Skip to content

Commit edfe42a

Browse files
lllyllly
committed
Linux 2.14 Open Source Gold Release
Supported loading enclave at address 0. Upgraded Intel(R) Quote Verification Enclave to integrate SgxSSL/OpenSSL version 1.1.1k. Updated the DCAP driver V1.33 with stability fixes, released as V1.33.2. This is to support legacy solutions not ready to transition to the latest DCAP driver V1.41 or kernel 5.11+. Fixed bugs. Signed-off-by: Li, Xun <[email protected]>
1 parent ebf4534 commit edfe42a

File tree

65 files changed

+1683
-382
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

65 files changed

+1683
-382
lines changed

‎.gitignore

Lines changed: 2 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -18,16 +18,12 @@
1818
/build/
1919
/linux/installer/bin/*.bin
2020

21-
2221
# files downloaded in preparation phase
2322
Intel redistributable binary.txt
2423
Master_EULA_for_Intel_Sw_Development_Products.pdf
25-
external/ippcp_internal/inc/ippcp.h
26-
external/ippcp_internal/inc/ippcpdefs.h
27-
external/ippcp_internal/inc/ippversion.h
28-
external/ippcp_internal/inc/sgx_ippcp.h
29-
external/ippcp_internal/license/
24+
external/ippcp_internal/
3025
external/toolset/
26+
psw/ae/data/prebuilt/README.md
3127
redist.txt
3228

3329
# directory created when running reproducibility scripts

‎README.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,8 @@ The Linux\* Intel(R) SGX software stack is comprised of the Intel(R) SGX driver,
4040

4141
The [SGXDataCenterAttestationPrimitives](https://github.com/intel/SGXDataCenterAttestationPrimitives/) project maintains an out-of-tree driver for the Linux\* Intel(R) SGX software stack, which will be used until the driver upstreaming process is complete. It is used on the platforms with *Flexible Launch Control* and *Intel(R) AES New Instructions* support and could support both Elliptic Curve Digital Signature algorithm (ECDSA) based attestation and Enhanced Privacy Identification (EPID) based attestation.
4242

43+
**Note**: Ice Lake Xeon-SP (and the future Xeon-SP platforms) doesn't support EPID attestation.
44+
4345
The [linux-sgx-driver](https://github.com/01org/linux-sgx-driver) project hosts the other out-of-tree driver for the Linux\* Intel(R) SGX software stack, which will be used until the driver upstreaming process is complete. It is used to support Enhanced Privacy Identification (EPID) based attestation on the platforms without *Flexible Launch Control*.
4446

4547
The [intel-device-plugins-for-kubernetes](https://github.com/intel/intel-device-plugins-for-kubernetes) project enables users to run container applications running Intel(R) SGX enclaves in Kubernetes clusters. It also gives instructions how to set up ECDSA based attestation in a cluster.

‎SampleCode/SampleEnclave/App/Edger8rSyntax/Pointers.cpp

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -50,19 +50,19 @@ void edger8r_pointer_attributes(void)
5050
assert(strcmp(c, "SGX_SUCCESS") == 0);
5151

5252

53-
val = 0;
53+
val = 1;
5454
ret = ecall_pointer_in(global_eid, &val);
5555
if (ret != SGX_SUCCESS)
5656
abort();
57-
assert(val == 0);
57+
assert(val == 1);
5858

59-
val = 0;
59+
val = 1;
6060
ret = ecall_pointer_out(global_eid, &val);
6161
if (ret != SGX_SUCCESS)
6262
abort();
6363
assert(val == 1234);
6464

65-
val = 0;
65+
val = 1;
6666
ret = ecall_pointer_in_out(global_eid, &val);
6767
if (ret != SGX_SUCCESS)
6868
abort();

‎SampleCode/SampleEnclave/Enclave/Edger8rSyntax/Pointers.cpp

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -98,6 +98,7 @@ void ecall_pointer_in(int* val)
9898
{
9999
if (sgx_is_within_enclave(val, sizeof(int)) != 1)
100100
abort();
101+
assert(*val == 1);
101102
*val = 1234;
102103
}
103104

@@ -119,6 +120,7 @@ void ecall_pointer_in_out(int* val)
119120
{
120121
if (sgx_is_within_enclave(val, sizeof(int)) != 1)
121122
abort();
123+
assert(*val == 1);
122124
*val = 1234;
123125
}
124126

‎build-scripts/sgx-asm-pp.py

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,7 @@
3030
#
3131
#
3232

33+
3334
__version__ = '1.0.1'
3435
import sys
3536
import os

‎common/inc/internal/enclave_creator.h

Lines changed: 7 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -57,11 +57,13 @@ class EnclaveCreator : private Uncopyable
5757
{
5858
public:
5959
/*
60-
@quote the EPC reserved;
61-
@enclave_id identify the unique enclave;
62-
@start_addr is the linear address allocated for Enclave;
60+
@secs is a pointer to the architecture-specific information to use to create the enclave;
61+
@enclave_id identify the unique enclave;
62+
@start_addr is the linear address allocated for enclave;
63+
@ex_features is the bitmask defining the extended features to activate on the enclave creation;
64+
@ex_features_p is the array of pointers to extended feature control structures;
6365
*/
64-
virtual int create_enclave(secs_t *secs, sgx_enclave_id_t *enclave_id, void **start_addr, bool ae = false) = 0;
66+
virtual int create_enclave(secs_t *secs, sgx_enclave_id_t *enclave_id, void **start_addr, const uint32_t ex_features, const void* ex_features_p[32]) = 0;
6567
/*
6668
*@attr can be REMOVABLE
6769
*/
@@ -83,6 +85,7 @@ class EnclaveCreator : private Uncopyable
8385
virtual int trim_range(uint64_t fromaddr, uint64_t toaddr) = 0;
8486
virtual int trim_accept(uint64_t addr) = 0;
8587
virtual int remove_range(uint64_t fromaddr, uint64_t numpages) = 0;
88+
8689
// destructor
8790
virtual ~EnclaveCreator() {};
8891
};

‎common/inc/internal/global_data.h

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -48,7 +48,7 @@
4848
typedef struct _global_data_t
4949
{
5050
sys_word_t sdk_version;
51-
sys_word_t enclave_size;
51+
sys_word_t enclave_size; /* the size of the virtual address range that the enclave will use*/
5252
sys_word_t heap_offset;
5353
sys_word_t heap_size;
5454
sys_word_t rsrv_offset;
@@ -61,6 +61,9 @@ typedef struct _global_data_t
6161
uint32_t layout_entry_num;
6262
uint32_t reserved;
6363
layout_t layout_table[LAYOUT_ENTRY_NUM];
64+
uint64_t enclave_image_address; /* the base address of the enclave image */
65+
uint64_t elrange_start_address; /* the base address provided in the enclave's SECS (SECS.BASEADDR) */
66+
uint64_t elrange_size; /* the size of the enclave address range provided in the enclave's SECS (SECS.SIZE) */
6467
} global_data_t;
6568

6669
#define ENCLAVE_INIT_NOT_STARTED 0

‎common/inc/internal/metadata.h

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,12 @@
4040
#define MAJOR_VERSION 2 //MAJOR_VERSION should not larger than 0ffffffff
4141
#define MINOR_VERSION 4 //MINOR_VERSION should not larger than 0ffffffff
4242

43+
#define SGX_2_ELRANGE_MAJOR_VERSION 12
44+
#define SGX_1_ELRANGE_MAJOR_VERSION 11
45+
46+
#define SGX_MAJOR_VERSION_GAP 10
47+
48+
4349
#define SGX_2_1_MAJOR_VERSION 2 //MAJOR_VERSION should not larger than 0ffffffff
4450
#define SGX_2_1_MINOR_VERSION 2 //MINOR_VERSION should not larger than 0ffffffff
4551

@@ -168,6 +174,13 @@ typedef struct _patch_entry_t
168174
uint32_t reserved[4];
169175
} patch_entry_t;
170176

177+
typedef struct _elrange_config_entry_t
178+
{
179+
uint64_t enclave_image_address;
180+
uint64_t elrange_start_address;
181+
uint64_t elrange_size;
182+
}elrange_config_entry_t;
183+
171184
typedef struct _metadata_t
172185
{
173186
uint64_t magic_num; /* The magic number identifying the file as a signed enclave image */

‎common/inc/internal/se_debugger_lib.h

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -87,6 +87,7 @@ typedef struct _debug_enclave_info_t
8787
PADDED_POINTER(void, lpFileName);
8888
PADDED_POINTER(void, g_peak_heap_used_addr);
8989
PADDED_POINTER(void, g_peak_rsrv_mem_committed_addr);
90+
uint64_t elrange_start_address;
9091
PADDED_POINTER(void, dyn_sec);
9192
sgx_misc_select_t misc_select;
9293
/* The following members are optional or unused */

‎common/inc/internal/se_version.h

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -31,20 +31,20 @@
3131
#ifndef _SE_VERSION_H_
3232
#define _SE_VERSION_H_
3333

34-
#define STRFILEVER "2.13.103.1"
34+
#define STRFILEVER "2.14.100.2"
3535
#define SGX_MAJOR_VERSION 2
36-
#define SGX_MINOR_VERSION 13
37-
#define SGX_REVISION_VERSION 103
36+
#define SGX_MINOR_VERSION 14
37+
#define SGX_REVISION_VERSION 100
3838
#define MAKE_VERSION_UINT(major,minor,rev) (((uint64_t)major)<<32 | ((uint64_t)minor) << 16 | rev)
3939
#define VERSION_UINT MAKE_VERSION_UINT(SGX_MAJOR_VERSION, SGX_MINOR_VERSION, SGX_REVISION_VERSION)
4040

4141
#define COPYRIGHT "Copyright (C) 2021 Intel Corporation"
4242

43-
#define UAE_SERVICE_VERSION "2.3.210.1"
44-
#define URTS_VERSION "1.1.114.1"
45-
#define ENCLAVE_COMMON_VERSION "1.0.117.1"
46-
#define LAUNCH_VERSION "1.0.112.1"
47-
#define EPID_VERSION "1.0.112.1"
48-
#define QUOTE_EX_VERSION "1.1.112.1"
43+
#define UAE_SERVICE_VERSION "2.3.211.2"
44+
#define URTS_VERSION "1.1.115.2"
45+
#define ENCLAVE_COMMON_VERSION "1.1.118.2"
46+
#define LAUNCH_VERSION "1.0.113.2"
47+
#define EPID_VERSION "1.0.113.2"
48+
#define QUOTE_EX_VERSION "1.1.113.2"
4949

5050
#endif

‎common/inc/sgx_error.h

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -44,9 +44,8 @@ typedef enum _status_t
4444
SGX_ERROR_ENCLAVE_LOST = SGX_MK_ERROR(0x0004), /* Enclave lost after power transition or used in child process created by linux:fork() */
4545
SGX_ERROR_INVALID_STATE = SGX_MK_ERROR(0x0005), /* SGX API is invoked in incorrect order or state */
4646
SGX_ERROR_FEATURE_NOT_SUPPORTED = SGX_MK_ERROR(0x0008), /* Feature is not supported on this platform */
47-
SGX_PTHREAD_EXIT = SGX_MK_ERROR(0x0009), /* Enclave is exited with pthread_exit() */
48-
49-
47+
SGX_PTHREAD_EXIT = SGX_MK_ERROR(0x0009), /* Enclave is exited with pthread_exit() */
48+
SGX_ERROR_MEMORY_MAP_FAILURE = SGX_MK_ERROR(0x000a), /* Failed to reserve memory for the enclave */
5049

5150
SGX_ERROR_INVALID_FUNCTION = SGX_MK_ERROR(0x1001), /* The ecall/ocall index is invalid */
5251
SGX_ERROR_OUT_OF_TCS = SGX_MK_ERROR(0x1003), /* The enclave is out of TCS */

‎common/src/se_memory.c

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,10 @@
3838
void* se_virtual_alloc(void* address, size_t size, uint32_t type)
3939
{
4040
UNUSED(type);
41-
void* pRet = mmap(address, size, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
41+
int mmap_flag = MAP_PRIVATE | MAP_ANONYMOUS;
42+
if(address != NULL)
43+
mmap_flag |= MAP_FIXED;
44+
void* pRet = mmap(address, size, PROT_READ | PROT_WRITE, mmap_flag, -1, 0);
4245
if(MAP_FAILED == pRet)
4346
return NULL;
4447
return pRet;

‎download_prebuilt.sh

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -33,11 +33,11 @@
3333

3434
top_dir=`dirname $0`
3535
out_dir=$top_dir
36-
optlib_name=optimized_libs_2.13.3.tar.gz
37-
ae_file_name=prebuilt_ae_2.13.3.tar.gz
36+
optlib_name=optimized_libs_2.14.tar.gz
37+
ae_file_name=prebuilt_ae_2.14.tar.gz
3838
binutils_file_name=as.ld.objdump.gold.r3.tar.gz
39-
checksum_file=SHA256SUM_prebuilt_2.13.3.cfg
40-
server_url_path=https://download.01.org/intel-sgx/sgx-linux/2.13.3
39+
checksum_file=SHA256SUM_prebuilt_2.14.cfg
40+
server_url_path=https://download.01.org/intel-sgx/sgx-linux/2.14
4141
server_optlib_url=$server_url_path/$optlib_name
4242
server_ae_url=$server_url_path/$ae_file_name
4343
server_binutils_url=$server_url_path/$binutils_file_name

‎external/dcap_source

Submodule dcap_source updated 594 files

‎external/ippcp_internal/0001-Add-mitigation-support-to-assembly-code.patch

Lines changed: 0 additions & 55 deletions
This file was deleted.

‎external/sgxssl/prepare_sgxssl.sh

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -32,18 +32,18 @@
3232

3333
top_dir="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
3434
openssl_out_dir=$top_dir/openssl_source
35-
openssl_ver=1.1.1i
35+
openssl_ver=1.1.1k
3636
openssl_ver_name=openssl-$openssl_ver
3737
sgxssl_github_archive=https://github.com/intel/intel-sgx-ssl/archive
38-
sgxssl_ver=2.13
38+
sgxssl_ver=2.14
3939
sgxssl_ver_name=v$sgx_ver
4040
sgxssl_file_name=lin_$sgxssl_ver\_$openssl_ver
4141
build_script=$top_dir/Linux/build_openssl.sh
4242
server_url_path=https://www.openssl.org/source
4343
full_openssl_url=$server_url_path/old/1.1.1/$openssl_ver_name.tar.gz
4444

45-
sgxssl_chksum=95997e75d0ea09e525626ce3812bbd3dd972382a20a989bcf1c3acb9746d2a23
46-
openssl_chksum=e8be6a35fe41d10603c3cc635e93289ed00bf34b79671a3a4de64fcee00d5242
45+
sgxssl_chksum=825e58823f2ec39bcfb69c2c62cc4e769bdac057ade10b362cdeac1f5a563954
46+
openssl_chksum=892a0875b9872acd04a9fde79b1f943075d5ea162415de3047c327df33fbaee5
4747
rm -f check_sum_sgxssl.txt check_sum_openssl.txt
4848
if [ ! -f $build_script ]; then
4949
wget $sgxssl_github_archive/$sgxssl_file_name.zip -P $top_dir || exit 1

‎linux/installer/common/psw/install.sh

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -220,6 +220,21 @@ if [ -d /run/systemd/system ]; then
220220
systemctl start remount-dev-exec
221221
fi
222222

223+
trigger_udev() {
224+
if ! which udevadm &> /dev/null; then
225+
return 0
226+
fi
227+
udevadm control --reload || :
228+
udevadm trigger || :
229+
}
230+
231+
# Add sgx_prv for in-kernel driver.
232+
if [ -c /dev/sgx_provision -o -c /dev/sgx/provision ]; then
233+
/usr/bin/getent group sgx_prv &> /dev/null || /usr/sbin/groupadd sgx_prv
234+
trigger_udev
235+
fi
236+
237+
223238
$AESM_PATH/cse_provision_tool 2> /dev/null || true
224239
rm -f $AESM_PATH/cse_provision_tool
225240

‎linux/installer/common/sgx-aesm-service/BOMs/libsgx-ae-pce.txt

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,3 @@
11
DeliveryName InstallName FileCheckSum FileFeature FileOwner
22
<deliverydir>/build/linux/libsgx_pce.signed.so <installdir>/lib/libsgx_pce.signed.so 0 main STP
3+
<deliverydir>/linux/installer/common/sgx-aesm-service/92-sgx-provision.rules <installdir>/etc/udev/rules.d/93-sgx-provision.rules 0 main STP

‎linux/installer/common/sgx-aesm-service/BOMs/sgx-aesm-service.txt

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,6 @@ DeliveryName InstallName FileCheckSum FileFeature FileOwner
99
<deliverydir>/build/linux/aesmd.service <installdir>/aesm/aesmd.service 0 main STP
1010
<deliverydir>/build/linux/aesm_service <installdir>/aesm/aesm_service 0 main STP
1111
<deliverydir>/psw/ae/aesm_service/config/network/aesmd.conf <installdir>/aesm/conf/aesmd.conf 0 main STP
12-
<deliverydir>/linux/installer/common/sgx-aesm-service/92-sgx-provision.rules <installdir>/aesm/conf/udev/rules.d/92-sgx-provision.rules 0 main STP
1312
<deliverydir>/linux/installer/common/sgx-aesm-service/linksgx.sh <installdir>/aesm/linksgx.sh 0 main STP
1413
<deliverydir>/linux/installer/common/sgx-aesm-service/startup.sh <installdir>/startup.sh 0 main STP
1514
<deliverydir>/linux/installer/common/sgx-aesm-service/cleanup.sh <installdir>/cleanup.sh 0 main STP

‎linux/installer/common/sgx-aesm-service/Makefile

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -84,6 +84,9 @@ $(PACKAGES):
8484
install $(PACKAGE_ROOT_FOLDER)/$@/$(LIB_DIR)/* $(DESTDIR)/$@/$(USR_LIB_PATH), \
8585
install -d $(shell readlink -m $(DESTDIR)/$@/$(AESM_SERVICE_PACKAGE_PATH)/$(AESM_SERVICE_PACKAGE_NAME)) && \
8686
cp -r $(PACKAGE_ROOT_FOLDER)/$@/* $(DESTDIR)/$@/$(AESM_SERVICE_PACKAGE_PATH)/$(AESM_SERVICE_PACKAGE_NAME))
87+
$(if $(wildcard $(PACKAGE_ROOT_FOLDER)/$@/$(ETC_DIR)/.*), \
88+
install -d $(shell readlink -m $(DESTDIR)/$@/$(ETC_DIR)) && \
89+
cp -fr $(PACKAGE_ROOT_FOLDER)/$@/$(ETC_DIR)/* $(DESTDIR)/$@/$(ETC_DIR))
8790
$(if $(wildcard $(PACKAGE_ROOT_FOLDER)/$@/aesm/data/.*), \
8891
install -d $(shell readlink -m $(DESTDIR)/$@/$(VAR_OPT_PATH)) && \
8992
cp -fr $(DESTDIR)/$@/$(AESM_SERVICE_PACKAGE_PATH)/$(AESM_SERVICE_PACKAGE_NAME)/aesm/data \

‎linux/installer/common/sgx-aesm-service/linksgx.sh

Lines changed: 2 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -36,12 +36,8 @@ if test $(id -u) -ne 0; then
3636
fi
3737

3838
/usr/bin/getent group sgx_prv &> /dev/null
39-
if [ $? != "0" -a -c /dev/sgx/provision ]; then
40-
# Add sgx_prv for in-kernel driver.
41-
/usr/sbin/groupadd sgx_prv
42-
udevadm trigger
39+
if [ $? == "0" ]; then
40+
/usr/sbin/usermod -aG sgx_prv aesmd &> /dev/null
4341
fi
4442

45-
/usr/sbin/usermod -aG sgx_prv aesmd &> /dev/null
46-
4743
echo

‎linux/installer/deb/libsgx-enclave-common/libsgx-enclave-common-1.0/debian/postinst

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,10 +17,17 @@ set -e
1717
# for details, see http://www.debian.org/doc/debian-policy/ or
1818
# the debian-policy package
1919

20+
trigger_udev() {
21+
if ! which udevadm &> /dev/null; then
22+
return 0
23+
fi
24+
udevadm control --reload || :
25+
udevadm trigger || :
26+
}
2027

2128
case "$1" in
2229
configure)
23-
udevadm trigger &> /dev/null || true
30+
trigger_udev
2431
systemctl enable remount-dev-exec &> /dev/null || true
2532
systemctl start remount-dev-exec &> /dev/null || true
2633
;;

0 commit comments

Comments
 (0)