pkgconfig/libsgx_urts.pc -endif \ No newline at end of file + @sed -i "s#\(prefix=\).*#\1$(SOURCE_PATH)#" \ + $(wildcard $(USR_LIB_INSTALL_PATH)/pkgconfig/*.pc) + @sed -i "s#\(libdir=\).*#\1$(USR_LIB_PATH)#" \ + $(wildcard $(USR_LIB_INSTALL_PATH)/pkgconfig/*_sim.pc) +endif diff --git a/linux/installer/common/sgx-aesm-service/linksgx.sh b/linux/installer/common/sgx-aesm-service/linksgx.sh index 5fd7282c..e90e8513 100755 --- a/linux/installer/common/sgx-aesm-service/linksgx.sh +++ b/linux/installer/common/sgx-aesm-service/linksgx.sh @@ -50,6 +50,11 @@ if [ -c /dev/sgx_provision -o -c /dev/sgx/provision ]; then udevadm trigger || : fi usermod -aG sgx_prv aesmd &> /dev/null + + # For systemd which supports https://github.com/systemd/systemd/pull/18944/files + if [ "sgx" = "$(stat -c '%G' /dev/sgx_enclave 2>/dev/null)" ]; then + usermod -aG sgx aesmd &> /dev/null + fi fi echo diff --git a/linux/installer/deb/sgx-aesm-service/sgx-aesm-service-1.0/debian/control b/linux/installer/deb/sgx-aesm-service/sgx-aesm-service-1.0/debian/control index a045a0e5..82a2768a 100644 --- a/linux/installer/deb/sgx-aesm-service/sgx-aesm-service-1.0/debian/control +++ b/linux/installer/deb/sgx-aesm-service/sgx-aesm-service-1.0/debian/control @@ -37,12 +37,12 @@ Description: Unified Quote Plugin for Intel(R) Software Guard Extensions AESM Se Package: libsgx-aesm-ecdsa-plugin Architecture: amd64 -Depends: ${shlibs:Depends}, ${misc:Depends}, sgx-aesm-service(>= @dep_version@), libsgx-qe3-logic(>= 1.13), libsgx-aesm-pce-plugin(>= @dep_version@) +Depends: ${shlibs:Depends}, ${misc:Depends}, sgx-aesm-service(>= @dep_version@), libsgx-qe3-logic(>= 1.14), libsgx-aesm-pce-plugin(>= @dep_version@) Description: ECDSA Quote Plugin for Intel(R) Software Guard Extensions AESM Service Package: libsgx-aesm-pce-plugin Architecture: amd64 -Depends: ${shlibs:Depends}, ${misc:Depends}, sgx-aesm-service(>= @dep_version@), libsgx-pce-logic(>= 1.13), libsgx-ae-pce(>= @dep_version@) +Depends: ${shlibs:Depends}, ${misc:Depends}, sgx-aesm-service(>= @dep_version@), libsgx-pce-logic(>= 1.14), libsgx-ae-pce(>= @dep_version@) Description: PCE Plugin for Intel(R) Software Guard Extensions AESM Service Package: libsgx-ae-pce diff --git a/linux/installer/deb/sgx-aesm-service/sgx-aesm-service-1.0/debian/rules b/linux/installer/deb/sgx-aesm-service/sgx-aesm-service-1.0/debian/rules index 8a3b96ec..3b82ddd8 100755 --- a/linux/installer/deb/sgx-aesm-service/sgx-aesm-service-1.0/debian/rules +++ b/linux/installer/deb/sgx-aesm-service/sgx-aesm-service-1.0/debian/rules @@ -8,4 +8,4 @@ dh $@ override_dh_shlibdeps: - dh_shlibdeps -l $(LINUX_BUILD_DIR) + dh_shlibdeps -l $(LINUX_BUILD_DIR) --dpkg-shlibdeps-params=--ignore-missing-info diff --git a/linux/installer/rpm/psw-dcap/psw-dcap.spec.tmpl b/linux/installer/rpm/psw-dcap/psw-dcap.spec.tmpl index 5c518cc5..627ca3b3 100644 --- a/linux/installer/rpm/psw-dcap/psw-dcap.spec.tmpl +++ b/linux/installer/rpm/psw-dcap/psw-dcap.spec.tmpl @@ -96,6 +96,7 @@ BuildRequires: protobuf-devel BuildRequires: libcurl-devel BuildRequires: python BuildRequires: perl +BuildRequires: nasm %description Intel(R) Software Guard Extensions AESM Service diff --git a/linux/installer/rpm/psw-dcap/sanitize.sh b/linux/installer/rpm/psw-dcap/sanitize.sh index b5d7d700..7ab53df3 100755 --- a/linux/installer/rpm/psw-dcap/sanitize.sh +++ b/linux/installer/rpm/psw-dcap/sanitize.sh @@ -44,6 +44,13 @@ tarball_dir="${cur_dir}/${tarball}" make -C ${root_dir} preparation +# Prepare ipp-crypto source +pushd ${root_dir}/external/ippcp_internal/ + +cd ipp-crypto && git apply ../0001-IPP-crypto-for-SGX_psw_dcap.patch >/dev/null 2>&1 || git apply ../0001-IPP-crypto-for-SGX_psw_dcap.patch --check -R + +popd + python ${common_dir}/gen_source/copy_source.py \ --bom-file ${common_psw_dcap_dir}/BOM_source/psw-dcap-tarball.txt \ --src-path ${root_dir} \ diff --git a/linux/installer/rpm/sgx-aesm-service/libsgx-aesm-ecdsa-plugin.spec b/linux/installer/rpm/sgx-aesm-service/libsgx-aesm-ecdsa-plugin.spec index aa50bbbc..506cceae 100644 --- a/linux/installer/rpm/sgx-aesm-service/libsgx-aesm-ecdsa-plugin.spec +++ b/linux/installer/rpm/sgx-aesm-service/libsgx-aesm-ecdsa-plugin.spec @@ -38,7 +38,7 @@ Version: @version@ Release: 1%{?dist} Summary: ECDSA Quote Plugin for Intel(R) Software Guard Extensions AESM Service Group: Development/System -Requires: sgx-aesm-service >= %{version}-%{release} libsgx-qe3-logic >= 1.13 libsgx-aesm-pce-plugin >= %{version}-%{release} +Requires: sgx-aesm-service >= %{version}-%{release} libsgx-qe3-logic >= 1.14 libsgx-aesm-pce-plugin >= %{version}-%{release} License: BSD License URL: https://github.com/intel/linux-sgx diff --git a/linux/installer/rpm/sgx-aesm-service/libsgx-aesm-pce-plugin.spec b/linux/installer/rpm/sgx-aesm-service/libsgx-aesm-pce-plugin.spec index 36e3d148..d8fff8b9 100644 --- a/linux/installer/rpm/sgx-aesm-service/libsgx-aesm-pce-plugin.spec +++ b/linux/installer/rpm/sgx-aesm-service/libsgx-aesm-pce-plugin.spec @@ -38,7 +38,7 @@ Version: @version@ Release: 1%{?dist} Summary: PCE Plugin for Intel(R) Software Guard Extensions AESM Service Group: Development/System -Requires: sgx-aesm-service >= %{version}-%{release} libsgx-pce-logic >= 1.13 +Requires: sgx-aesm-service >= %{version}-%{release} libsgx-pce-logic >= 1.14 License: BSD License URL: https://github.com/intel/linux-sgx diff --git a/linux/reproducibility/README.md b/linux/reproducibility/README.md index 8ef16fcd..e4ffe265 100644 --- a/linux/reproducibility/README.md +++ b/linux/reproducibility/README.md @@ -41,10 +41,10 @@ In order to reproduce the enclave build, there are three requirements:1. stable To reproduce QVE, you need to apply below patch to the [build_and_launch_docker.sh](./build_and_launch_docker.sh) before start the reproducible build with the script. ``` diff --git a/linux/reproducibility/build_and_launch_docker.sh b/linux/reproducibility/build_and_launch_docker.sh -index da6837c1..27fd69a1 100755 +index b85eda85..f8bc6812 100755 --- a/linux/reproducibility/build_and_launch_docker.sh +++ b/linux/reproducibility/build_and_launch_docker.sh -@@ -183,6 +183,7 @@ prepare_sgx_src() +@@ -188,6 +188,7 @@ prepare_sgx_src() fi cd "$sgx_repo" && make preparation @@ -52,5 +52,4 @@ index da6837c1..27fd69a1 100755 popd } - ``` diff --git a/linux/reproducibility/build_and_launch_docker.sh b/linux/reproducibility/build_and_launch_docker.sh index da6837c1..feb4d3e6 100755 --- a/linux/reproducibility/build_and_launch_docker.sh +++ b/linux/reproducibility/build_and_launch_docker.sh @@ -76,8 +76,8 @@ mount_dir="/linux-sgx" sdk_installer="" sgx_src="" -default_sdk_installer=sgx_linux_x64_sdk_reproducible_2.16.100.1.bin -default_sdk_installer_url=https://download.01.org/intel-sgx/sgx-linux/2.16/distro/nix_reproducibility/$default_sdk_installer +default_sdk_installer=sgx_linux_x64_sdk_reproducible_2.17.100.2.bin +default_sdk_installer_url=https://download.01.org/intel-sgx/sgx-linux/2.17/distro/nix_reproducibility/$default_sdk_installer usage() @@ -179,7 +179,7 @@ prepare_sgx_src() if [ "$sgx_src" != "" ]; then mkdir -p "$sgx_repo" && cp -a "$sgx_src/." "$sgx_repo" else - git clone -b sgx_2.16_reproducible https://github.com/intel/linux-sgx.git $sgx_repo + git clone -b sgx_2.17_reproducible https://github.com/intel/linux-sgx.git $sgx_repo fi cd "$sgx_repo" && make preparation diff --git a/linux/reproducibility/start_build.sh.tmp b/linux/reproducibility/start_build.sh.tmp index 8fa89de4..1dfe07ca 100644 --- a/linux/reproducibility/start_build.sh.tmp +++ b/linux/reproducibility/start_build.sh.tmp @@ -143,6 +143,8 @@ build_ae() cp qe3.so $ae_out cd $sgx_repo/external/dcap_source/QuoteGeneration/quote_wrapper/quote/id_enclave/linux && make cp id_enclave.so $ae_out + cd $sgx_repo/external/dcap_source/QuoteGeneration/quote_wrapper/tdx_quote/enclave/linux && make + cp tdqe.so $ae_out cd $sgx_repo/external/dcap_source/QuoteVerification/QvE && make cp qve.so $ae_out popd diff --git a/psw/ae/aesm_service/source/core/CMakeLists.txt b/psw/ae/aesm_service/source/core/CMakeLists.txt index 5cfc353b..878ba1db 100644 --- a/psw/ae/aesm_service/source/core/CMakeLists.txt +++ b/psw/ae/aesm_service/source/core/CMakeLists.txt @@ -1,5 +1,10 @@ aux_source_directory(. _srcs) +#Disable CET +if (CMAKE_COMPILER_IS_GNUCC AND CMAKE_CXX_COMPILER_VERSION VERSION_GREATER_EQUAL 8) + add_compile_options(-fcf-protection=none) +endif() + if(NOT US_BUILD_SHARED_LIBS) # Set up dependencies to resources from static bundles usFunctionGetResourceSource(TARGET aesm_service OUT _srcs) diff --git a/psw/ae/aesm_service/source/core/ipc/UnixCommunicationSocket.cpp b/psw/ae/aesm_service/source/core/ipc/UnixCommunicationSocket.cpp index 1165caad..f53db676 100644 --- a/psw/ae/aesm_service/source/core/ipc/UnixCommunicationSocket.cpp +++ b/psw/ae/aesm_service/source/core/ipc/UnixCommunicationSocket.cpp @@ -225,11 +225,6 @@ bool UnixCommunicationSocket::init() SE_PROD_LOG("Failed to connect to socket %s\n", serv_addr.sun_path); return false; } - if (mSocket < 0) - { - SE_PROD_LOG("Invalid socket fd\n"); - return false; - } } return true; } diff --git a/psw/ae/aesm_service/source/oal/linux/error_report.cpp b/psw/ae/aesm_service/source/oal/linux/error_report.cpp index 86690c7f..de86235c 100644 --- a/psw/ae/aesm_service/source/oal/linux/error_report.cpp +++ b/psw/ae/aesm_service/source/oal/linux/error_report.cpp @@ -63,22 +63,26 @@ void sgx_proc_log_report(int level, const char *format, ...) { int priority = 0; va_list ap; + // Make sure strlen(format) >= 1 + // so we can always add newline + if (!format || !(*format)) + return;//ignore va_start(ap, format); switch(level){ - case AESM_LOG_REPORT_FATAL: - priority = LOG_CRIT; - break; - case AESM_LOG_REPORT_ERROR: - priority = LOG_ERR; - break; - case AESM_LOG_REPORT_WARNING: - priority = LOG_WARNING; - break; - case AESM_LOG_REPORT_INFO: - priority = LOG_INFO; - break; - default: - return;//ignore + case AESM_LOG_REPORT_FATAL: + priority = LOG_CRIT; + break; + case AESM_LOG_REPORT_ERROR: + priority = LOG_ERR; + break; + case AESM_LOG_REPORT_WARNING: + priority = LOG_WARNING; + break; + case AESM_LOG_REPORT_INFO: + priority = LOG_INFO; + break; + default: + return;//ignore } if (!_nosyslog) { vsyslog(priority, format, ap); diff --git a/psw/ae/aesm_service/source/oal/linux/internal_log.cpp b/psw/ae/aesm_service/source/oal/linux/internal_log.cpp index f10c3dea..dee56b30 100644 --- a/psw/ae/aesm_service/source/oal/linux/internal_log.cpp +++ b/psw/ae/aesm_service/source/oal/linux/internal_log.cpp @@ -468,6 +468,7 @@ static const char *get_sgx_status_t_string(sgx_status_t status) CASE_ENUM_RET_STRING(SGX_ERROR_OUT_OF_EPC) CASE_ENUM_RET_STRING(SGX_ERROR_NO_DEVICE) CASE_ENUM_RET_STRING(SGX_ERROR_MEMORY_MAP_CONFLICT) + CASE_ENUM_RET_STRING(SGX_ERROR_MEMORY_MAP_FAILURE) CASE_ENUM_RET_STRING(SGX_ERROR_INVALID_METADATA) CASE_ENUM_RET_STRING(SGX_ERROR_DEVICE_BUSY) CASE_ENUM_RET_STRING(SGX_ERROR_INVALID_VERSION) diff --git a/psw/ae/pce/config.xml b/psw/ae/pce/config.xml index de550ce1..78d874e3 100644 --- a/psw/ae/pce/config.xml +++ b/psw/ae/pce/config.xml @@ -3,7 +3,7 @@ 1 0 0x1 - 0xC + 0xD 1 0 1 diff --git a/psw/ae/pve/config.xml b/psw/ae/pve/config.xml index 1f300bf9..1f53a3a5 100644 --- a/psw/ae/pve/config.xml +++ b/psw/ae/pve/config.xml @@ -3,7 +3,7 @@ 1 0 0x1 - 0xC + 0xD 1 0 1 diff --git a/psw/ae/pve/helper.cpp b/psw/ae/pve/helper.cpp index cdcc2dea..f4ce8dc6 100644 --- a/psw/ae/pve/helper.cpp +++ b/psw/ae/pve/helper.cpp @@ -193,7 +193,8 @@ pve_status_t get_pve_psk( //simple wrapper for memcpy but checking type of parameter void pve_memcpy_out(external_memory_byte_t *dst, const void *src, uint32_t size) { - memcpy(dst, src, size); + // Use PRT mitigated version of memcpy to copy buffer to untrusted memory + memcpy_verw(dst, src, size); } void pve_memcpy_in(void *dst, const external_memory_byte_t *src, uint32_t size) diff --git a/psw/ae/qe/config.xml b/psw/ae/qe/config.xml index 1936e0f8..9224e394 100644 --- a/psw/ae/qe/config.xml +++ b/psw/ae/qe/config.xml @@ -3,7 +3,7 @@ 0 0 0x1 - 0xC + 0xD 1 0 1 diff --git a/psw/ae/qe/quoting_enclave.cpp b/psw/ae/qe/quoting_enclave.cpp index 6ae9ded3..8d458125 100644 --- a/psw/ae/qe/quoting_enclave.cpp +++ b/psw/ae/qe/quoting_enclave.cpp @@ -84,6 +84,12 @@ extern "C" { to be signed by EPID. So we need to minus sizeof(uint32_t). */ #define QE_QUOTE_BODY_SIZE (sizeof(sgx_quote_t) - sizeof(uint32_t)) +static void memcpy_t2u(void *dst, const void *src, uint32_t size) +{ + // Use PRT mitigated version of memcpy to copy buffer to untrusted memory + memcpy_verw(dst, src, size); +} + /* * An internal function used to verify EPID Blob, get EPID Group Cert * and get EPID context, at the same time, you can check whether EPID blob has @@ -514,11 +520,11 @@ static ae_error_t qe_epid_sign( } /* Copy the wrap_key_t into output buffer. */ - memcpy(&emp_p->wrap_key, &wrap_key, sizeof(wrap_key)); + memcpy_t2u(&emp_p->wrap_key, &wrap_key, sizeof(wrap_key)); /* Copy the AES IV into output buffer. */ - memcpy(&emp_p->iv, aes_iv, sizeof(aes_iv)); + memcpy_t2u(&emp_p->iv, aes_iv, sizeof(aes_iv)); /* Copy the AES Blob payload size into output buffer. */ - memcpy(&emp_p->payload_size, &sign_size, sizeof(sign_size)); + memcpy_t2u(&emp_p->payload_size, &sign_size, sizeof(sign_size)); se_ret = sgx_aes_gcm128_enc_init( @@ -549,7 +555,7 @@ static ae_error_t qe_epid_sign( } /* Copy the encrypted basic signature into output buffer. */ - memcpy(&emp_p->basic_sign, &encrypted_basic_sig, + memcpy_t2u(&emp_p->basic_sign, &encrypted_basic_sig, sizeof(encrypted_basic_sig)); if(p_qe_report) @@ -620,9 +626,9 @@ static ae_error_t qe_epid_sign( goto CLEANUP; } - memcpy(&(emp_p->rl_ver), &encrypted_rl_ver, + memcpy_t2u(&(emp_p->rl_ver), &encrypted_rl_ver, sizeof(encrypted_rl_ver)); - memcpy(&(emp_p->rl_num), &encrypted_n2, + memcpy_t2u(&(emp_p->rl_num), &encrypted_n2, sizeof(encrypted_n2)); if(p_qe_report) { @@ -694,7 +700,7 @@ static ae_error_t qe_epid_sign( goto CLEANUP; } - memcpy(emp_nr, &encrypted_temp_nr, sizeof(encrypted_temp_nr)); + memcpy_t2u(emp_nr, &encrypted_temp_nr, sizeof(encrypted_temp_nr)); if(p_qe_report) { @@ -771,7 +777,7 @@ static ae_error_t qe_epid_sign( } /* This will copy both encrypted rl_ver and encrypted rl_num into Output buffer. */ - memcpy(&emp_p->rl_ver, &encrypted_temp_buf, + memcpy_t2u(&emp_p->rl_ver, &encrypted_temp_buf, sizeof(encrypted_temp_buf)); if(p_qe_report) @@ -794,7 +800,7 @@ static ae_error_t qe_epid_sign( goto CLEANUP; } - memcpy((uint8_t *)&(emp_p->basic_sign) + sign_size, &aes_tag, + memcpy_t2u((uint8_t *)&(emp_p->basic_sign) + sign_size, &aes_tag, sizeof(aes_tag)); if(p_qe_report) @@ -1084,7 +1090,7 @@ uint32_t get_quote( sgx_lfence(); /* Copy the data in the report into quote body. */ - memset(emp_quote, 0, quote_size); + memset_verw(emp_quote, 0, quote_size); quote_body.version = QE_QUOTE_VERSION; quote_body.sign_type = (uint16_t)quote_type; quote_body.pce_svn = pce_isvsvn; // Both are little endian @@ -1136,12 +1142,12 @@ uint32_t get_quote( if(AE_SUCCESS != ret) { // Only need to clean the buffer after the fixed length part. - memset_s(emp_quote + sizeof(sgx_quote_t), quote_size - sizeof(sgx_quote_t), + memset_verw_s(emp_quote + sizeof(sgx_quote_t), quote_size - sizeof(sgx_quote_t), 0, quote_size - sizeof(sgx_quote_t)); goto CLEANUP; } - memcpy(emp_quote, "e_body, sizeof(sgx_quote_t)); + memcpy_t2u(emp_quote, "e_body, sizeof(sgx_quote_t)); CLEANUP: if(p_epid_context) diff --git a/psw/enclave_common/sgx_enclave_common.cpp b/psw/enclave_common/sgx_enclave_common.cpp index b5aaa81e..95e7eb4f 100644 --- a/psw/enclave_common/sgx_enclave_common.cpp +++ b/psw/enclave_common/sgx_enclave_common.cpp @@ -75,7 +75,7 @@ static std::map s_hfile; //enclave file handles for drive static std::map s_enclave_size; static std::map s_enclave_init; static std::map s_secs_attr; -static std::maps_enclave_elrange_map; +static std::maps_enclave_elrange_map; typedef struct _mem_region_t { void* addr; @@ -177,9 +177,9 @@ static bool get_elrange_from_base_address(void* base_address, enclave_elrange_t* { if(enclave_elrange != NULL) { - enclave_elrange->elrange_size = s_enclave_elrange_map[base_address]->elrange_size; - enclave_elrange->elrange_start_address = s_enclave_elrange_map[base_address]->elrange_start_address; - enclave_elrange->enclave_image_address = s_enclave_elrange_map[base_address]->enclave_image_address; + enclave_elrange->elrange_size = s_enclave_elrange_map[base_address].elrange_size; + enclave_elrange->elrange_start_address = s_enclave_elrange_map[base_address].elrange_start_address; + enclave_elrange->enclave_image_address = s_enclave_elrange_map[base_address].enclave_image_address; } return true; } @@ -235,20 +235,10 @@ static void close_sofile(void) } -static void release_enclave_elrange_map() -{ - for (auto &res:s_enclave_elrange_map) - { - auto elrange = res.second; - delete elrange; - elrange = NULL; - } -} static void __attribute__((destructor)) enclave_fini(void) { close_device(); close_sofile(); - release_enclave_elrange_map(); } static uint32_t error_driver2api(int driver_error, int err_no) @@ -788,38 +778,7 @@ extern "C" void* COMM_API enclave_create_ex( s_enclave_mem_region[enclave_base].prot = 0; if(enclave_elrange != NULL) { - enclave_elrange_t *tmp_enclave_elrange = new(std::nothrow) enclave_elrange_t; - if (tmp_enclave_elrange == NULL) - { - if (enclave_error) - { - *enclave_error = ENCLAVE_OUT_OF_MEMORY; - } - - //if in-kernel driver then close the file handle - if (s_driver_type == SGX_DRIVER_IN_KERNEL) - { - close_file(&hdevice_temp); - } - munmap(enclave_base, virtual_size); - return NULL; - } - memset(tmp_enclave_elrange, 0, sizeof(enclave_elrange_t)); - if (memcpy_s(tmp_enclave_elrange, sizeof(enclave_elrange_t), enclave_elrange, sizeof(enclave_elrange_t))) - { - if (enclave_error) - { - *enclave_error = ENCLAVE_UNEXPECTED; - } - //if in-kernel driver then close the file handle - if (s_driver_type == SGX_DRIVER_IN_KERNEL) - { - close_file(&hdevice_temp); - } - munmap(enclave_base, virtual_size); - return NULL; - } - s_enclave_elrange_map[enclave_base] = tmp_enclave_elrange; + s_enclave_elrange_map[enclave_base] = *enclave_elrange; } } @@ -1283,16 +1242,7 @@ extern "C" bool COMM_API enclave_delete( s_hfile.erase(base_address); } - if(s_enclave_elrange_map.count(base_address) != 0) - { - enclave_elrange_t *enclave_elrange = s_enclave_elrange_map[base_address]; - if (enclave_elrange != NULL) - { - s_enclave_elrange_map.erase(base_address); - delete enclave_elrange; - enclave_elrange = NULL; - } - } + s_enclave_elrange_map.erase(base_address); } if (0 != munmap(base_address, enclave_size)) { diff --git a/psw/urts/linux/sig_handler.cpp b/psw/urts/linux/sig_handler.cpp index 1e0c16bd..b84d0a22 100644 --- a/psw/urts/linux/sig_handler.cpp +++ b/psw/urts/linux/sig_handler.cpp @@ -353,10 +353,11 @@ static int sgx_urts_vdso_handler(long rdi, long rsi, long rdx, long ursp, long r return 0; } //move the ocall return result to rsi and set rdi to ECMD_ORET for ocall return to trts - __asm__ __volatile__("mov %%rax, %%rsi\n" - "mov %0, %%rdi\n" + __asm__ __volatile__("mov $0, %%rsi\n" + "movl %0, %%esi\n" + "mov %1, %%rdi\n" : - :"i"(ECMD_ORET) + :"r"(status),"i"(ECMD_ORET) :"rsi","rdi"); return SE_EENTER; } diff --git a/psw/urts/loader.cpp b/psw/urts/loader.cpp index bd98a3c0..67eea74b 100644 --- a/psw/urts/loader.cpp +++ b/psw/urts/loader.cpp @@ -907,7 +907,7 @@ int CLoader::load_enclave(SGXLaunchToken *lc, int debug, const metadata_t *metad int CLoader::load_enclave_ex(SGXLaunchToken *lc, bool debug, const metadata_t *metadata, sgx_config_id_t *config_id, sgx_config_svn_t config_svn, le_prd_css_file_t *prd_css_file, sgx_misc_attribute_t *misc_attr) { - unsigned int ret = SGX_SUCCESS, map_conflict_count = 3; + unsigned int ret = SGX_SUCCESS, map_retry_count = 3; bool retry = true; while (retry) @@ -919,12 +919,13 @@ int CLoader::load_enclave_ex(SGXLaunchToken *lc, bool debug, const metadata_t *m case SGX_ERROR_ENCLAVE_LOST: //caused by loading enclave while power transition occurs break; - //If memroy map conflict occurs, we only retry 3 times. + //If memory map fail or conflict occurs, we only retry 3 times. + case SGX_ERROR_MEMORY_MAP_FAILURE: case SGX_ERROR_MEMORY_MAP_CONFLICT: - if(0 == map_conflict_count) + if(0 == map_retry_count) retry = false; else - map_conflict_count--; + map_retry_count--; break; //We don't re-load enclave due to other error code. diff --git a/psw/urts/parser/update_global_data.hxx b/psw/urts/parser/update_global_data.hxx index 31a21ef1..2889587d 100644 --- a/psw/urts/parser/update_global_data.hxx +++ b/psw/urts/parser/update_global_data.hxx @@ -89,6 +89,7 @@ namespace { global_data->heap_size = (sys_word_t)(create_param->heap_init_size); global_data->thread_policy = (sys_word_t)metadata->tcs_policy; global_data->tcs_max_num = (sys_word_t)create_param->tcs_max_num; + global_data->tcs_num = (sys_word_t)create_param->tcs_num; thread_data_t *thread_data = &global_data->td_template; thread_data->stack_limit_addr = (sys_word_t)create_param->stack_limit_addr; diff --git a/sdk/debugger_interface/linux/se_ptrace.c b/sdk/debugger_interface/linux/se_ptrace.c index 9a0b255e..11c7e3df 100644 --- a/sdk/debugger_interface/linux/se_ptrace.c +++ b/sdk/debugger_interface/linux/se_ptrace.c @@ -36,11 +36,9 @@ #include "se_trace.h" #include "se_memory.h" #include -#include #include #include #include -#include #include #include #include diff --git a/sdk/edger8r/linux/CodeGen.ml b/sdk/edger8r/linux/CodeGen.ml index 58012d6f..b6385d89 100644 --- a/sdk/edger8r/linux/CodeGen.ml +++ b/sdk/edger8r/linux/CodeGen.ml @@ -242,6 +242,14 @@ extern \"C\" {\n\ (* Header footer *) let header_footer = "\n#ifdef __cplusplus\n}\n#endif /* __cplusplus */\n\n#endif\n" +(* NO_HARDEN_EXT_WRITES Macro *) +let mk_no_harden_macro = sprintf "\n#ifdef NO_HARDEN_EXT_WRITES\n%s\n#else\n%s\n#endif /* NO_HARDEN_EXT_WRITES */\n" + +(* NO_HARDEN_EXT_WRITES Macro *) +let memcpy_macro = mk_no_harden_macro + "#define MEMCPY_S memcpy_s\n#define MEMSET memset" + "#define MEMCPY_S memcpy_verw_s\n#define MEMSET memset_verw" + (* Little functions for generating file names. *) let get_uheader_short_name (file_shortnm: string) = file_shortnm ^ "_u.h" let get_uheader_name (file_shortnm: string) = @@ -730,7 +738,7 @@ let gen_theader_preemble (guard: string) (inclist: string) = #include \n\ #include \n\ #include \"sgx_edger8r.h\" /* for sgx_ocall etc. */\n\n" in - grd_hdr ^ inc_exp ^ inclist ^ "\n" ^ common_macros + grd_hdr ^ inc_exp ^ inclist ^ "\n" ^ common_macros ^ memcpy_macro (* Generate trusted header for enclave *) let gen_trusted_header (ec: enclave_content) = @@ -1399,7 +1407,7 @@ let gen_struct_ptr_direction_post (param_direction: Ast.ptr_direction) (struct_t "\t\tstatus = SGX_ERROR_INVALID_PARAMETER;"; "\t\tbreak;"; "\t}"; - sprintf "\tif (memcpy_s(%s, %s, %s, %s)) {" in_ptr_name in_len_ptr_var in_struct_member out_len_ptr_var; + sprintf "\tif (MEMCPY_S(%s, %s, %s, %s)) {" in_ptr_name in_len_ptr_var in_struct_member out_len_ptr_var; sprintf "\t\tstatus = SGX_ERROR_UNEXPECTED;"; "\t\tbreak;"; "\t}"; @@ -1441,7 +1449,7 @@ let gen_parm_ptr_direction_post (plist: Ast.pdecl list) = "\t{"; sprintf "\t\t%s[%s - 1] = '\\0';" in_ptr_name len_var; sprintf "\t\t%s = strlen(%s) + 1;" len_var in_ptr_name; - sprintf "\t\tif (memcpy_s((void*)%s, %s, %s, %s)) {" (mk_tmp_var name) len_var in_ptr_name len_var; + sprintf "\t\tif (MEMCPY_S((void*)%s, %s, %s, %s)) {" (mk_tmp_var name) len_var in_ptr_name len_var; "\t\t\tstatus = SGX_ERROR_UNEXPECTED;"; "\t\t\tgoto err;"; "\t\t}"; @@ -1455,7 +1463,7 @@ let gen_parm_ptr_direction_post (plist: Ast.pdecl list) = "\t{"; sprintf "\t\t%s[(%s - sizeof(wchar_t))/sizeof(wchar_t)] = (wchar_t)0;" in_ptr_name len_var; sprintf "\t\t%s = (wcslen(%s) + 1) * sizeof(wchar_t);" len_var in_ptr_name; - sprintf "\t\tif (memcpy_s((void*)%s, %s, %s, %s)) {" (mk_tmp_var name) len_var in_ptr_name len_var; + sprintf "\t\tif (MEMCPY_S((void*)%s, %s, %s, %s)) {" (mk_tmp_var name) len_var in_ptr_name len_var; "\t\t\tstatus = SGX_ERROR_UNEXPECTED;"; "\t\t\tgoto err;"; "\t\t}"; @@ -1466,7 +1474,7 @@ let gen_parm_ptr_direction_post (plist: Ast.pdecl list) = else let code_template = [ sprintf "\tif (%s) {" in_ptr_name; - sprintf "%s\t\tif (memcpy_s(%s, %s, %s, %s)) {" struct_deep_copy_post (mk_tmp_var name) len_var in_ptr_name len_var; + sprintf "%s\t\tif (MEMCPY_S(%s, %s, %s, %s)) {" struct_deep_copy_post (mk_tmp_var name) len_var in_ptr_name len_var; "\t\t\tstatus = SGX_ERROR_UNEXPECTED;"; "\t\t\tgoto err;"; "\t\t}"; @@ -1484,14 +1492,14 @@ let gen_parm_ptr_direction_post (plist: Ast.pdecl list) = (* Generate an "err:" goto mark if necessary. *) -let gen_err_mark (plist: Ast.pdecl list) = +let gen_err_mark (fd: Ast.func_decl) = let has_inout_p (attr: Ast.ptr_attr): bool = attr.Ast.pa_direction <> Ast.PtrNoDirection in - if List.exists (fun (pt, name) -> + if fd.rtype <> Ast.Void || List.exists (fun (pt, name) -> match pt with Ast.PTVal _ -> false - | Ast.PTPtr(_, attr) -> has_inout_p attr) plist + | Ast.PTPtr(_, attr) -> has_inout_p attr) fd.plist then "err:" else "" @@ -1661,7 +1669,10 @@ let gen_func_tbridge (fd: Ast.func_decl) (dummy_var: string) = let func_open = sprintf "static sgx_status_t SGX_CDECL %s(void* %s)\n{\n" (mk_tbridge_name fd.Ast.fname) ms_ptr_name in - let local_vars = gen_tbridge_local_vars fd.Ast.plist in + let local_vars = gen_tbridge_local_vars fd.Ast.plist ^ + if fd.rtype <> Ast.Void + then sprintf "\t%s %s;\n" (Ast.get_tystr fd.rtype) (mk_in_var retval_name) + else "" in let func_close = "\treturn status;\n}\n" in let ms_struct_name = mk_ms_struct_name fd.Ast.fname in @@ -1672,9 +1683,21 @@ let gen_func_tbridge (fd: Ast.func_decl) (dummy_var: string) = ms_ptr_name in let invoke_func = gen_func_invoking fd mk_parm_name_tbridge in - let update_retval = sprintf "%s = %s" - (mk_parm_accessor retval_name) - invoke_func in + + let update_retval = + let code_template =[ + sprintf "%s = %s"(mk_in_var retval_name) invoke_func; + sprintf "if (MEMCPY_S(&%s, sizeof(%s), &%s, sizeof(%s))) {" + (mk_parm_accessor retval_name) + (mk_parm_accessor retval_name) + (mk_in_var retval_name) + (mk_in_var retval_name); + "\tstatus = SGX_ERROR_UNEXPECTED;"; + "\tgoto err;"; + "}"; + ] + in + List.fold_left (fun acc s -> acc ^ "\t" ^ s ^ "\n") "" code_template in if is_naked_func fd then let check_pms = @@ -1682,7 +1705,7 @@ let gen_func_tbridge (fd: Ast.func_decl) (dummy_var: string) = in sprintf "%s%s%s\t%s\n\t%s\n%s" func_open local_vars dummy_var check_pms invoke_func func_close else - sprintf "%s%s\t%s\n%s\n%s%s\n%s\n\t%s\n%s\n%s\n%s%s" + sprintf "%s%s\t%s\n%s\n%s%s\n%s%s%s\n%s\n%s%s" func_open (mk_check_pms fd.Ast.fname) declare_ms_ptr @@ -1690,9 +1713,9 @@ let gen_func_tbridge (fd: Ast.func_decl) (dummy_var: string) = (gen_check_tbridge_length_overflow fd.Ast.plist) (gen_check_tbridge_ptr_parms fd.Ast.plist) (gen_parm_ptr_direction_pre fd.Ast.plist) - (if fd.Ast.rtype <> Ast.Void then update_retval else invoke_func) + (if fd.rtype <> Ast.Void then update_retval else sprintf "\t%s\n" invoke_func) (gen_parm_ptr_direction_post fd.Ast.plist) - (gen_err_mark fd.Ast.plist) + (gen_err_mark fd) (gen_parm_ptr_free_post fd.Ast.plist) func_close @@ -1702,14 +1725,23 @@ let tproxy_fill_ms_field (pd: Ast.pdecl) (is_ocall_switchless: bool) = let len_var = mk_len_var name in let parm_accessor = mk_parm_accessor name in let sgx_ocfree_fn = get_sgx_fname SGX_OCFREE is_ocall_switchless in + let copy_ms_val_filed = [ + sprintf "\tif (MEMCPY_S(&%s, sizeof(%s), &%s, sizeof(%s))) {" + parm_accessor + parm_accessor + name + name; + sprintf "\t\t%s();" sgx_ocfree_fn; + "\t\treturn SGX_ERROR_UNEXPECTED;"; + "\t}"; + ] in match pt with - Ast.PTVal _ -> fill_ms_field true pd + Ast.PTVal _ -> List.fold_left (fun acc s -> acc ^ s ^ "\n") "" copy_ms_val_filed | Ast.PTPtr(ty, attr) -> let is_ary = (Ast.is_array declr || attr.Ast.pa_isary) in let tystr = sprintf "%s%s%s" (if is_const_ptr pt then "const " else"")(get_param_tystr pt) (if is_ary then "*" else "") in if not attr.Ast.pa_chkptr then (* [user_check] specified *) - if is_ary then sprintf "%s = SGX_CAST(%s, %s);" parm_accessor tystr name - else sprintf "%s = %s;" parm_accessor name + List.fold_left (fun acc s -> acc ^ s ^ "\n") "" copy_ms_val_filed else let check_size = match ty with @@ -1754,7 +1786,7 @@ let tproxy_fill_ms_field (pd: Ast.pdecl) (is_ocall_switchless: bool) = in let post = let code_template =[ - sprintf "\tif (memcpy_s((void *)((size_t)__tmp + sizeof(__local_%s) * i), sizeof(__local_%s), &__local_%s, sizeof(__local_%s))) {" name name name name; + sprintf "\tif (MEMCPY_S((void *)((size_t)__tmp + sizeof(__local_%s) * i), sizeof(__local_%s), &__local_%s, sizeof(__local_%s))) {" name name name name; sprintf "\t\t%s();" sgx_ocfree_fn; "\t\treturn SGX_ERROR_UNEXPECTED;"; "\t}"; @@ -1769,7 +1801,7 @@ let tproxy_fill_ms_field (pd: Ast.pdecl) (is_ocall_switchless: bool) = let non_deep_copy_out = let code_template = [ - sprintf "if (memcpy_s(__tmp, ocalloc_size, %s, %s)) {" name len_var; + sprintf "if (MEMCPY_S(__tmp, ocalloc_size, %s, %s)) {" name len_var; sprintf "\t\t%s();" sgx_ocfree_fn; "\t\treturn SGX_ERROR_UNEXPECTED;"; "\t}"; @@ -1778,27 +1810,39 @@ let tproxy_fill_ms_field (pd: Ast.pdecl) (is_ocall_switchless: bool) = in if deep_copy_out = "" then non_deep_copy_out else deep_copy_out in + let assign_tmp_to_ptr = [ + sprintf "\tif (MEMCPY_S(&%s, sizeof(%s), &__tmp, sizeof(%s))) {" + parm_accessor + tystr + tystr; + sprintf "\t\t%s();" sgx_ocfree_fn; + "\t\treturn SGX_ERROR_UNEXPECTED;"; + "\t}"; + ] + in match attr.Ast.pa_direction with Ast.PtrOut -> let code_template = - [sprintf "if (%s != NULL) {" name; - sprintf "\t%s = (%s)__tmp;" parm_accessor tystr; + [sprintf "if (%s != NULL) {" name;] + @ assign_tmp_to_ptr @ + [ sprintf "\t__tmp_%s = __tmp;" name; ] @ check_size @ [ - sprintf "\tmemset(__tmp_%s, 0, %s);" name len_var; + sprintf "\tMEMSET(__tmp_%s, 0, %s);" name len_var; sprintf "\t__tmp = (void *)((size_t)__tmp + %s);" len_var; sprintf "\tocalloc_size -= %s;" len_var; "} else {"; sprintf "\t%s = NULL;" parm_accessor; "}" ] - in List.fold_left (fun acc s -> acc ^ s ^ "\n\t") "" code_template + in List.fold_left (fun acc s -> acc ^ "\t" ^ s ^ "\n") "" code_template | Ast.PtrInOut -> let code_template = - [sprintf "if (%s != NULL) {" name; - sprintf "\t%s = (%s)__tmp;" parm_accessor tystr; + [sprintf "if (%s != NULL) {" name;] + @ assign_tmp_to_ptr @ + [ sprintf "\t__tmp_%s = __tmp;" name; ] @ check_size @ @@ -1809,13 +1853,12 @@ let tproxy_fill_ms_field (pd: Ast.pdecl) (is_ocall_switchless: bool) = sprintf "\t%s = NULL;" parm_accessor; "}" ] - in List.fold_left (fun acc s -> acc ^ s ^ "\n\t") "" code_template + in List.fold_left (fun acc s -> acc ^ "\t" ^ s ^ "\n") "" code_template | _ -> let code_template = [sprintf "if (%s != NULL) {" name; - sprintf "\t%s = (%s)__tmp;" parm_accessor tystr; ] - @ check_size @ + @ assign_tmp_to_ptr @ check_size @ [ sprintf "%s\t\t__tmp = (void *)((size_t)__tmp + %s);" copy_out len_var; sprintf "\tocalloc_size -= %s;" len_var; @@ -1823,7 +1866,7 @@ let tproxy_fill_ms_field (pd: Ast.pdecl) (is_ocall_switchless: bool) = sprintf "\t%s = NULL;" parm_accessor; "}" ] - in List.fold_left (fun acc s -> acc ^ s ^ "\n\t") "" code_template + in List.fold_left (fun acc s -> acc ^ "\t" ^ s ^ "\n") "" code_template (* Attach data pointed by structure member pointer at the end of ms. *) let tproxy_fill_structure(pd: Ast.pdecl) (is_ocall_switchless: bool)= @@ -1844,11 +1887,11 @@ let tproxy_fill_structure(pd: Ast.pdecl) (is_ocall_switchless: bool)= [ sprintf "%s = %s;" len_member_name (gen_struct_ptr_size ty attr name para_struct); sprintf "\tif (%s != NULL && %s != 0) {" para_struct_member len_member_name; - sprintf "\t\tif (memcpy_s(__tmp, %s, %s, %s)) {" len_member_name para_struct_member len_member_name; + sprintf "\t\tif (MEMCPY_S(__tmp, %s, %s, %s) ||" len_member_name para_struct_member len_member_name; + sprintf "\t\t\tMEMCPY_S(&%s, sizeof(%s), &__tmp, sizeof(%s))) {" in_struct_member (Ast.get_tystr ty) (Ast.get_tystr ty); sprintf "\t\t\t%s();" sgx_ocfree_fn; "\t\t\treturn SGX_ERROR_UNEXPECTED;"; "\t\t}"; - sprintf "\t\t%s = (%s)__tmp;" in_struct_member (Ast.get_tystr ty); sprintf "\t\t__tmp = (void *)((size_t)__tmp + %s);" len_member_name; sprintf "\t\tocalloc_size -= %s;" len_member_name; "\t} else {"; @@ -1879,7 +1922,7 @@ let tproxy_fill_structure(pd: Ast.pdecl) (is_ocall_switchless: bool)= (* Generate local variables required for the trusted proxy, inclidng variables required by structure deep copy. *) let gen_tproxy_local_vars (plist: Ast.pdecl list) = - let status_var = "sgx_status_t status = SGX_SUCCESS;\n" in + let status_var = "\tsgx_status_t status = SGX_SUCCESS;\n" in let do_gen_local_vars (ty: Ast.atype) (attr: Ast.ptr_attr) (name: string) = let do_gen_local_var = if not attr.Ast.pa_chkptr then "" @@ -1920,7 +1963,7 @@ let gen_tproxy_local_vars (plist: Ast.pdecl list) = let gen_ocalloc_block (fname: string) (plist: Ast.pdecl list) (is_switchless: bool) = let ms_struct_name = mk_ms_struct_name fname in let new_param_list = List.map conv_array_to_ptr plist in - let local_vars_block = sprintf "%s* %s = NULL;\n\tsize_t ocalloc_size = sizeof(%s);\n\tvoid *__tmp = NULL;\n\n" ms_struct_name ms_struct_val ms_struct_name in + let local_vars_block = sprintf "\t%s* %s = NULL;\n\tsize_t ocalloc_size = sizeof(%s);\n\tvoid *__tmp = NULL;\n\n" ms_struct_name ms_struct_val ms_struct_name in let local_var (ty: Ast.atype) (attr: Ast.ptr_attr) (name: string) = if not attr.Ast.pa_chkptr then "" else @@ -2189,13 +2232,13 @@ let gen_func_tproxy (ufunc: Ast.untrusted_func) (idx: int) = (gen_ocfree fd.Ast.rtype fd.Ast.plist) "\treturn status;\n}" in let sgx_ocall_fn = get_sgx_fname SGX_OCALL ufunc.Ast.uf_is_switchless in - let ocall_null = sprintf "status = %s(%d, NULL);\n" sgx_ocall_fn idx in - let ocall_with_ms = sprintf "status = %s(%d, %s);\n" sgx_ocall_fn idx ms_struct_val in - let update_retval = sprintf "\tif (%s) *%s = %s;" + let ocall_null = sprintf "\tstatus = %s(%d, NULL);\n" sgx_ocall_fn idx in + let ocall_with_ms = sprintf "\tstatus = %s(%d, %s);\n" sgx_ocall_fn idx ms_struct_val in + let update_retval = sprintf "\t\tif (%s) *%s = %s;" retval_name retval_name (mk_parm_accessor retval_name) in let func_body = ref [] in if (is_naked_func fd) && (propagate_errno = false) then - sprintf "%s\t%s\t%s%s" func_open local_vars ocall_null "\n\treturn status;\n}" + sprintf "%s%s%s%s" func_open local_vars ocall_null "\n\treturn status;\n}" else begin func_body := local_vars :: !func_body; @@ -2204,9 +2247,9 @@ let gen_func_tproxy (ufunc: Ast.untrusted_func) (idx: int) = func_body := ocalloc_struct_deep_copy ufunc.Ast.uf_is_switchless :: !func_body; List.iter (fun pd -> func_body := tproxy_fill_structure pd ufunc.Ast.uf_is_switchless:: !func_body) fd.Ast.plist; func_body := ocall_with_ms :: !func_body; - func_body := "if (status == SGX_SUCCESS) {" :: !func_body; + func_body := "\tif (status == SGX_SUCCESS) {" :: !func_body; if fd.Ast.rtype <> Ast.Void then func_body := update_retval :: !func_body; - List.fold_left (fun acc s -> if s = "" then acc else acc ^ "\t" ^ s ^ "\n") func_open (List.rev !func_body) ^ func_close + List.fold_left (fun acc s -> if s = "" then acc else acc ^ s ^ "\n") func_open (List.rev !func_body) ^ func_close end (* It generates OCALL table and the untrusted proxy to setup OCALL table. *) diff --git a/sdk/sign_tool/SignTool/sign_tool.cpp b/sdk/sign_tool/SignTool/sign_tool.cpp index ea9f5317..ba5d896f 100644 --- a/sdk/sign_tool/SignTool/sign_tool.cpp +++ b/sdk/sign_tool/SignTool/sign_tool.cpp @@ -1306,7 +1306,7 @@ int main(int argc, char* argv[]) {"EnclaveImageAddress", 0xFFFFFFFFFFFFFFFF, 0x1000, 0, 0}, {"ELRangeStartAddress", 0xFFFFFFFFFFFFFFFF, 0, 0, 0}, {"ELRangeSize", 0xFFFFFFFFFFFFFFFF, 0x1000, 0, 0}, - {"PKRU", FEATURE_LOADER_SELECTS, FEATURE_MUST_BE_DISABLED, FEATURE_MUST_BE_DISABLED, 0}}; + {"PKRU", FEATURE_LOADER_SELECTS, FEATURE_MUST_BE_DISABLED, FEATURE_MUST_BE_DISABLED, 0}}; const char *path[8] = {NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL}; uint8_t enclave_hash[SGX_HASH_SIZE] = {0}; uint8_t metadata_raw[METADATA_SIZE]; diff --git a/sdk/simulation/urtssim/enclave_creator_sim.cpp b/sdk/simulation/urtssim/enclave_creator_sim.cpp index 64b9e0e8..8bed968e 100644 --- a/sdk/simulation/urtssim/enclave_creator_sim.cpp +++ b/sdk/simulation/urtssim/enclave_creator_sim.cpp @@ -75,18 +75,7 @@ static void cleanup_openssl(void) static Mutex s_enclave_info_mutex; -static std::maps_enclave_elrange_map; - -__attribute__((destructor)) -static void enclave_elrange_cleanup(void) -{ - for (auto &res:s_enclave_elrange_map) - { - auto elrange = res.second; - delete elrange; - elrange = NULL; - } -} +static std::maps_enclave_elrange_map; extern "C" bool get_elrange_start_address(void* base_address, uint64_t &elrange_start_address) { @@ -94,7 +83,7 @@ extern "C" bool get_elrange_start_address(void* base_address, uint64_t &elrange_ bool ret = false; if(s_enclave_elrange_map.count(base_address) != 0) { - elrange_start_address = s_enclave_elrange_map[base_address]->elrange_start_address; + elrange_start_address = s_enclave_elrange_map[base_address].elrange_start_address; ret = true; } return ret; @@ -116,33 +105,7 @@ int EnclaveCreatorSim::create_enclave(secs_t *secs, sgx_enclave_id_t *enclave_id enclave_elrange_t *tmp_enclave_elrange = reinterpret_cast(const_cast(ex_features_p[ENCLAVE_CREATE_EX_EL_RANGE_BIT_IDX])); void *base_address = reinterpret_cast(tmp_enclave_elrange->enclave_image_address); LockGuard lock(&s_enclave_info_mutex); - if (s_enclave_elrange_map.count(base_address) != 0) - { - enclave_elrange_t *enclave_elrange = s_enclave_elrange_map[base_address]; - if (enclave_elrange == NULL) - { - return SGX_ERROR_UNEXPECTED; - } - - if (memcpy_s(enclave_elrange, sizeof(enclave_elrange_t), tmp_enclave_elrange, sizeof(enclave_elrange_t))) - { - return SGX_ERROR_UNEXPECTED; - } - } - else - { - enclave_elrange_t *enclave_elrange = new(std::nothrow) enclave_elrange_t; - if (enclave_elrange == NULL) - { - return SGX_ERROR_OUT_OF_MEMORY; - } - memset(enclave_elrange, 0, sizeof(enclave_elrange_t)); - if (memcpy_s(enclave_elrange, sizeof(enclave_elrange_t), tmp_enclave_elrange, sizeof(enclave_elrange_t))) - { - return SGX_ERROR_UNEXPECTED; - } - s_enclave_elrange_map[base_address] = enclave_elrange; - } + s_enclave_elrange_map[base_address] = *tmp_enclave_elrange; } return ::create_enclave(secs, enclave_id, start_addr); } @@ -257,6 +220,9 @@ int EnclaveCreatorSim::destroy_enclave(sgx_enclave_id_t enclave_id, uint64_t enc if(enclave == NULL) return SGX_ERROR_INVALID_ENCLAVE_ID; + + s_enclave_elrange_map.erase(enclave->get_start_address()); + return ::destroy_enclave(enclave_id); } diff --git a/sdk/switchless/inc/sl_bitops.h b/sdk/switchless/inc/sl_bitops.h index 6b8f5c3f..587b1a4c 100644 --- a/sdk/switchless/inc/sl_bitops.h +++ b/sdk/switchless/inc/sl_bitops.h @@ -55,7 +55,7 @@ static inline uint32_t count_leading_zeroes(uint64_t value) static inline void set_bit(volatile uint64_t* l, uint32_t i) { - lock_or64(l, 1UL << i); + lock_or64(l, 1ULL << i); } static inline int32_t test_and_clear_bit(volatile uint64_t* l, uint32_t i) @@ -63,9 +63,9 @@ static inline int32_t test_and_clear_bit(volatile uint64_t* l, uint32_t i) uint64_t old_l, new_l; retry: old_l = *l; - if (unlikely((old_l & (1UL << i)) == 0)) return 0; + if (unlikely((old_l & (1ULL << i)) == 0)) return 0; - new_l = old_l & (~(1UL << i)); + new_l = old_l & (~(1ULL << i)); if (unlikely(lock_cmpxchg64(l, old_l, new_l) != old_l)) goto retry; return 1; } diff --git a/sdk/switchless/inc/sl_fcall_mngr_common.h b/sdk/switchless/inc/sl_fcall_mngr_common.h index 5ae6a235..06c3a664 100644 --- a/sdk/switchless/inc/sl_fcall_mngr_common.h +++ b/sdk/switchless/inc/sl_fcall_mngr_common.h @@ -90,6 +90,20 @@ static inline uint32_t sl_call_mngr_process(struct sl_call_mngr* mngr) return sl_siglines_process_signals(&mngr->siglns); } +#ifdef SL_INSIDE_ENCLAVE /* Trusted */ +#include +#define SET_VALUE_HARDEN_FOR_PROCESS_TASK(dest, value, value_type) \ + do { \ + value_type tmp = value; \ + memcpy_verw((void*)(dest), &tmp, sizeof(value_type)); \ + } while(0) +#else /* Untrusted */ +#define SET_VALUE_HARDEN_FOR_PROCESS_TASK(dest, value, value_type) \ + do { \ + *(dest) = value; \ + } while(0) +#endif + static inline void process_switchless_call(struct sl_siglines* siglns, uint32_t line) { /* @@ -124,7 +138,7 @@ static inline void process_switchless_call(struct sl_siglines* siglns, uint32_t struct sl_call_task *call_task_u = &mngr->tasks[line]; BUG_ON(call_task_u->status != SL_SUBMITTED); - call_task_u->status = SL_ACCEPTED; + SET_VALUE_HARDEN_FOR_PROCESS_TASK(&call_task_u->status, SL_ACCEPTED, sl_call_status_t); uint32_t func_id = call_task_u->func_id; @@ -132,7 +146,7 @@ static inline void process_switchless_call(struct sl_siglines* siglns, uint32_t sl_call_func_t call_func_ptr = NULL; if (unlikely(func_id >= call_table->size)) { - call_task_u->ret_code = SGX_ERROR_INVALID_FUNCTION; + SET_VALUE_HARDEN_FOR_PROCESS_TASK(&call_task_u->ret_code, SGX_ERROR_INVALID_FUNCTION, sgx_status_t); goto on_done; } @@ -141,26 +155,40 @@ static inline void process_switchless_call(struct sl_siglines* siglns, uint32_t call_func_ptr = call_table->funcs[func_id]; if (unlikely(call_func_ptr == NULL)) { - call_task_u->ret_code = mngr->type == SL_TYPE_ECALL ? - SGX_ERROR_ECALL_NOT_ALLOWED : - SGX_ERROR_OCALL_NOT_ALLOWED; + SET_VALUE_HARDEN_FOR_PROCESS_TASK(&call_task_u->ret_code, + mngr->type == SL_TYPE_ECALL ? SGX_ERROR_ECALL_NOT_ALLOWED : SGX_ERROR_OCALL_NOT_ALLOWED, + sgx_status_t); goto on_done; } // Do the call. // func_data should point to untrusted buffer and should be checked by invoked function // in our case, edre8r generated code is performing the check - call_task_u->ret_code = call_func_ptr(call_task_u->func_data); + { + sgx_status_t ret = call_func_ptr(call_task_u->func_data); + SET_VALUE_HARDEN_FOR_PROCESS_TASK(&call_task_u->ret_code, ret, sgx_status_t); + } on_done: /* Notify the caller that the switchless is done by updating the status. * The memory barrier ensures that switchless results are visible to the * caller when it finds out that the status becomes SL_DONE. */ - call_task_u->status = SL_DONE; + SET_VALUE_HARDEN_FOR_PROCESS_TASK(&call_task_u->status, SL_DONE, sl_call_status_t); sgx_mfence(); } - +#ifdef SL_INSIDE_ENCLAVE +#define SET_VALUE_HARDEN_FOR_SEND_TASK(dest, value, value_type) \ + do { \ + value_type tmp = value; \ + memcpy_verw((void*)(dest), &tmp, sizeof(value_type)); \ + } while(0) +#else +#define SET_VALUE_HARDEN_FOR_SEND_TASK(dest, value, value_type) \ + do { \ + *(dest) = value; \ + } while(0) +#endif static inline int sl_call_mngr_call(struct sl_call_mngr* mngr, struct sl_call_task* call_task, uint32_t max_tries) { @@ -185,10 +213,10 @@ static inline int sl_call_mngr_call(struct sl_call_mngr* mngr, struct sl_call_ta return -EAGAIN; BUG_ON(call_task->status != SL_INIT); - call_task->status = SL_SUBMITTED; + SET_VALUE_HARDEN_FOR_SEND_TASK(&call_task->status, SL_SUBMITTED, sl_call_status_t); // copy task data to internal array accessable by both sides (trusted & untrusted) - mngr->tasks[line] = *call_task; + SET_VALUE_HARDEN_FOR_SEND_TASK(&mngr->tasks[line], *call_task, struct sl_call_task); /* Send a signal so that workers will access the buffer for switchless call * requests. Here, a memory barrier is used to make sure the buffer is @@ -232,7 +260,7 @@ static inline int sl_call_mngr_call(struct sl_call_mngr* mngr, struct sl_call_ta call_task->ret_code = mngr->tasks[line].ret_code; on_exit: - mngr->tasks[line].func_id = SL_INVALID_FUNC_ID; + SET_VALUE_HARDEN_FOR_SEND_TASK(&mngr->tasks[line].func_id, SL_INVALID_FUNC_ID, uint32_t); sl_siglines_free_line(siglns, line); return ret; } diff --git a/sdk/switchless/sgx_tswitchless/sgx_ocall_switchless.c b/sdk/switchless/sgx_tswitchless/sgx_ocall_switchless.c index 469b586e..bb26ef65 100644 --- a/sdk/switchless/sgx_tswitchless/sgx_ocall_switchless.c +++ b/sdk/switchless/sgx_tswitchless/sgx_ocall_switchless.c @@ -75,6 +75,12 @@ static int_type init_tswitchless_ocall_mngr(void* param) /*========================================================================= * The implementation of switchless OCall *========================================================================*/ +#include +#define SET_VALUE_HARDEN(dest, value, value_type) \ + do { \ + value_type tmp = value; \ + memcpy_verw((void*)(dest), &tmp, sizeof(value_type)); \ + } while(0) sgx_status_t sgx_ocall_switchless(const unsigned int index, void* ms) { @@ -97,7 +103,7 @@ sgx_status_t sgx_ocall_switchless(const unsigned int index, void* ms) // if there are sleeping workers, wake them up if (g_uswitchless_handle->us_uworkers.num_sleeping > 0) { - g_uswitchless_handle->us_wake_workers = 1; + SET_VALUE_HARDEN(&g_uswitchless_handle->us_wake_workers, 1, uint64_t); } struct sl_call_task call_task; @@ -118,7 +124,7 @@ sgx_status_t sgx_ocall_switchless(const unsigned int index, void* ms) on_fallback: lock_inc(&g_uswitchless_handle->us_uworkers.stats.missed); - g_uswitchless_handle->us_has_new_ocall_fallback = 1; + SET_VALUE_HARDEN(&g_uswitchless_handle->us_has_new_ocall_fallback, 1, uint64_t); return sgx_ocall(index, ms); } diff --git a/sdk/tkey_exchange/tkey_exchange.cpp b/sdk/tkey_exchange/tkey_exchange.cpp index 3aec583d..4f361817 100644 --- a/sdk/tkey_exchange/tkey_exchange.cpp +++ b/sdk/tkey_exchange/tkey_exchange.cpp @@ -576,7 +576,7 @@ extern "C" sgx_status_t sgx_ra_get_msg3_trusted( } memcpy(&msg3_except_quote_in.mac, mac, sizeof(mac)); - memcpy(emp_msg3, &msg3_except_quote_in, offsetof(sgx_ra_msg3_t, quote)); + memcpy_verw(emp_msg3, &msg3_except_quote_in, offsetof(sgx_ra_msg3_t, quote)); se_ret = SGX_SUCCESS; }while(0); memset_s(&smk_key, sizeof(smk_key), 0, sizeof(smk_key)); diff --git a/sdk/tlibc/string/asm/memcpy_verw.S b/sdk/tlibc/string/asm/memcpy_verw.S new file mode 100644 index 00000000..3bcdae8f --- /dev/null +++ b/sdk/tlibc/string/asm/memcpy_verw.S @@ -0,0 +1,64 @@ +/* + * Copyright (C) 2011-2021 Intel Corporation. All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * + * * Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * * Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in + * the documentation and/or other materials provided with the + * distribution. + * * Neither the name of Intel Corporation nor the names of its + * contributors may be used to endorse or promote products derived + * from this software without specific prior written permission. + * + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS + * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT + * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR + * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT + * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, + * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT + * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, + * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY + * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT + * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE + * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + * + */ +#include "DEFS.h" + + /* + * void* __memcpy_verw(void *dst, const void *src) + * + */ + +ENTRY(__memcpy_verw) + RETGUARD_SETUP(__memcpy_verw, r10) + movb (%rsi), %al + sub $8, %rsp + mov %ds, (%rsp) + verw (%rsp) + movb %al, (%rdi) + mfence + lfence + add $8, %rsp + movq %rdi, %rax + RETGUARD_CHECK(__memcpy_verw, r10) + ret +END_STRONG(__memcpy_verw) + + /* + * void* __memcpy_8a(void *dst, const void *src) + * + */ +ENTRY(__memcpy_8a) + RETGUARD_SETUP(__memcpy_8a, r10) + movq (%rsi), %rax + movq %rax, (%rdi) + movq %rdi, %rax + RETGUARD_CHECK(__memcpy_8a, r10) + ret +END_STRONG(__memcpy_8a) diff --git a/sdk/tlibc/string/memcpy.c b/sdk/tlibc/string/memcpy.c index 25d0421e..a8dd23b5 100644 --- a/sdk/tlibc/string/memcpy.c +++ b/sdk/tlibc/string/memcpy.c @@ -48,6 +48,7 @@ typedef long word; /* "word" used for optimal copy speed */ extern void *_intel_fast_memcpy(void *, void *, size_t); #endif + /* * Copy a block of memory, not handling overlap. */ @@ -100,6 +101,49 @@ done: return (dst0); } +extern void* __memcpy_verw(void *dst0, const void *src0); +extern void* __memcpy_8a(void *dst0, const void *src0); +// use in the enclave when dst is outside the enclave +void* memcpy_verw(void *dst0, const void *src0, size_t len) +{ + char* dst = dst0; + const char *src = (const char *)src0; + if(len == 0 || dst == src) + { + return dst0; + } + + //abort if overlap exist + if ((dst < src && dst + len > src) || + (src < dst && src + len > dst)) + { + abort(); + } + + while (len >= 8) { + if((unsigned long long)dst%8 == 0) { + // 8-byte-aligned - don't need bracketing + __memcpy_8a(dst, src); + src += 8; + dst += 8; + len -= 8; + } + else{ + // not 8-byte-aligned - need bracketing + __memcpy_verw(dst, src); + src++; + dst++; + len--; + } + } + // less than 8 bytes left - need bracketing + for (unsigned i = 0; i < len; i++) { + __memcpy_verw(dst, src); + src++; + dst++; + } + return dst0; +} void * memcpy(void *dst0, const void *src0, size_t length) diff --git a/sdk/tlibc/string/memmove.c b/sdk/tlibc/string/memmove.c index e3f0c0d6..a0a1a6ec 100644 --- a/sdk/tlibc/string/memmove.c +++ b/sdk/tlibc/string/memmove.c @@ -62,3 +62,75 @@ memmove(void *dst0, const void *src0, size_t length) #endif } +extern void* __memcpy_verw(void *dst0, const void *src0); +extern void* __memcpy_8a(void *dst0, const void *src0); +void * +memmove_verw(void *dst, const void *src, size_t count) +{ + if(count == 0 || dst == src) + { + return dst; + } + + if (dst < src) + { + // if src is above dst, we have to copy front to back + // to avoid overwriting the data we want to copy. + char* dst0 = (char*)dst; + const char *src0 = (const char *)src; + while (count >= 8) { + if((unsigned long long)dst0%8 == 0) { + // 8-byte-aligned - don't need bracketing + __memcpy_8a(dst0, src0); + src0 += 8; + dst0 += 8; + count -= 8; + } + else{ + // not 8-byte-aligned - need bracketing + __memcpy_verw(dst0, src0); + src0++; + dst0++; + count--; + } + } + // less than 8 bytes left - need bracketing + for (unsigned i = 0; i < count; i++) { + __memcpy_verw(dst0, src0); + src0++; + dst0++; + } + } + else + { + // If dst is above src, we have to copy back to front + // to avoid overwriting the data we want to copy. + char* dst0 = (char*)dst + count -1; + const char *src0 = (const char *)src + count -1; + while (count >= 8) { + if((unsigned long long)dst0%8 == 7) { + // 8-byte-aligned - don't need bracketing + __memcpy_8a(dst0 - 7, src0 - 7); + src0 -= 8; + dst0 -= 8; + count -= 8; + } + else{ + // not 8-byte-aligned - need bracketing + __memcpy_verw(dst0, src0); + src0--; + dst0--; + count--; + } + } + // less than 8 bytes left - need bracketing + for (unsigned i = 0; i < count; i++) { + __memcpy_verw(dst0, src0); + src0--; + dst0--; + } + } + + return dst; +} + diff --git a/sdk/tlibc/string/memset.c b/sdk/tlibc/string/memset.c index fcdca898..73ba2ff4 100644 --- a/sdk/tlibc/string/memset.c +++ b/sdk/tlibc/string/memset.c @@ -32,6 +32,8 @@ */ #include +#include +#include #ifdef _TLIBC_USE_INTEL_FAST_STRING_ extern void *_intel_fast_memset(void *, void *, size_t); @@ -39,6 +41,42 @@ extern void *_intel_fast_memset(void *, void *, size_t); extern void *__memset(void *dst, int c, size_t n); #endif +extern void* __memcpy_verw(void *dst0, const void *src0); +extern void* __memcpy_8a(void *dst0, const void *src0); + +void * +memset_verw(void *dst, int c, size_t len) +{ + char* dst0 = dst; + if (len == 0 || dst == NULL) + { + return dst; + } + unsigned char tt = (unsigned char)c; + uint64_t tmp = 0; + memset((void*)&tmp, c, 8); + while (len >= 8) { + if((unsigned long long)dst0%8 == 0) { + // 8-byte-aligned - don't need bracketing + __memcpy_8a(dst0, (void*)&tmp); + dst0 += 8; + len -= 8; + } + else{ + // not 8-byte-aligned - need bracketing + __memcpy_verw(dst0, (void *)&tt); + dst0++; + len--; + } + } + // less than 8 bytes left - need bracketing + for (unsigned i = 0; i < len; i++) { + __memcpy_verw(dst0, (void *)&tt); + dst0++; + } + return dst; +} + void * memset(void *dst, int c, size_t n) { @@ -48,4 +86,3 @@ memset(void *dst, int c, size_t n) return __memset(dst, c, n); #endif /* !_TLIBC_USE_INTEL_FAST_STRING_ */ } - diff --git a/sdk/tlibc/string/memset_s.c b/sdk/tlibc/string/memset_s.c index 53cb5304..280bd246 100644 --- a/sdk/tlibc/string/memset_s.c +++ b/sdk/tlibc/string/memset_s.c @@ -81,3 +81,38 @@ memset_s(void *s, size_t smax, int c, size_t n) return err; } } + + +errno_t +memset_verw_s(void *s, size_t smax, int c, size_t n) +{ + errno_t err = 0; + + if (s == NULL) { + err = EINVAL; + goto out; + } + if (smax > SIZE_MAX) { + err = E2BIG; + goto out; + } + if (n > SIZE_MAX) { + err = E2BIG; + n = smax; + } + if (n > smax) { + err = EOVERFLOW; + n = smax; + } + + memset_verw(s, c, n); + + out: + if (err == 0) + return 0; + else { + errno = err; + /* XXX call runtime-constraint handler */ + return err; + } +} diff --git a/sdk/trts/init_enclave.cpp b/sdk/trts/init_enclave.cpp index 525e9924..8d303d48 100644 --- a/sdk/trts/init_enclave.cpp +++ b/sdk/trts/init_enclave.cpp @@ -60,7 +60,7 @@ uint64_t g_enclave_base __attribute__((section(RELRO_SECTION_NAME))) = 0; uint64_t g_enclave_size __attribute__((section(RELRO_SECTION_NAME))) = 0; -const volatile global_data_t g_global_data __attribute__((section(".niprod"))) = {VERSION_UINT, 1, 2, 3, 4, 5, 6, 0, 0, +const volatile global_data_t g_global_data __attribute__((section(".niprod"))) = {VERSION_UINT, 1, 2, 3, 4, 5, 6, 0, 0, 0, {0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, {0, 0, 0, 0, 0, 0}, 0}, {0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0}, 0, 0, {{{0, 0, 0, 0, 0, 0, 0}}}, 0, 0, 0}; uint32_t g_enclave_state __attribute__((section(".nipd"))) = ENCLAVE_INIT_NOT_STARTED; uint32_t g_cpu_core_num __attribute__((section(RELRO_SECTION_NAME))) = 0; diff --git a/sdk/trts/linux/trts_pic.S b/sdk/trts/linux/trts_pic.S index 92470a49..f969304a 100644 --- a/sdk/trts/linux/trts_pic.S +++ b/sdk/trts/linux/trts_pic.S @@ -169,6 +169,7 @@ DECLARE_GLOBAL_FUNC enclave_entry mov %xdi, (%xsp) #endif call restore_xregs + lfence add $(4*SE_WORDSIZE), %xsp /* switch to C code */ @@ -188,6 +189,7 @@ DECLARE_GLOBAL_FUNC enclave_entry mov %xdi, (%xsp) #endif call restore_xregs + lfence /* set xdi and xsi */ mov $OCMD_ERET, %xdi @@ -337,6 +339,7 @@ DECLARE_LOCAL_FUNC do_ocall lea_pic SYNTHETIC_STATE, %xdi mov %xdi, (%xsp) call restore_xregs + lfence /* set xdi and xsi using the input parameters */ #ifdef LINUX64 @@ -451,6 +454,7 @@ DECLARE_GLOBAL_FUNC asm_oret mov %xdi, (%xsp) #endif call restore_xregs + lfence /* memset_s */ xor %xax, %xax diff --git a/sdk/trts/trts_util.cpp b/sdk/trts/trts_util.cpp index 6cc0c7b3..196bcad0 100644 --- a/sdk/trts/trts_util.cpp +++ b/sdk/trts/trts_util.cpp @@ -195,7 +195,15 @@ bool is_utility_thread() size_t get_max_tcs_num() { - return (size_t)g_global_data.tcs_max_num; + if (EDMM_supported == 1) + { + return (size_t)g_global_data.tcs_max_num; + } + else + { + return (size_t)g_global_data.tcs_num; + } + } bool is_pkru_enabled() diff --git a/sdk/trts/trts_veh.cpp b/sdk/trts/trts_veh.cpp index e951b02a..c36c56ed 100644 --- a/sdk/trts/trts_veh.cpp +++ b/sdk/trts/trts_veh.cpp @@ -383,7 +383,7 @@ extern "C" sgx_status_t trts_handle_exception(void *tcs) return SGX_ERROR_STACK_OVERRUN; } - // sp is within limit_addr and commit_addr, currently only SGX 2.0 under hardware mode will enter this branch.^M + // sp is within limit_addr and commit_addr, currently only SGX 2.0 under hardware mode will enter this branch. if((size_t)sp < thread_data->stack_commit_addr) { int ret = -1; diff --git a/sdk/trts/trts_xsave.cpp b/sdk/trts/trts_xsave.cpp index 2806260b..3b035327 100644 --- a/sdk/trts/trts_xsave.cpp +++ b/sdk/trts/trts_xsave.cpp @@ -43,7 +43,7 @@ //XRSTOR in compacted mode will ignore the first 512 bytes. extern "C" SE_DECLSPEC_ALIGN(XSAVE_ALIGN_SIZE) const uint32_t SYNTHETIC_STATE[SYNTHETIC_STATE_SIZE/sizeof(uint32_t)] __attribute__((section(".niprod"))) = { - 0x037F, 0, 0, 0, 0, 0, 0x1F80, 0xFFFF, 0, 0, 0, 0, 0, 0, 0, 0, + 0x037F, 0, 0, 0, 0, 0, 0x1FBF, 0xFFFF, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, @@ -51,7 +51,7 @@ SYNTHETIC_STATE[SYNTHETIC_STATE_SIZE/sizeof(uint32_t)] __attribute__((section(". 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, - 0, 0, 0, 0x80000000, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, // XCOMP_BV[63] = 1, compaction mode + 2, 0, 2, 0x80000000, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, // XCOMP_BV[63] = 1, compaction mode }; int g_xsave_enabled __attribute__((section(".nipd"))) = 0; // flag to indicate whether xsave is enabled or not diff --git a/sdk/tsafecrt/pal/src/safecrt/memcpy_s.c b/sdk/tsafecrt/pal/src/safecrt/memcpy_s.c index a2f22a4a..cb9c8061 100644 --- a/sdk/tsafecrt/pal/src/safecrt/memcpy_s.c +++ b/sdk/tsafecrt/pal/src/safecrt/memcpy_s.c @@ -79,3 +79,59 @@ errno_t __cdecl memcpy_s( memcpy(dst, src, count); return 0; } + + +/*** +*memcpy_verw_s - Copy source buffer to destination buffer +* +*Purpose: +* memcpy_verw_s() copies a source memory buffer to a destination memory buffer. +* This routine handles the suitation that the destination buffer's address or +* the number of bytes to copy is not 8 byte aligned. +* This routine does NOT recognize overlapping buffers, and thus can lead +* to propagation. +* +* +*Entry: +* void *dst = pointer to destination buffer +* size_t sizeInBytes = size in bytes of the destination buffer +* const void *src = pointer to source buffer +* size_t count = number of bytes to copy +* +*Exit: +* Returns 0 if everything is ok, else return the error code. +* +*Exceptions: +* Input parameters are validated. Refer to the validation section of the function. +* On error, the error code is returned. +* +*******************************************************************************/ +errno_t __cdecl memcpy_verw_s( + void * dst, + size_t sizeInBytes, + const void * src, + size_t count +) +{ + if (count == 0) + { + /* nothing to do */ + return 0; + } + + /* validation section */ + _VALIDATE_RETURN_ERRCODE(dst != NULL, EINVAL); + if (src == NULL || sizeInBytes < count) + { + /* zeroes the destination buffer */ + memset_verw(dst, 0, sizeInBytes); + + _VALIDATE_RETURN_ERRCODE(src != NULL, EINVAL); + _VALIDATE_RETURN_ERRCODE(sizeInBytes >= count, ERANGE); + /* useless, but prefast is confused */ + return EINVAL; + } + + memcpy_verw(dst, src, count); + return 0; +} diff --git a/sdk/tsafecrt/pal/src/safecrt/memmove_s.c b/sdk/tsafecrt/pal/src/safecrt/memmove_s.c index 8469c254..35f1b605 100644 --- a/sdk/tsafecrt/pal/src/safecrt/memmove_s.c +++ b/sdk/tsafecrt/pal/src/safecrt/memmove_s.c @@ -117,3 +117,39 @@ int __cdecl memmove_s( void *ret_val = memmove_xplat(dst, src, count); return ret_val != NULL ? 0 : ENOMEM; // memmove_xplat returns `NULL` only if ENOMEM } + + +/* +dest + Destination object. + +sizeInBytes + Size of the destination buffer. + +src + Source object. + +count + Number of bytes (memmove_s) or characters (wmemmove_s) to copy. +*/ +int __cdecl memmove_verw_s( + void * dst, + size_t sizeInBytes, + const void * src, + size_t count +) +{ + if (count == 0) + { + /* nothing to do */ + return 0; + } + + /* validation section */ + _VALIDATE_RETURN_ERRCODE(dst != NULL, EINVAL); + _VALIDATE_RETURN_ERRCODE(src != NULL, EINVAL); + _VALIDATE_RETURN_ERRCODE(sizeInBytes >= count, ERANGE); + + void *ret_val = memmove_verw(dst, src, count); + return ret_val != NULL ? 0 : ENOMEM; // memmove_verw returns `NULL` only if ENOMEM +} diff --git a/sdk/ttls/ttls.cpp b/sdk/ttls/ttls.cpp index dce51f5c..5dc1067f 100644 --- a/sdk/ttls/ttls.cpp +++ b/sdk/ttls/ttls.cpp @@ -41,6 +41,9 @@ static const char* oid_sgx_quote = X509_OID_FOR_QUOTE_STRING; +//The ISVSVN threshold of Intel signed QvE +const sgx_isv_svn_t qve_isvsvn_threshold = 6; + extern "C" quote3_error_t SGXAPI tee_get_certificate_with_evidence( const unsigned char *p_subject_name, const uint8_t *p_prv_key, @@ -87,7 +90,7 @@ extern "C" quote3_error_t SGXAPI tee_get_certificate_with_evidence( func_ret = SGX_QL_ERROR_UNEXPECTED; break; } - + ret = sgx_sha256_update(p_pub_key, (uint32_t)public_key_size, sha_handle); if (ret != SGX_SUCCESS) { func_ret = SGX_QL_ERROR_UNEXPECTED; @@ -182,7 +185,7 @@ extern "C" quote3_error_t tee_verify_certificate_with_evidence( uint8_t *p_quote = NULL; uint32_t quote_size = 0; sgx_ql_qe_report_info_t qve_report_info; - uint32_t collateral_expiration_status = 0; + uint32_t collateral_expiration_status = 0; sgx_cert_t cert = {0}; uint8_t *pub_key_buff = NULL; @@ -191,9 +194,7 @@ extern "C" quote3_error_t tee_verify_certificate_with_evidence( sgx_report_data_t *p_report_data = NULL; sgx_report_data_t cert_pub_hash; sgx_sha_state_handle_t sha_handle = NULL; - - //The ISVSVN threshold of Intel signed QvE - const sgx_isv_svn_t qve_isvsvn_threshold = 4; + memset(&cert_pub_hash, 0, sizeof(sgx_report_data_t)); @@ -203,7 +204,7 @@ extern "C" quote3_error_t tee_verify_certificate_with_evidence( p_supplemental_data_size == NULL) return SGX_QL_ERROR_INVALID_PARAMETER; - + do { //verify X.509 certificate pub_key_buff = (uint8_t*)malloc(KEY_BUFF_SIZE); @@ -343,7 +344,7 @@ extern "C" quote3_error_t tee_verify_certificate_with_evidence( // get report data from quote p_sgx_quote = (sgx_quote3_t *) p_quote; - + if (p_sgx_quote != NULL) { p_report_data = &(p_sgx_quote->report_body.report_data); }