Messages in this thread | | | Subject | Re: [PATCH v28 14/22] selftests/x86: Add a selftest for SGX | Date | Tue, 10 Mar 2020 14:29:41 -0500 | From | "Haitao Huang" <> |
| |
On Thu, 05 Mar 2020 23:32:10 -0600, Dr. Greg <greg@enjellic.com> wrote:
> On Wed, Mar 04, 2020 at 01:36:01AM +0200, Jarkko Sakkinen wrote: > > Good evening, I hope the end of the week is going well for everyone. > >> Add a selftest for SGX. It is a trivial test where a simple enclave >> copies one 64-bit word of memory between two memory locations given >> to the enclave as arguments. Use ENCLS[EENTER] to invoke the >> enclave. > > Just as a clarification, are you testing the new driver against signed > production class enclaves in .so format that also include metadata > layout directives or is the driver just getting tested against the two > page toy enclave that copies a word of memory from one memory location > to another? >
We (Intel SGX SDK/PSW team) tested this driver for enclaves in .so format with metadata. Our 2.8 release supports v24 and 2.9 supports v25+. Both production signed and debug signed enclaves worked.
*Note* we did make some code changes in our runtime for v24+, mainly dealing with src & EPC page alignment for EADD, open one fd per enclave, use -z noexecstack linker option, etc. You can see the changes on GitHub.
> Our PSW/runtime is currently failing to initialize production class > enclaves secondary to a return value of -4 from the ENCLU[EINIT] > instruction, which means the measurement of the loaded enclave has > failed to match the value in the signature structure. > > The same enclave loads fine with the out of kernel driver. Our > diagnostics tell us we are feeding identical page streams and > permissions to the page add ioctl's of both drivers. The identity > modulus signature of the signing key for the enclave is being written > to the launch control registers. > > We see the same behavior from both our unit test enclaves and the > Quoting Enclave from the Intel SGX runtime. > We did not see any issue loading QE in our tests. Please directly email me on this test if you have specific questions.
> When we ported our runtime loader to the new driver ABI we kept things > simple and add only a single page at a time in order to replicate the > behavior of the old driver. > > Secondly, we were wondering what distribution you are building the > self-tests with? Initial indications are that the selftest signing > utility doesn't build properly with OpenSSL 1.1.1. > > Have a good day. > > Dr. Greg > > As always, > Dr. Greg Wettstein, Ph.D, Worker > IDfusion, LLC SGX secured infrastructure and > 4206 N. 19th Ave. autonomously self-defensive platforms. > Fargo, ND 58102 > PH: 701-281-1686 EMAIL: greg@idfusion.net > ------------------------------------------------------------------------------ > "Don't worry about people stealing your ideas. If your ideas are any > good, you'll have to ram them down people's throats." > -- Howard Aiken
-- Using Opera's mail client: http://www.opera.com/mail/
| |