Updates for SGX 2.17 reproducible build.

Signed-off-by: Zhang Lili <lili.z.zhang@intel.com>

SampleCode/Cxx11SGXDemo/App/App.cpp

@@ -132,6 +132,11 @@ static sgx_errlist_t sgx_errlist[] = {
         "The enclave is signed as product enclave, and can not be created as debuggable enclave.",
         NULL
     },
+    {
+        SGX_ERROR_MEMORY_MAP_FAILURE,
+        "Failed to reserve memory for the enclave.",
+        NULL
+    },
 };
 
 /* Check error conditions for loading enclave */

SampleCode/Cxx11SGXDemo/Enclave/Enclave.cpp

@@ -39,7 +39,7 @@
  * printf: 
  *   Invokes OCALL to display the enclave buffer to the terminal.
  */
-void printf(const char *fmt, ...)
+int printf(const char *fmt, ...)
 {
     char buf[BUFSIZ] = {'\0'};
     va_list ap;
@@ -47,4 +47,5 @@ void printf(const char *fmt, ...)
     vsnprintf(buf, BUFSIZ, fmt, ap);
     va_end(ap);
     ocall_print_string(buf);
+    return 0;
 }

SampleCode/Cxx11SGXDemo/Enclave/Enclave.h

@@ -39,7 +39,7 @@
 extern "C" {
 #endif
 
-void printf(const char *fmt, ...);
+int printf(const char *fmt, ...);
 
 #if defined(__cplusplus)
 }

SampleCode/Cxx11SGXDemo/Makefile

@@ -129,7 +129,7 @@ Crypto_Library_Name := sgx_tcrypto
 Enclave_Cpp_Files := Enclave/Enclave.cpp $(wildcard Enclave/TrustedLibrary/*.cpp)
 Enclave_Include_Paths := -IEnclave -I$(SGX_SDK)/include -I$(SGX_SDK)/include/libcxx -I$(SGX_SDK)/include/tlibc 
 
-Enclave_C_Flags := -nostdinc -fvisibility=hidden -fpie -fstack-protector $(Enclave_Include_Paths)
+Enclave_C_Flags := -nostdinc -fvisibility=hidden -fpie -fstack-protector -fno-builtin-printf $(Enclave_Include_Paths)
 Enclave_Cpp_Flags := $(Enclave_C_Flags) -nostdinc++
 
 # Enable the security flags

SampleCode/Cxx14SGXDemo/App/App.cpp

@@ -132,6 +132,11 @@ static sgx_errlist_t sgx_errlist[] = {
         "The enclave is signed as product enclave, and can not be created as debuggable enclave.",
         NULL
     },
+    {
+        SGX_ERROR_MEMORY_MAP_FAILURE,
+        "Failed to reserve memory for the enclave.",
+        NULL
+    },
 };
 
 /* Check error conditions for loading enclave */

SampleCode/Cxx14SGXDemo/Enclave/Enclave.cpp

@@ -39,7 +39,7 @@
  * printf: 
  *   Invokes OCALL to display the enclave buffer to the terminal.
  */
-void printf(const char *fmt, ...)
+int printf(const char *fmt, ...)
 {
     char buf[BUFSIZ] = {'\0'};
     va_list ap;
@@ -47,4 +47,5 @@ void printf(const char *fmt, ...)
     vsnprintf(buf, BUFSIZ, fmt, ap);
     va_end(ap);
     ocall_print_string(buf);
+    return 0;
 }

SampleCode/Cxx14SGXDemo/Enclave/Enclave.h

@@ -39,7 +39,7 @@
 extern "C" {
 #endif
 
-void printf(const char *fmt, ...);
+int printf(const char *fmt, ...);
 
 #if defined(__cplusplus)
 }

SampleCode/Cxx14SGXDemo/Makefile

@@ -129,7 +129,7 @@ Crypto_Library_Name := sgx_tcrypto
 Enclave_Cpp_Files := Enclave/Enclave.cpp $(wildcard Enclave/TrustedLibrary/*.cpp)
 Enclave_Include_Paths := -IEnclave -I$(SGX_SDK)/include -I$(SGX_SDK)/include/libcxx -I$(SGX_SDK)/include/tlibc 
 
-Enclave_C_Flags := -nostdinc -fvisibility=hidden -fpie -fstack-protector $(Enclave_Include_Paths)
+Enclave_C_Flags := -nostdinc -fvisibility=hidden -fpie -fstack-protector -fno-builtin-printf $(Enclave_Include_Paths)
 Enclave_Cpp_Flags := $(Enclave_C_Flags) -nostdinc++
 
 # Enable the security flags

SampleCode/PowerTransition/App/ErrorSupport.cpp

@@ -51,6 +51,7 @@ static sgx_errlist_t sgx_errlist[] = {
     {SGX_ERROR_OUT_OF_EPC,               "Out of EPC memory."},
     {SGX_ERROR_NO_DEVICE,                "Invalid SGX device."},
     {SGX_ERROR_MEMORY_MAP_CONFLICT,      "Memory map conflicted."},
+    {SGX_ERROR_MEMORY_MAP_FAILURE,       "Failed to reserve memory for the enclave."},
     {SGX_ERROR_INVALID_METADATA,         "Invalid encalve metadata."},
     {SGX_ERROR_DEVICE_BUSY,              "SGX device is busy."},
     {SGX_ERROR_INVALID_VERSION,          "Enclave metadata version is invalid."},

SampleCode/PowerTransition/Enclave/Enclave.cpp

@@ -149,7 +149,7 @@ int increase_and_seal_data(size_t tid, struct sealed_buf_t* sealed_buf)
         return -1;
     }
     // Backup the sealed data to outside buffer
-    memcpy(sealed_buf->sealed_buf_ptr[MOD2(sealed_buf->index + 1)], temp_sealed_buf, sealed_len);
+    memcpy_verw(sealed_buf->sealed_buf_ptr[MOD2(sealed_buf->index + 1)], temp_sealed_buf, sealed_len);
     sealed_buf->index++;
 
     sgx_thread_mutex_unlock(&g_mutex);

SampleCode/ProtobufSGXDemo/App/App.cpp

@@ -132,6 +132,11 @@ static sgx_errlist_t sgx_errlist[] = {
         "The enclave is signed as product enclave, and can not be created as debuggable enclave.",
         NULL
     },
+    {
+        SGX_ERROR_MEMORY_MAP_FAILURE,
+        "Failed to reserve memory for the enclave.",
+        NULL
+    },
 };
 
 /* Check error conditions for loading enclave */

SampleCode/ProtobufSGXDemo/Enclave/Enclave.cpp

@@ -39,7 +39,7 @@
  *   Invokes OCALL to display the enclave buffer to the terminal.
  *   'printf' function is required for sgx protobuf logging module.
  */
-void printf(const char *fmt, ...)
+int printf(const char *fmt, ...)
 {
     char buf[BUFSIZ] = {'\0'};
     va_list ap;
@@ -47,6 +47,7 @@ void printf(const char *fmt, ...)
     vsnprintf(buf, BUFSIZ, fmt, ap);
     va_end(ap);
     ocall_print_string(buf);
+    return 0;
 }
 
 void ecall_person()

SampleCode/ProtobufSGXDemo/Enclave/Enclave.h

@@ -39,7 +39,7 @@
 extern "C" {
 #endif
 
-void printf(const char *fmt, ...);
+int printf(const char *fmt, ...);
 
 #if defined(__cplusplus)
 }

SampleCode/SampleAttestedTLS/client/enc/openssl_client.cpp

@@ -118,7 +118,7 @@ int communicate_with_server(SSL* ssl)
                 SERVER_PAYLOAD_SIZE,
                 bytes_read);
             ret = bytes_read;
-            goto done;
+            break;
         }
         else
         {
@@ -128,7 +128,6 @@ int communicate_with_server(SSL* ssl)
             break;
         }
     } while (1);
-    ret = 0;
 done:
     return ret;
 }
@@ -137,12 +136,8 @@ done:
 int create_socket(char* server_name, char* server_port)
 {
     int sockfd = -1;
-    char* addr_ptr = nullptr;
-    int port = 0;
 	struct sockaddr_in dest_sock;
-    //struct addrinfo dest_info;//hints, *dest_info = nullptr, *curr_di = nullptr;
     int res = -1;
-	char *err_str = nullptr;
 
     sockfd = socket(AF_INET, SOCK_STREAM, 0);
     if (sockfd == -1)
@@ -151,14 +146,14 @@ int create_socket(char* server_name, char* server_port)
         goto done;
     }
 
-	dest_sock.sin_family = AF_INET;
-	dest_sock.sin_port = htons(atoi(server_port));
-	dest_sock.sin_addr.s_addr = inet_addr2(server_name);
-	bzero(&(dest_sock.sin_zero), sizeof(dest_sock.sin_zero));
+    dest_sock.sin_family = AF_INET;
+    dest_sock.sin_port = htons(atoi(server_port));
+    dest_sock.sin_addr.s_addr = inet_addr2(server_name);
+    bzero(&(dest_sock.sin_zero), sizeof(dest_sock.sin_zero));
     
-	if (connect(
-            sockfd, (sockaddr*) &dest_sock,
-            sizeof(struct sockaddr)) == -1)
+    if (connect(
+                sockfd, (sockaddr*) &dest_sock,
+                sizeof(struct sockaddr)) == -1)
     {
         t_print(
             TLS_CLIENT "failed to connect to %s:%s (errno=%d)\n",
@@ -166,8 +161,8 @@ int create_socket(char* server_name, char* server_port)
             server_port,
             errno);
         ocall_close(&res, sockfd);
-		if (res != 0) 
-			t_print(TLS_CLIENT "OCALL: error closing socket\n");
+        if (res != 0)
+            t_print(TLS_CLIENT "OCALL: error closing socket\n");
         sockfd = -1;
         goto done;
     }
@@ -266,13 +261,13 @@ int launch_tls_client(char* server_name, char* server_port)
 done:
 
     if (client_socket != -1) 
-	{
+    {
         ocall_close(&ret, client_socket);
-		if (ret != 0)
-			t_print(TLS_CLIENT "OCALL: error close socket\n");
-	}
+        if (ret != 0)
+            t_print(TLS_CLIENT "OCALL: error close socket\n");
+    }
 
-	if (ssl_session)
+    if (ssl_session)
     {
         SSL_shutdown(ssl_session);
         SSL_free(ssl_session);

SampleCode/SampleAttestedTLS/client/host/host.cpp

@@ -152,9 +152,9 @@ sgx_status_t initialize_enclave(const char *enclave_path)
 
     if (ret != SGX_SUCCESS)
     {
-		print_error_message(ret);
-		return ret;
-	}
+        print_error_message(ret);
+        return ret;
+    }
     return ret;
 }
 
@@ -166,14 +166,8 @@ void terminate_enclave()
 
 int main(int argc, const char* argv[])
 {
-    uint8_t* encrypted_msg = NULL;
-    size_t encrypted_msg_size = 0;
     sgx_status_t result = SGX_SUCCESS;
     int ret = 1;
-    uint8_t* pem_key = NULL;
-    size_t pem_key_size = 0;
-    uint8_t* remote_report = NULL;
-    size_t remote_report_size = 0;
     char* server_name = NULL;
     char* server_port = NULL;
 
@@ -229,7 +223,7 @@ int main(int argc, const char* argv[])
 
     printf("Host: launch TLS client to initiate TLS connection\n");
     result = launch_tls_client(client_global_eid, &ret, server_name, server_port);
-    if (ret != 0)
+    if (result != SGX_SUCCESS || ret != 0)
     {
         printf("Host: launch_tls_client failed\n");
         goto exit;
@@ -237,7 +231,7 @@ int main(int argc, const char* argv[])
     ret = 0;
 exit:
 
-	terminate_enclave();
+    terminate_enclave();
 
     printf("Host:  %s \n", (ret == 0) ? "succeeded" : "failed");
     return ret;

SampleCode/SampleAttestedTLS/client/tls_client.edl

@@ -32,17 +32,16 @@
 
 enclave {
     from "sgx_tstdc.edl" import *;
-	from "enclave.edl" import *;
-	from "sgx_socket.edl" import *;
-	from "sgx_tsgxssl.edl" import *;
-	from "sgx_ttls.edl" import *;
-	from "sgx_pthread.edl" import *;
+    from "enclave.edl" import *;
+    from "sgx_socket.edl" import *;
+    from "sgx_tsgxssl.edl" import *;
+    from "sgx_ttls.edl" import *;
+    from "sgx_pthread.edl" import *;
 
-	include "sgx_ttls.h"
-	trusted {
-		public int launch_tls_client(
-                       [in, string] char* server_name,
-                       [in, string] char* server_port);
+    include "sgx_ttls.h"
+    trusted {
+        public int launch_tls_client(
+                [in, string] char* server_name,
+                [in, string] char* server_port);
     };
-
 };

SampleCode/SampleAttestedTLS/common/enclave.edl

@@ -38,7 +38,7 @@ enclave {
      */
     untrusted {
         void ocall_print_string([in, string] const char *str);
-		int ocall_close(int fd);
-		void ocall_get_current_time([out] uint64_t *p_current_time);
-	};
+        int ocall_close(int fd);
+        void ocall_get_current_time([out] uint64_t *p_current_time);
+    };
 };

SampleCode/SampleAttestedTLS/common/openssl_utility.cpp

@@ -29,7 +29,7 @@
 sgx_status_t generate_certificate_and_pkey(X509*& certificate, EVP_PKEY*& pkey)
 {
     quote3_error_t qresult = SGX_QL_SUCCESS;
-	sgx_status_t result = SGX_ERROR_UNEXPECTED;
+    sgx_status_t result = SGX_ERROR_UNEXPECTED;
     uint8_t* output_certificate = NULL;
     size_t output_certificate_size = 0;
     uint8_t* private_key_buffer = nullptr;
@@ -38,15 +38,15 @@ sgx_status_t generate_certificate_and_pkey(X509*& certificate, EVP_PKEY*& pkey)
     size_t public_key_buffer_size = 0;
     const unsigned char* certificate_buffer_ptr = nullptr;
     BIO* mem = nullptr;
-	int key_type = RSA_TYPE;
+    int key_type = RSA_TYPE;
 
-	if (key_type) {
-		t_print(" generating keys by EC P-384\n");
-	}
-	else
-	{
-		t_print(" generating keys by RSA 3072\n");
-	}
+    if (key_type) {
+        t_print(" generating keys by EC P-384\n");
+    }
+    else
+    {
+        t_print(" generating keys by RSA 3072\n");
+    }
     result = generate_key_pair(
         key_type, &public_key_buffer,
         &public_key_buffer_size,
@@ -73,8 +73,8 @@ sgx_status_t generate_certificate_and_pkey(X509*& certificate, EVP_PKEY*& pkey)
 
     if (qresult != SGX_QL_SUCCESS || output_certificate == nullptr)
     {
-		if (output_certificate == nullptr)
-		  t_print(" null certificate\n");
+        if (output_certificate == nullptr)
+            t_print(" null certificate\n");
         p_sgx_tls_qe_err_msg(qresult);
         goto done;
     }
@@ -84,7 +84,7 @@ sgx_status_t generate_certificate_and_pkey(X509*& certificate, EVP_PKEY*& pkey)
     // data. sending certificate_buffer_ptr as argument will keep
     // output_certificate pointer undisturbed.
 
-	certificate_buffer_ptr = output_certificate;
+    certificate_buffer_ptr = output_certificate;
 
     if ((certificate = d2i_X509(
              nullptr,
@@ -108,11 +108,10 @@ sgx_status_t generate_certificate_and_pkey(X509*& certificate, EVP_PKEY*& pkey)
 
     result = SGX_SUCCESS;
 done:
-
     if (private_key_buffer)
-		free(private_key_buffer);
-	if (public_key_buffer)
-		free(public_key_buffer);
+        free(private_key_buffer);
+    if (public_key_buffer)
+        free(public_key_buffer);
     certificate_buffer_ptr = nullptr;
 
     if (mem)
@@ -135,11 +134,11 @@ sgx_status_t load_tls_certificates_and_keys(
         goto exit;
     }
 
-	if (certificate == nullptr)
-	{
-		t_print("null cert\n");
-		goto exit;
-	}
+    if (certificate == nullptr)
+    {
+        t_print("null cert\n");
+        goto exit;
+    }
 
     if (!SSL_CTX_use_certificate(ctx, certificate))
     {
@@ -249,7 +248,7 @@ int read_from_session_peer(
     int bytes_read = 0;
     do
     {
-        int len = sizeof(buffer) - 1;
+        unsigned int len = sizeof(buffer) - 1;
         memset(buffer, 0, sizeof(buffer));
         bytes_read = SSL_read(ssl_session, buffer, (size_t)len);
 

SampleCode/SampleAttestedTLS/common/tcommon.cpp

@@ -53,5 +53,5 @@ void t_print(const char *fmt, ...)
 
 void t_time(time_t *current_t)
 {
-	ocall_get_current_time((uint64_t*)current_t);
+    ocall_get_current_time((uint64_t*)current_t);
 }

SampleCode/SampleAttestedTLS/common/ucommon.cpp

@@ -40,7 +40,7 @@
 
 int ocall_close(int fd)
 {
-	return close(fd);
+    return close(fd);
 }
 
 void ocall_get_current_time(uint64_t *p_current_time)
@@ -56,5 +56,5 @@ void ocall_get_current_time(uint64_t *p_current_time)
 
 void ocall_print_string(const char *str)
 {
-	printf("%s", str);
+    printf("%s", str);
 }

SampleCode/SampleAttestedTLS/common/utility.cpp

@@ -28,8 +28,8 @@
 
 //
 // Generate_Key_Pair function:
-// type1: RSA 
-// type2: EC-P384 
+// type1: RSA
+// type2: EC-P384
 // currently all hardware independant
 //
 #include <openssl/bio.h>
@@ -45,26 +45,29 @@
 
 int get_pkey_by_rsa(EVP_PKEY *pk)
 {
-	int res = -1;
-	RSA* rsa = nullptr;
+    int res = -1;
+    RSA* rsa = nullptr;
     BIGNUM* e = nullptr;
 
 
-	e = BN_new();
-    if (!e)
+    e = BN_new();
+    if (!e) {
         t_print("BN_new failed\n");
+        return res;
+    }
 
     res = BN_set_word(e, (BN_ULONG)RSA_F4);
-	if (!res) {
+    if (!res) {
         t_print("BN_set_word failed (%d)\n", res);
 		return res;
-	}
+    }
 
     rsa = RSA_new();
     if (!rsa) {
         t_print("RSA_new failed\n");
+        res = -1;
 		return res;
-	}
+    }
 
     res = RSA_generate_key_ex(
         rsa,
@@ -73,16 +76,16 @@ int get_pkey_by_rsa(EVP_PKEY *pk)
         nullptr /* callback argument - not needed in this case */
     );
 
-    if (!res) 
-	{
+    if (!res)
+    {
         t_print("RSA_generate_key failed (%d)\n", res);
 		return res;
-	}
-    
-	// Assign RSA key to EVP_PKEY structure
+    }
+
+    // Assign RSA key to EVP_PKEY structure
     EVP_PKEY_assign_RSA(pk, rsa);
 
-	return res;
+    return res;
 }
 
 int get_pkey_by_ec(EVP_PKEY *pk)
@@ -93,15 +96,29 @@ int get_pkey_by_ec(EVP_PKEY *pk)
     ctx = EVP_PKEY_CTX_new_id(EVP_PKEY_EC, NULL);
     if (ctx == NULL)
         return res;
-    if (EVP_PKEY_keygen_init(ctx) <= 0)
+    res = EVP_PKEY_keygen_init(ctx);
+    if (res <= 0)
+    {
+        t_print("EC_generate_key failed (%d)\n", res);
         return res;
-    if (EVP_PKEY_CTX_set_ec_paramgen_curve_nid(ctx, NID_secp384r1) <= 0)
+    }
+
+    res = EVP_PKEY_CTX_set_ec_paramgen_curve_nid(ctx, NID_secp384r1);
+    if (res <= 0)
+    {
+        t_print("EC_generate_key failed (%d)\n", res);
         return res;
+    }
 
     /* Generate key */
-    if (EVP_PKEY_keygen(ctx, &pk) <= 0)
+    res = EVP_PKEY_keygen(ctx, &pk);
+    if (res <= 0)
+    {
+        t_print("EC_generate_key failed (%d)\n", res);
         return res;
-	return 0;
+    }
+
+    return res;
 }
 
 
@@ -121,110 +138,112 @@ sgx_status_t generate_key_pair(
     EVP_PKEY* pkey = nullptr;
     BIO* bio = nullptr;
 
-	pkey = EVP_PKEY_new();
+    pkey = EVP_PKEY_new();
     if (!pkey)
+    {
         t_print("EVP_PKEY_new failed\n");
+        result = SGX_ERROR_UNEXPECTED;
+        goto done;
+    }
 
-    if (type != RSA_TYPE || type != EC_TYPE) 
+    if (type != RSA_TYPE && type != EC_TYPE)
     {
         type = RSA_TYPE; // by default, we use RSA_TYPE
     }
 
-	switch(type) 
-	{
-		case RSA_TYPE:
-			res = get_pkey_by_rsa(pkey);
-			break;
-		case EC_TYPE:
-			res = get_pkey_by_ec(pkey);
-			break;
-	}
+    switch(type)
+    {
+        case RSA_TYPE:
+            res = get_pkey_by_rsa(pkey);
+            break;
+        case EC_TYPE:
+            res = get_pkey_by_ec(pkey);
+            break;
+    }
 
-    if (!res) 
-	{
+    if (res <= 0)
+    {
         t_print("get_pkey failed (%d)\n", res);
 		result = SGX_ERROR_UNEXPECTED;
 		goto done;
-	}
-    
+    }
+
     // Allocate memory
     local_public_key = (uint8_t*)malloc(RSA_3072_PUBLIC_KEY_SIZE);
-	memset(local_public_key, 0x00, RSA_3072_PUBLIC_KEY_SIZE);
-	if (!local_public_key)
-	{
-		t_print("out-of-memory:calloc(local_public_key failed\n");
-		result = SGX_ERROR_UNEXPECTED;
-		goto done;
-	}
+    if (!local_public_key)
+    {
+        t_print("out-of-memory:calloc(local_public_key failed\n");
+        result = SGX_ERROR_OUT_OF_EPC;
+        goto done;
+    }
+    memset(local_public_key, 0x00, RSA_3072_PUBLIC_KEY_SIZE);
 
-	local_private_key = (uint8_t*)malloc(RSA_3072_PRIVATE_KEY_SIZE);
-    memset(local_private_key, 0x00, RSA_3072_PRIVATE_KEY_SIZE);
+    local_private_key = (uint8_t*)malloc(RSA_3072_PRIVATE_KEY_SIZE);
     if (!local_private_key)
-	{
-	    t_print("out-of-memory: calloc(local_private_key) failed\n");
-		result = SGX_ERROR_UNEXPECTED;
-		goto done;
-	}
+    {
+        t_print("out-of-memory: calloc(local_private_key) failed\n");
+        result = SGX_ERROR_OUT_OF_EPC;
+        goto done;
+    }
+    memset(local_private_key, 0x00, RSA_3072_PRIVATE_KEY_SIZE);
+
     // Write out the public/private key in PEM format for exchange with
     // other enclaves.
-	bio = BIO_new(BIO_s_mem());
-    if (!bio) 
-	{
+    bio = BIO_new(BIO_s_mem());
+    if (!bio)
+    {
         t_print("BIO_new for local_public_key failed\n");
 		goto done;
-	}
+    }
 
     res = PEM_write_bio_PUBKEY(bio, pkey);
     if (!res)
-	{
-		t_print("PEM_write_bio_PUBKEY failed (%d)\n", res);
-		goto done;
-	}
+    {
+        t_print("PEM_write_bio_PUBKEY failed (%d)\n", res);
+        goto done;
+    }
 
     res = BIO_read(bio, local_public_key, RSA_3072_PUBLIC_KEY_SIZE);
     if (!res)
-	{
-		t_print("BIO_read public key failed (%d)\n", res);
-		goto done;
-	}
+    {
+        t_print("BIO_read public key failed (%d)\n", res);
+        goto done;
+    }
     BIO_free(bio);
     bio = nullptr;
 
     bio = BIO_new(BIO_s_mem());
     if (!bio)
-	{
-		t_print("BIO_new for local_public_key failed\n");
-		goto done;
-	}
+    {
+        t_print("BIO_new for local_public_key failed\n");
+        goto done;
+    }
 
     res = PEM_write_bio_PrivateKey(
         bio, pkey, nullptr, nullptr, 0, nullptr, nullptr);
     if (!res)
-	{
-		t_print("PEM_write_bio_PrivateKey failed (%d)\n", res);
-		goto done;
-	}
+    {
+        t_print("PEM_write_bio_PrivateKey failed (%d)\n", res);
+        goto done;
+    }
 
     res = BIO_read(bio, local_private_key, RSA_3072_PRIVATE_KEY_SIZE);
     if (!res)
-	{
-		t_print("BIO_read private key failed (%d)\n", res);
-		goto done;
-	}
+    {
+        t_print("BIO_read private key failed (%d)\n", res);
+        goto done;
+    }
 
-	BIO_free(bio);
+    BIO_free(bio);
     bio = nullptr;
 
     *public_key = local_public_key;
-	//*public_key_size = RSA_3072_PUBLIC_KEY_SIZE;
     *private_key = local_private_key;
-    //	*private_key_size = RSA_3072_PRIVATE_KEY_SIZE;
 
-
-	*public_key_size = strlen(reinterpret_cast<const char *>(local_public_key)) + 1;
+    *public_key_size = strlen(reinterpret_cast<const char *>(local_public_key)) + 1;
     *private_key_size = strlen(reinterpret_cast<const char *>(local_private_key)) + 1;
 
-	t_print("public_key_size %d, private_key_size %d\n", *public_key_size, *private_key_size);
+    t_print("public_key_size %d, private_key_size %d\n", *public_key_size, *private_key_size);
     result = SGX_SUCCESS;
 
 done:
@@ -232,10 +251,12 @@ done:
         BIO_free(bio);
     if (pkey)
         EVP_PKEY_free(pkey); // When this is called, rsa is also freed
-	if (result != SGX_SUCCESS) 
+    if (result != SGX_SUCCESS)
 	{
-		free(local_public_key);
-		free(local_private_key);
-	}
+        if (local_public_key)
+            free(local_public_key);
+        if (local_private_key)
+            free(local_private_key);
+    }
     return result;
 }

SampleCode/SampleAttestedTLS/common/verify_callback.cpp

@@ -80,12 +80,12 @@ int verify_callback(int preverify_ok, X509_STORE_CTX* ctx)
 
     // convert a cert into a buffer in DER format
     der_len = i2d_X509(crt, nullptr);
-	if (der_len <= 0) {
-		PRINT(TLS_CLIENT "i2d_X509 failed(der_len=%d)\n", der_len);
+    if (der_len <= 0) {
+        PRINT(TLS_CLIENT "i2d_X509 failed(der_len=%d)\n", der_len);
         goto done;
-	}
+    }
 
-	buff = (unsigned char*)malloc(der_len);
+    buff = (unsigned char*)malloc(der_len);
     if (buff == nullptr)
     {
         PRINT(TLS_CLIENT "malloc failed (der_len=%d)\n", der_len);
@@ -115,11 +115,11 @@ int verify_callback(int preverify_ok, X509_STORE_CTX* ctx)
 	GETCURRTIME(&current_time);
 
 	// verify tls certificate
-	result = VERIFY_CALLBACK(
-				der, der_len, current_time, &qv_result, &sup_data, (uint32_t *)&sup_data_len);
+    result = VERIFY_CALLBACK(
+            der, der_len, current_time, &qv_result, &sup_data, (uint32_t *)&sup_data_len);
 
    // result != SGX_QL_SUCCESS means critical error
-	if (result != SGX_QL_SUCCESS)
+    if (result != SGX_QL_SUCCESS)
     {
         PRINT(TLS_CLIENT "Quote Verification Failed with result(%x) - \n", result);
         p_sgx_tls_qe_err_msg(result);
@@ -136,10 +136,10 @@ int verify_callback(int preverify_ok, X509_STORE_CTX* ctx)
         }
     }
 
-	FREE_SUPDATA(sup_data);
+    FREE_SUPDATA(sup_data);
 
     PRINT(" verifying certificate end\n");
-	ret = 1;
+    ret = 1;
 done:
 
     if (der)

SampleCode/SampleAttestedTLS/non_enc_client/client.cpp

@@ -54,7 +54,7 @@ int parse_arguments(
 {
     int ret = 1;
     const char* option = nullptr;
-    int param_len = 0;
+    unsigned int param_len = 0;
 
     if (argc != 3)
         goto print_usage;
@@ -87,7 +87,7 @@ int communicate_with_server(SSL* ssl)
     unsigned char buf[200];
     int ret = 1;
     int error = 0;
-    int len = 0;
+    unsigned int len = 0;
     int bytes_written = 0;
     int bytes_read = 0;
 
@@ -121,7 +121,7 @@ int communicate_with_server(SSL* ssl)
 
             printf(TLS_CLIENT "Failed! SSL_read returned error=%d\n", error);
             ret = bytes_read;
-            break;
+            goto done;
         }
 
         printf(TLS_CLIENT " %d bytes read\n", bytes_read);
@@ -143,10 +143,9 @@ int communicate_with_server(SSL* ssl)
             printf(TLS_CLIENT
                    " received all the expected data from server\n\n");
             ret = 0;
+            printf("Verified: the contents of server payload were expected\n\n");
             break;
         }
-        printf("Verified: the contents of server payload were expected\n\n");
-    
     } while (1);
     ret = 0;
 done:
@@ -157,8 +156,6 @@ done:
 int create_socket(char* server_name, char* server_port)
 {
     int sockfd = -1;
-    char* addr_ptr = nullptr;
-    int port = 0;
     struct addrinfo hints, *dest_info, *curr_di;
     int res;
 
@@ -227,7 +224,6 @@ done:
 int main(int argc, char** argv)
 {
     int ret = 1;
-    X509* cert = nullptr;
     SSL_CTX* ctx = nullptr;
     SSL* ssl = nullptr;
     int serversocket = 0;
@@ -268,7 +264,7 @@ int main(int argc, char** argv)
     SSL_CTX_set_options(ctx, SSL_OP_NO_TLSv1);
     SSL_CTX_set_options(ctx, SSL_OP_NO_TLSv1_1);
     // specify the verify_callback for custom verification
-	SSL_CTX_set_verify(ctx, SSL_VERIFY_PEER, &verify_callback);
+    SSL_CTX_set_verify(ctx, SSL_VERIFY_PEER, &verify_callback);
     
     if ((ssl = SSL_new(ctx)) == nullptr)
     {
@@ -290,7 +286,7 @@ int main(int argc, char** argv)
         goto done;
     }
 
-	printf(
+    printf(
             TLS_CLIENT
             "create a socket and initate a TCP connect to server: %s:%s "
             "\n",
@@ -319,17 +315,14 @@ int main(int argc, char** argv)
     }
 
     // Free the structures we don't need anymore
+    ret = 0;
+done:
     if (serversocket != -1)
         close(serversocket);
 
-    ret = 0;
-done:
     if (ssl)
         SSL_free(ssl);
 
-    if (cert)
-        X509_free(cert);
-
     if (ctx)
         SSL_CTX_free(ctx);
 

SampleCode/SampleAttestedTLS/server/enc/openssl_server.cpp

@@ -95,19 +95,19 @@ int handle_communication_until_done(
 	int  test_error = 1;
 waiting_for_connection_request:
 	
-	struct sockaddr_in addr;
+    struct sockaddr_in addr;
     uint len = sizeof(addr);
 
     // reset ssl_session and client_socket_fd to prepare for the new TLS
     // connection
     if (client_socket_fd > 0) 
-	{
-		ocall_close(&ret, client_socket_fd);
-		if (ret != 0) {
-			t_print(TLS_SERVER "OCALL: error closing client socket before starting a new TLS session.\n");
-			goto exit;
-		}
-	}
+    {
+        ocall_close(&ret, client_socket_fd);
+        if (ret != 0) {
+            t_print(TLS_SERVER "OCALL: error closing client socket before starting a new TLS session.\n");
+            goto exit;
+        }
+    }
     SSL_free(ssl_session);
     t_print(TLS_SERVER " waiting for client connection\n");
 
@@ -131,9 +131,9 @@ waiting_for_connection_request:
 
     // wait for a TLS/SSL client to initiate a TLS/SSL handshake
 
-	t_print(TLS_SERVER "initiating a passive connect SSL_accept\n");
-	test_error = SSL_accept(ssl_session);
-	if (test_error <= 0)
+    t_print(TLS_SERVER "initiating a passive connect SSL_accept\n");
+    test_error = SSL_accept(ssl_session);
+    if (test_error <= 0)
     {
         t_print(TLS_SERVER " SSL handshake failed, error(%d)(%d)\n",
 					test_error, SSL_get_error(ssl_session, test_error));
@@ -169,7 +169,7 @@ int set_up_tls_server(char* server_port, bool keep_server_up)
     int ret = 0;
     int server_socket_fd;
     int client_socket_fd = -1;
-    int server_port_number;
+    unsigned int server_port_number;
 
     X509* certificate = nullptr;
     EVP_PKEY* pkey = nullptr;
@@ -183,12 +183,12 @@ int set_up_tls_server(char* server_port, bool keep_server_up)
         goto exit;
     }
 
-	if (initalize_ssl_context(ssl_confctx, ssl_server_ctx) != SGX_SUCCESS)
+    if (initalize_ssl_context(ssl_confctx, ssl_server_ctx) != SGX_SUCCESS)
     {
         t_print(TLS_SERVER "unable to create a initialize SSL context\n ");
         goto exit;
     }
-	SSL_CTX_set_verify(ssl_server_ctx, SSL_VERIFY_PEER, &verify_callback);
+    SSL_CTX_set_verify(ssl_server_ctx, SSL_VERIFY_PEER, &verify_callback);
     
     if (load_tls_certificates_and_keys(ssl_server_ctx, certificate, pkey) != 0)
     {
@@ -197,7 +197,7 @@ int set_up_tls_server(char* server_port, bool keep_server_up)
         goto exit;
     }
 	
-    server_port_number = (uint16_t)atoi(server_port); // convert to char* to int
+    server_port_number = (unsigned int)atoi(server_port); // convert to char* to int
     if (create_listener_socket(server_port_number, server_socket_fd) != 0)
     {
         t_print(TLS_SERVER " unable to create listener socket on the server\n ");
@@ -219,11 +219,11 @@ int set_up_tls_server(char* server_port, bool keep_server_up)
 
 exit:
     ocall_close(&ret, client_socket_fd); // close the socket connections
-	if (ret != 0)
-		t_print(TLS_SERVER "OCALL: error closing client socket\n");
+    if (ret != 0)
+        t_print(TLS_SERVER "OCALL: error closing client socket\n");
     ocall_close(&ret, server_socket_fd);
-	if (ret != 0)
-		t_print(TLS_SERVER "OCALL: error closing server socket\n");
+    if (ret != 0)
+        t_print(TLS_SERVER "OCALL: error closing server socket\n");
 
     if (ssl_session)
     {

SampleCode/SampleAttestedTLS/server/host/host.cpp

@@ -150,8 +150,8 @@ sgx_status_t initialize_enclave(const char *enclave_path)
     if (ret != SGX_SUCCESS)
     {
         print_error_message(ret);
-		return ret;
-	}
+        return ret;
+    }
     return ret;
 }
 
@@ -218,7 +218,7 @@ read_port:
 
     printf("Host: calling setup_tls_server\n");
     result = set_up_tls_server(server_global_eid, &ret, server_port, keep_server_up);
-    if (ret != 0)
+    if (result != SGX_SUCCESS || ret != 0)
     {
         printf("Host: setup_tls_server failed\n");
         goto exit;

SampleCode/SampleAttestedTLS/server/tls_server.edl

@@ -30,15 +30,15 @@
  */
 
 enclave {
-	from "sgx_tstdc.edl" import *;
-	from "sgx_socket.edl" import *;
-	from "enclave.edl" import *;
-	from "sgx_tsgxssl.edl" import *;
-	from "sgx_ttls.edl" import *;
-	from "sgx_pthread.edl" import *;
+    from "sgx_tstdc.edl" import *;
+    from "sgx_socket.edl" import *;
+    from "enclave.edl" import *;
+    from "sgx_tsgxssl.edl" import *;
+    from "sgx_ttls.edl" import *;
+    from "sgx_pthread.edl" import *;
 
-	include "sgx_ttls.h"
-	trusted {
+    include "sgx_ttls.h"
+    trusted {
         public int set_up_tls_server([in, string] char* port, int keep_server_up);
     };
 };

SampleCode/SampleAttestedTLS/sgx_socket/include/sgx_socket.edl

@@ -44,8 +44,8 @@ enclave {
         int u_connect (int fd, [in, size=len] const struct sockaddr *addr, socklen_t len) propagate_errno;
         ssize_t u_send (int fd, [in, size=n] const void *buf, size_t n, int flags) propagate_errno;
 
-		ssize_t u_recv (int fd, [out, size=n] void *buf, size_t n, int flags) propagate_errno;
-		int u_setsockopt (int fd, int level, int optname, [in, size=optlen] const void *optval, socklen_t optlen) propagate_errno;
-		int u_close(int fd);
+        ssize_t u_recv (int fd, [out, size=n] void *buf, size_t n, int flags) propagate_errno;
+        int u_setsockopt (int fd, int level, int optname, [in, size=optlen] const void *optval, socklen_t optlen) propagate_errno;
+        int u_close(int fd);
     };
 };

SampleCode/SampleAttestedTLS/sgx_socket/trusted_sgx_socket.cpp

@@ -46,84 +46,84 @@
 
 int socket(int domain, int type, int protocol)
 {
-	int ret = -1;
-	
-	if (u_socket(&ret, domain, type, protocol) == SGX_SUCCESS) 
-	  return ret;
+    int ret = -1;
 
-	return -1;
+    if (u_socket(&ret, domain, type, protocol) == SGX_SUCCESS) 
+        return ret;
+
+    return -1;
 }
 
 int connect (int sockfd, const struct sockaddr *servaddr, socklen_t addrlen)
 {
-	int ret = -1;
+    int ret = -1;
 	
-	if (u_connect(&ret, sockfd, servaddr, addrlen) == SGX_SUCCESS)
-	  return ret;
+    if (u_connect(&ret, sockfd, servaddr, addrlen) == SGX_SUCCESS)
+        return ret;
 
-	return -1;
+    return -1;
 }
 
 int bind(int sockfd, const struct sockaddr* servaddr, socklen_t addrlen)
 {
-	int ret = -1;
-	
-	if (u_bind(&ret, sockfd, servaddr, addrlen) == SGX_SUCCESS)
-	  return ret;
+    int ret = -1;
 
-	return -1;
+    if (u_bind(&ret, sockfd, servaddr, addrlen) == SGX_SUCCESS)
+        return ret;
+
+    return -1;
 }
 
 int listen(int sockfd, int backlog)
 {
-	int ret = -1;
+    int ret = -1;
 
-	if (u_listen(&ret, sockfd, backlog) == SGX_SUCCESS)
-	  return ret;
+    if (u_listen(&ret, sockfd, backlog) == SGX_SUCCESS)
+        return ret;
 
-	return -1;
+    return -1;
 }
 
 
 int accept(int sockfd, struct sockaddr* addr, socklen_t *addrlen)
 {
-	int ret = -1;
-	socklen_t addrlen_in = 0;
+    int ret = -1;
+    socklen_t addrlen_in = 0;
 
-	if ((addr && !addrlen) || (addrlen && !addr)) 
-	{
-		return -1;
-	}
+    if ((addr && !addrlen) || (addrlen && !addr)) 
+    {
+        return -1;
+    }
 
-	if (addr && addrlen)
-	{
-		addrlen_in = *addrlen;
-	}
+    if (addr && addrlen)
+    {
+        addrlen_in = *addrlen;
+    }
 
-	if (u_accept(&ret, sockfd, addr, addrlen_in, addrlen) == SGX_SUCCESS)
-	  return ret;
+    if (u_accept(&ret, sockfd, addr, addrlen_in, addrlen) == SGX_SUCCESS)
+        return ret;
 
-	return -1;
+    return -1;
 }
 
 ssize_t send(int sockfd, const void *buf, size_t nbytes, int flags)
 {
-	ssize_t ret = 0; 
+    ssize_t ret = 0; 
 
-	if (u_send(&ret, sockfd, buf, nbytes, flags) == SGX_SUCCESS)
-	  return ret;
+    if (u_send(&ret, sockfd, buf, nbytes, flags) == SGX_SUCCESS)
+        return ret;
 
-	return -1;
+    return -1;
 }
 
 ssize_t recv(int fd, void *buf, size_t len, int flags)
 {
-	ssize_t ret = 0;
+    ssize_t ret = 0;
 
-	if (u_recv(&ret, fd, buf, len, flags) == SGX_SUCCESS)
-	  return ret;
+    if (u_recv(&ret, fd, buf, len, flags) == SGX_SUCCESS)
+        return ret;
 	
-	return -1;
+    return -1;
 }
 
 int setsockopt(
@@ -154,9 +154,9 @@ int setsockopt(
 
 int close(int sockfd)
 {
-	int ret = -1;
-	if (u_close(&ret, sockfd) == SGX_SUCCESS)
-	  return ret;
+    int ret = -1;
+    if (u_close(&ret, sockfd) == SGX_SUCCESS)
+        return ret;
 
-	return -1;
+    return -1;
 }

SampleCode/SampleAttestedTLS/sgx_socket/untrusted_sgx_socket.cpp

@@ -42,22 +42,22 @@
 
 int u_socket(int domain, int type, int protocol)
 {
-	return socket(domain, type, protocol);
+    return socket(domain, type, protocol);
 }
 
 int u_connect(int sockfd, const struct sockaddr *servaddr, socklen_t addrlen)
 {
-	return connect(sockfd, servaddr, addrlen);
+    return connect(sockfd, servaddr, addrlen);
 }
 
 int u_bind(int fd, const struct sockaddr *addr, socklen_t len)
 {
-	return bind(fd, addr, len);
+    return bind(fd, addr, len);
 }
 
 int u_listen(int fd, int n)
 {
-	return listen(fd, n);
+    return listen(fd, n);
 }
 
 int u_accept(
@@ -67,24 +67,24 @@ int u_accept(
 			socklen_t *addrlen_out
 			)
 {
-	int ret = -1;
-	
-	if ((ret = accept(fd, addr, &addrlen_in)) != -1) 
-	{
-		if (addrlen_out) 
-		  *addrlen_out = addrlen_in;
-	}
-	return ret;
+    int ret = -1;
+
+    if ((ret = accept(fd, addr, &addrlen_in)) != -1) 
+    {
+        if (addrlen_out) 
+            *addrlen_out = addrlen_in;
+    }
+    return ret;
 }
 
 ssize_t u_send(int sockfd, const void *buf, size_t nbytes, int flags)
 {
-	return send(sockfd, buf, nbytes, flags);
+    return send(sockfd, buf, nbytes, flags);
 }
 
 ssize_t u_recv(int sockfd, void *buf, size_t nbytes, int flags)
 {
-	return recv(sockfd, buf, nbytes, flags);
+    return recv(sockfd, buf, nbytes, flags);
 }
 
 int u_setsockopt(
@@ -95,15 +95,10 @@ int u_setsockopt(
 			socklen_t optlen
 			)
 {
-	return setsockopt(sockfd, level, optname, optval, optlen);
+    return setsockopt(sockfd, level, optname, optval, optlen);
 }
 
 int u_close(int fd)
 {
-	return close(fd);
+    return close(fd);
 }
-
-
-
-
-

SampleCode/SampleDNNL/App/App.cpp

@@ -134,6 +134,11 @@ static sgx_errlist_t sgx_errlist[] = {
         "Can't open enclave file.",
         NULL
     },
+    {
+        SGX_ERROR_MEMORY_MAP_FAILURE,
+        "Failed to reserve memory for the enclave.",
+        NULL
+    },
 };
 
 /* Check error conditions for loading enclave */

SampleCode/SampleDNNL/Enclave/Enclave.cpp

@@ -39,7 +39,7 @@
 
 using namespace std;
 
-extern "C" void printf(const char *fmt, ...)
+extern "C" int printf(const char *fmt, ...)
 {
     char buf[300] = {'\0'};
     va_list ap;
@@ -47,6 +47,8 @@ extern "C" void printf(const char *fmt, ...)
     vsnprintf(buf, BUFSIZ, fmt, ap);
     va_end(ap);
     ocall_print_string(buf);
+
+    return 0;
 }
 
 

SampleCode/SampleDNNL/Enclave/cpu_rnn_inference_f32_cpp.cpp

@@ -58,7 +58,7 @@
 
 #include "dnnl.hpp"
 
-extern "C" void printf(const char *fmt, ...);
+extern "C" int printf(const char *fmt, ...);
 
 // MSVC doesn't support collapse clause in omp parallel
 

SampleCode/SampleDNNL/Enclave/cpu_rnn_inference_int8_cpp.cpp

@@ -58,7 +58,7 @@
 
 #include "dnnl.hpp"
 
-extern "C" void printf(const char *fmt, ...);
+extern "C" int printf(const char *fmt, ...);
 
 // MSVC doesn't support collapse clause in omp parallel
 

SampleCode/SampleDNNL/Enclave/example_utils.hpp

@@ -39,7 +39,7 @@
 
 #include "dnnl.hpp"
 
-extern "C" void printf(const char *fmt, ...);
+extern "C" int printf(const char *fmt, ...);
 
 static dnnl::engine::kind parse_engine_kind(
         int argc, char **argv, int extra_args = 0) {

SampleCode/SampleDNNL/Makefile

@@ -131,7 +131,7 @@ ifeq ($(CC_BELOW_4_9), 1)
 else
 	Enclave_Compile_CFlags := -fstack-protector-strong
 endif
-Enclave_Compile_CFlags += -nostdinc -ffreestanding -fvisibility=hidden -fpie -ffunction-sections -fdata-sections $(Enclave_Include_Paths) -fomit-frame-pointer
+Enclave_Compile_CFlags += -nostdinc -ffreestanding -fvisibility=hidden -fpie -ffunction-sections -fdata-sections $(Enclave_Include_Paths) -fomit-frame-pointer -fno-builtin-printf
 Enclave_Compile_CXXFlags := -nostdinc++ $(Enclave_Compile_CFlags) -fomit-frame-pointer
 
 # Enable the security flags

SampleCode/SampleEnclave/App/App.cpp

@@ -128,6 +128,11 @@ static sgx_errlist_t sgx_errlist[] = {
         "Can't open enclave file.",
         NULL
     },
+    {
+        SGX_ERROR_MEMORY_MAP_FAILURE,
+        "Failed to reserve memory for the enclave.",
+        NULL
+    },
 };
 
 /* Check error conditions for loading enclave */

SampleCode/SampleEnclave/Enclave/Edger8rSyntax/Arrays.cpp

@@ -34,6 +34,7 @@
 #include "sgx_trts.h"
 #include "../Enclave.h"
 #include "Enclave_t.h"
+#include <string.h>
 
 /* ecall_array_user_check:
  *   [user_check] parameter does not perfrom copy operations.
@@ -45,7 +46,12 @@ void ecall_array_user_check(int arr[4])
     
     for (int i = 0; i < 4; i++) {
         assert(arr[i] == i);
-        arr[i] = 3 - i;
+	/* Below code performs as arr[i] = (3 - i)
+	 * It writes 4 bytes to untrusted memory, not 8 bytes aligned.
+	 * So we need to use memcpy_verw() for security consideration.
+	 * */
+        int tmp = 3 - i;
+        memcpy_verw(&arr[i], &tmp, sizeof(int));
     }
 }
 
@@ -97,6 +103,11 @@ void ecall_array_isary(array_t arr)
     int n = sizeof(array_t)/sizeof(arr[0]);
     for (int i = 0; i < n; i++) {
         assert(arr[i] == i);
-        arr[i] = (n - 1 - i);
+	/* Below code performs as arr[i] = (n - 1 - i);
+	 * It writes 4 bytes to untrusted memory, not 8 bytes aligned.
+	 * So we need to use memcpy_verw() for security consideration.
+	 * */
+	int tmp = n -1 - i;
+	memcpy_verw(&arr[i], &tmp, sizeof(int));
     }
 }

SampleCode/SampleEnclave/Enclave/Edger8rSyntax/Pointers.cpp

@@ -85,7 +85,7 @@ size_t ecall_pointer_user_check(void* val, size_t sz)
         val, len, (unsigned int)sum);
 
     /* modify outside memory directly */
-    memcpy(val, "SGX_SUCCESS", len > 12 ? 12 : len);
+    memcpy_verw(val, "SGX_SUCCESS", len > 12 ? 12 : len);
 
     return len;
 }

SampleCode/SampleEnclaveGMIPP/App/App.cpp

@@ -129,6 +129,11 @@ static sgx_errlist_t sgx_errlist[] = {
 		"Can't open enclave file.",
 		NULL
 	},
+	{
+		SGX_ERROR_MEMORY_MAP_FAILURE,
+		"Failed to reserve memory for the enclave.",
+		NULL
+	},
 };
 
 /* Check error conditions for loading enclave */

SampleCode/SampleEnclavePCL/App/App.cpp

@@ -158,6 +158,11 @@ static sgx_errlist_t sgx_errlist[] = {
         "PCL sealed key GUID mismatch.",
         NULL
     },
+    {
+        SGX_ERROR_MEMORY_MAP_FAILURE,
+        "Failed to reserve memory for the enclave.",
+        NULL
+    },
 };
 
 /* Check error conditions for loading enclave */

SampleCode/SampleEnclavePCL/Enclave/Edger8rSyntax/Arrays.cpp

@@ -34,6 +34,7 @@
 #include "sgx_trts.h"
 #include "../Enclave.h"
 #include "Enclave_t.h"
+#include <string.h>
 
 /* ecall_array_user_check:
  *   [user_check] parameter does not perfrom copy operations.
@@ -45,7 +46,12 @@ void ecall_array_user_check(int arr[4])
     
     for (int i = 0; i < 4; i++) {
         assert(arr[i] == i);
-        arr[i] = 3 - i;
+	/* Below code performs as arr[i] = (3 - i)
+	 * It writes 4 bytes to untrusted memory, not 8 bytes aligned.
+	 * So we need to use memcpy_verw() for security consideration.
+	 * */
+        int tmp = 3 - i;
+        memcpy_verw(&arr[i], &tmp, sizeof(int));
     }
 }
 
@@ -97,6 +103,11 @@ void ecall_array_isary(array_t arr)
     int n = sizeof(array_t)/sizeof(arr[0]);
     for (int i = 0; i < n; i++) {
         assert(arr[i] == i);
-        arr[i] = (n - 1 - i);
+	/* Below code performs as arr[i] = (n - 1 - i);
+	 * It writes 4 bytes to untrusted memory, not 8 bytes aligned.
+	 * So we need to use memcpy_verw() for security consideration.
+	 * */
+	int tmp = n -1 - i;
+	memcpy_verw(&arr[i], &tmp, sizeof(int));
     }
 }

SampleCode/SampleEnclavePCL/Enclave/Edger8rSyntax/Pointers.cpp

@@ -29,68 +29,72 @@
  *
  */
 
-
 /* Test Pointer Auttributes */
 
-#include <sys/types.h>
 #include <string.h>
+#include <sys/types.h>
 
-#include "sgx_trts.h"
 #include "../Enclave.h"
 #include "Enclave_t.h"
+#include "sgx_lfence.h"
+#include "sgx_trts.h"
 
 /* checksum_internal:
  *   get simple checksum of input buffer and length
  */
-int32_t checksum_internal(char *buf, size_t count)
+int32_t checksum_internal(char* buf, size_t count)
 {
     register int32_t sum = 0;
-    int16_t *ptr = (int16_t *)buf;
+    int16_t* ptr = (int16_t*)buf;
 
     /* Main summing loop */
-    while(count > 1) {
+    while (count > 1) {
         sum = sum + *ptr++;
         count = count - 2;
     }
 
     /* Add left-over byte, if any */
-    if (count > 0)
-        sum = sum + *((char *)ptr);
+    if (count > 0) {
+        sum = sum + *((char*)ptr);
+    }
 
-	return ~sum;
+    return ~sum;
 }
 
 /* ecall_pointer_user_check, ecall_pointer_in, ecall_pointer_out, ecall_pointer_in_out:
  *   The root ECALLs to test [in], [out], [user_check] attributes.
  */
-size_t ecall_pointer_user_check(void *val, size_t sz)
+size_t ecall_pointer_user_check(void* val, size_t sz)
 {
     /* check if the buffer is allocated outside */
     if (sgx_is_outside_enclave(val, sz) != 1)
         abort();
 
-    char tmp[100] = {0};
-    size_t len = sz>100?100:sz;
-    
+    /*fence after sgx_is_outside_enclave check*/
+    sgx_lfence();
+
+    char tmp[100] = { 0 };
+    size_t len = sz > 100 ? 100 : sz;
+
     /* copy the memory into the enclave to make sure 'val' 
      * is not being changed in checksum_internal() */
     memcpy(tmp, val, len);
-    
-    int32_t sum = checksum_internal((char *)tmp, len);
-    printf("Checksum(0x%p, %zu) = 0x%x\n", 
-            val, len, (unsigned int)sum);
-    
-    /* modify outside memory directly */
-    memcpy(val, "SGX_SUCCESS", len>12?12:len);
 
-	return len;
+    int32_t sum = checksum_internal((char*)tmp, len);
+    printf("Checksum(0x%p, %zu) = 0x%x\n",
+        val, len, (unsigned int)sum);
+
+    /* modify outside memory directly */
+    memcpy_verw(val, "SGX_SUCCESS", len > 12 ? 12 : len);
+
+    return len;
 }
 
 /* ecall_pointer_in:
  *   the buffer of val is copied to the enclave.
  */
 
-void ecall_pointer_in(int *val)
+void ecall_pointer_in(int* val)
 {
     if (sgx_is_within_enclave(val, sizeof(int)) != 1)
         abort();
@@ -100,7 +104,7 @@ void ecall_pointer_in(int *val)
 /* ecall_pointer_out:
  *   the buffer of val is copied to the untrusted side.
  */
-void ecall_pointer_out(int *val)
+void ecall_pointer_out(int* val)
 {
     if (sgx_is_within_enclave(val, sizeof(int)) != 1)
         abort();
@@ -111,7 +115,7 @@ void ecall_pointer_out(int *val)
 /* ecall_pointer_in_out:
  * the buffer of val is double-copied.
  */
-void ecall_pointer_in_out(int *val)
+void ecall_pointer_in_out(int* val)
 {
     if (sgx_is_within_enclave(val, sizeof(int)) != 1)
         abort();
@@ -154,7 +158,7 @@ void ocall_pointer_attr(void)
 /* ecall_pointer_string:
  *   [string] defines a string.
  */
-void ecall_pointer_string(char *str)
+void ecall_pointer_string(char* str)
 {
     strncpy(str, "0987654321", strlen(str));
 }
@@ -162,17 +166,17 @@ void ecall_pointer_string(char *str)
 /* ecall_pointer_string_const:
  *   const [string] defines a string that cannot be modified.
  */
-void ecall_pointer_string_const(const char *str)
+void ecall_pointer_string_const(const char* str)
 {
     char* temp = new char[strlen(str)];
     strncpy(temp, str, strlen(str));
-    delete []temp;
+    delete[] temp;
 }
 
 /* ecall_pointer_size:
  *   'len' needs to be specified to tell Edger8r the length of 'str'.
  */
-void ecall_pointer_size(void *ptr, size_t len)
+void ecall_pointer_size(void* ptr, size_t len)
 {
     strncpy((char*)ptr, "0987654321", len);
 }
@@ -180,9 +184,9 @@ void ecall_pointer_size(void *ptr, size_t len)
 /* ecall_pointer_count:
  *   'cnt' needs to be specified to tell Edger8r the number of elements in 'arr'.
  */
-void ecall_pointer_count(int *arr, size_t count)
+void ecall_pointer_count(int* arr, size_t count)
 {
-    int cnt = (int) count;
+    int cnt = (int)count;
     for (int i = (cnt - 1); i >= 0; i--)
         arr[i] = (cnt - 1 - i);
 }
@@ -195,4 +199,3 @@ void ecall_pointer_isptr_readonly(buffer_t buf, size_t len)
 {
     strncpy((char*)buf, "0987654321", len);
 }
-

SampleCode/SampleEnclavePCL/Enclave/Enclave.cpp

@@ -40,7 +40,7 @@
  * printf: 
  *   Invokes OCALL to display the enclave buffer to the terminal.
  */
-void printf(const char *fmt, ...)
+int printf(const char *fmt, ...)
 {
     char buf[BUFSIZ] = {'\0'};
     va_list ap;
@@ -48,4 +48,5 @@ void printf(const char *fmt, ...)
     vsnprintf(buf, BUFSIZ, fmt, ap);
     va_end(ap);
     ocall_print_string(buf);
+    return 0;
 }

SampleCode/SampleEnclavePCL/Enclave/Enclave.h

@@ -40,7 +40,7 @@
 extern "C" {
 #endif
 
-void printf(const char *fmt, ...);
+int printf(const char *fmt, ...);
 
 #if defined(__cplusplus)
 }

SampleCode/SealUnseal/App/ErrorSupport.cpp

@@ -50,6 +50,7 @@ static sgx_errlist_t sgx_errlist[] = {
     {SGX_ERROR_OUT_OF_EPC,               "Out of EPC memory."},
     {SGX_ERROR_NO_DEVICE,                "Invalid SGX device."},
     {SGX_ERROR_MEMORY_MAP_CONFLICT,      "Memory map conflicted."},
+    {SGX_ERROR_MEMORY_MAP_FAILURE,       "Failed to reserve memory for the enclave."},
     {SGX_ERROR_INVALID_METADATA,         "Invalid encalve metadata."},
     {SGX_ERROR_DEVICE_BUSY,              "SGX device is busy."},
     {SGX_ERROR_INVALID_VERSION,          "Enclave metadata version is invalid."},

SampleCode/Switchless/App/App.cpp

@@ -132,6 +132,11 @@ static sgx_errlist_t sgx_errlist[] = {
         "Can't open enclave file.",
         NULL
     },
+    {
+        SGX_ERROR_MEMORY_MAP_FAILURE,
+        "Failed to reserve memory for the enclave.",
+        NULL
+    },
 };
 
 /* Check error conditions for loading enclave */