intel / intel/confidential-computing.sgx
Run the sample 'SampleCommonLoader' failed with several questions
- Dominant language
- C++
- Stars
- 1.5k
- Forks
- 565
- PR merge metrics
- No merged PRs in 30d
Description
I am new for SGX. My platform is Intel GeminiLake, and I enable SGX in BIOS and select 128MB. I am using the Out of Tree Linux sgx kernel driver, and I can load it well. With dmesg, I see the SGX memory is reserved. So there is only one device node /dev/isgx.
By running the sample 'SampleCommonLoader', I get failed with several questions:
1. To run any enclaves, must AESM service be run firstly? As once I run the sample, it tries to connect AESM service, and get failed.
2. If AESM service is not a MUST, how can I make the enclave not depended on AESM service?
3. I check the linux out of tree driver code, the enclave initialization instruction 'EINIT' requests a token. How can I generate this token by myself, any documents can refer? It seems AESM service try to generate such tokens. Any documents to describe the mechanism for this token, like why need this token, and how to use it. I read many documents, but I can't catch it exactly.
4. I launch the AESM service with only system bundle but no other bundles, and run 'SampleCommonLoader', and it reports enclave initialized failed. And I do some debugging, the function 'oal_get_launch_token' returns failed, the error is 'AESM_SERVICE_UNAVAILABLE'. I guest it needs LE service.
5. I launch AESM service with some bundles, like 'lible_launch_service_bundle.so', but AESM run failed. I check the kernel message, EINIT instruction return 2 while initiliazing LE enclave (libsgx_le.signed.so). I check the error code '2', and it is defined as 'SGX_INVALID_ATTRIBUTE'. How can I fix it?
6. For the MSR registers IA32_SGXPUBKEYHASH0..3 MSRs, I try to write some values to them in kernel driver, but it causes my system crashed. I see it needs the platform support the Flexible Launch Control (FLC) feature, but in my BIOS setting, I can't find the item to enable FLC, so does it mean my platform GeminiLake do not support FLC?
7. The enclave requests the mmap address aligned with the size, but for the 'enclave_create_ex' code, only the IN KERNEL driver handles the alignment, both the Out of driver and DCAP don't handle it. Will out of tree driver and DCAP driver be deprecated? And the latest sgx sdk doesn't support them, right?
Sorry for so many questions.
Contributor guide
Research direction
Start by reproducing the SampleCommonLoader failure with the Out of Tree Linux SGX driver and AESM configuration described in the issue. Trace oal_get_launch_token, EINIT, the /dev/isgx device, and the reported SGX_INVALID_ATTRIBUTE and AESM_SERVICE_UNAVAILABLE errors; completion would require documented answers or verified fixes for the seven platform, token, service, driver, and FLC questions.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp, linux
- Domain
- operating-systems, security
- Issue type
- Bug
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 20/100