intel / intel/confidential-computing.sgx

Run the sample 'SampleCommonLoader' failed with several questions

Open
#754 11 comments 0 reactions 0 assignees View on GitHub
Dominant language
C++
Stars
1.5k
Forks
565
PR merge metrics
No merged PRs in 30d

Description

I am new for SGX. My platform is Intel GeminiLake, and I enable SGX in BIOS and select 128MB. I am using the Out of Tree Linux sgx kernel driver, and I can load it well. With dmesg, I see the SGX memory is reserved. So there is only one device node /dev/isgx.
By running the sample 'SampleCommonLoader', I get failed with several questions:
1. To run any enclaves, must AESM service be run firstly? As once I run the sample, it tries to connect AESM service, and get failed.
2. If AESM service is not a MUST, how can I make the enclave not depended on AESM service?
3. I check the linux out of tree driver code, the enclave initialization instruction 'EINIT' requests a token. How can I generate this token by myself, any documents can refer? It seems AESM service try to generate such tokens. Any documents to describe the mechanism for this token, like why need this token, and how to use it. I read many documents, but I can't catch it exactly.
4. I launch the AESM service with only system bundle but no other bundles, and run 'SampleCommonLoader', and it reports enclave initialized failed. And I do some debugging, the function 'oal_get_launch_token' returns failed, the error is 'AESM_SERVICE_UNAVAILABLE'. I guest it needs LE service.
5. I launch AESM service with some bundles, like 'lible_launch_service_bundle.so', but AESM run failed. I check the kernel message, EINIT instruction return 2 while initiliazing LE enclave (libsgx_le.signed.so). I check the error code '2', and it is defined as 'SGX_INVALID_ATTRIBUTE'. How can I fix it?
6. For the MSR registers IA32_SGXPUBKEYHASH0..3 MSRs, I try to write some values to them in kernel driver, but it causes my system crashed. I see it needs the platform support the Flexible Launch Control (FLC) feature, but in my BIOS setting, I can't find the item to enable FLC, so does it mean my platform GeminiLake do not support FLC?
7. The enclave requests the mmap address aligned with the size, but for the 'enclave_create_ex' code, only the IN KERNEL driver handles the alignment, both the Out of driver and DCAP don't handle it. Will out of tree driver and DCAP driver be deprecated? And the latest sgx sdk doesn't support them, right?

Sorry for so many questions.

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the SampleCommonLoader failure with the Out of Tree Linux SGX driver and AESM configuration described in the issue. Trace oal_get_launch_token, EINIT, the /dev/isgx device, and the reported SGX_INVALID_ATTRIBUTE and AESM_SERVICE_UNAVAILABLE errors; completion would require documented answers or verified fixes for the seven platform, token, service, driver, and FLC questions.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp, linux
Domain
operating-systems, security
Issue type
Bug
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
20/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.