topic Re: Ecall invocation from a remote enclave fails in Intel® Software Guard Extensions (Intel® SGX)

Ecall invocation from a remote enclave fails

Daniel_ˢᵍˣ — Wed, 10 Aug 2022 18:00:12 GMT

Hello,

I have a lib project that generates an enclave.signed.so and an app project that loads that .so using sgx_create_enclave_from_buffer_ex. The enclave is loaded successfully. However, when I attempt to invoke ecalls this fails.

I created a hello world to demo the problem: https://github.com/andrade/create-from-buffer-hello

I imagined sgx_create_enclave_from_buffer_ex would work similarly to dlopen and allow this scenario. Am I doing something wrong? Is this not possible with SGX?

* Right now this is all done locally but the endgame is having a server that can load client enclaves on request and invoke a well-defined API which all clients implement (clients may have other ecalls/ocalls which the server does not care about and ignores).

Re:Ecall invocation from a remote enclave fails

Sahira_Intel — Mon, 15 Aug 2022 23:17:17 GMT

Hi,

This is probably because the empty trusted enclave function gets compiled out. It should work if you put something in the enclave (it can be something simple like returning a value).

https://github.com/andrade/create-from-buffer-hello/blob/a5beed8111c5e5ec030d1f830635e80f83834a93/lib/enclave.c#L9

Sincerely,

Sahira

Re: Re:Ecall invocation from a remote enclave fails

Daniel_ˢᵍˣ — Tue, 16 Aug 2022 15:19:39 GMT

Hello. Thank you for your reply.

I've tried with a non-empty ecall but it still fails with the same error.

https://github.com/andrade/create-from-buffer-hello/blob/fa2279b65cf0c3b9c329450c613847a47238fcc3/lib/enclave.c#L14

Re: Ecall invocation from a remote enclave fails

Sahira_Intel — Tue, 23 Aug 2022 18:46:37 GMT

Hi,

Can you send the errors you are getting?

Sincerely,

Sahira

Re: Ecall invocation from a remote enclave fails

Daniel_ˢᵍˣ — Thu, 25 Aug 2022 13:15:28 GMT

Hello,

Library

The library that generates the enclave.signed.so has an ecall public int ecall_two(int n).

Application

When I invoke the application I get the error:

$ ./app_ex ./app_ex: symbol lookup error: ./app_ex: undefined symbol: ecall_two

But this happens when using -rdynamic in the makefile (I don't need it, was just trying to find a way to solve the problem).

Without -rdynamic the error is:

$ ./app_ex Loads remote enclave using sgx_create_enclave_from_buffer_ex sgx_create_enclave: success Segmentation fault (core dumped)

Re: Ecall invocation from a remote enclave fails

Daniel_ˢᵍˣ — Thu, 01 Sep 2022 21:31:13 GMT

Finally got it working.

Library generates enclave.signed.so and untrusted.so. Then application creates enclave from enclave.signed.so and loads untrusted.so using dlopen.

I wasn't generating untrusted code and passing it to the app which was causing the problem. I usually don't do this when I have no ocalls but in this case it won't work without it.

I've also updated the repository with the example I posted above, in case someone else needs it, since there is no other code using sgx_create_enclave_from_buffer_ex at the moment as far as I could find.