Intel® Software Guard Extensions (Intel® SGX)
Discussion board focused on hardware-based isolation and memory encryption to provide extended code protection in solutions.

Ecall invocation from a remote enclave fails

Daniel_ˢᵍˣ
New Contributor I
1,534 Views

Hello,

 

I have a lib project that generates an enclave.signed.so and an app project that loads that .so using sgx_create_enclave_from_buffer_ex. The enclave is loaded successfully. However, when I attempt to invoke ecalls this fails.

 

I created a hello world to demo the problem: https://github.com/andrade/create-from-buffer-hello

 

I imagined sgx_create_enclave_from_buffer_ex would work similarly to dlopen and allow this scenario. Am I doing something wrong? Is this not possible with SGX?

 

 

* Right now this is all done locally but the endgame is having a server that can load client enclaves on request and invoke a well-defined API which all clients implement (clients may have other ecalls/ocalls which the server does not care about and ignores).

Labels (1)
0 Kudos
1 Solution
Daniel_ˢᵍˣ
New Contributor I
1,383 Views

Finally got it working.

Library generates enclave.signed.so and untrusted.so. Then application creates enclave from enclave.signed.so and loads untrusted.so using dlopen.

I wasn't generating untrusted code and passing it to the app which was causing the problem. I usually don't do this when I have no ocalls but in this case it won't work without it.

I've also updated the repository with the example I posted above, in case someone else needs it, since there is no other code using sgx_create_enclave_from_buffer_ex at the moment as far as I could find.

View solution in original post

0 Kudos
5 Replies
Sahira_Intel
Moderator
1,489 Views

Hi,

This is probably because the empty trusted enclave function gets compiled out. It should work if you put something in the enclave (it can be something simple like returning a value).


https://github.com/andrade/create-from-buffer-hello/blob/a5beed8111c5e5ec030d1f830635e80f83834a93/lib/enclave.c#L9



Sincerely,

Sahira




















0 Kudos
Daniel_ˢᵍˣ
New Contributor I
1,482 Views

Hello. Thank you for your reply.

 

I've tried with a non-empty ecall but it still fails with the same error.

 

https://github.com/andrade/create-from-buffer-hello/blob/fa2279b65cf0c3b9c329450c613847a47238fcc3/lib/enclave.c#L14

0 Kudos
Sahira_Intel
Moderator
1,445 Views

Hi,

Can you send the errors you are getting? 

Sincerely,

Sahira

0 Kudos
Daniel_ˢᵍˣ
New Contributor I
1,418 Views

Hello,

 

Library

The library that generates the enclave.signed.so has an ecall public int ecall_two(int n).

 

Application

When I invoke the application I get the error:

$ ./app_ex
./app_ex: symbol lookup error: ./app_ex: undefined symbol: ecall_two

But this happens when using -rdynamic in the makefile (I don't need it, was just trying to find a way to solve the problem).

Without -rdynamic the error is:

$ ./app_ex
Loads remote enclave using sgx_create_enclave_from_buffer_ex
sgx_create_enclave: success
Segmentation fault (core dumped)

 

0 Kudos
Daniel_ˢᵍˣ
New Contributor I
1,384 Views

Finally got it working.

Library generates enclave.signed.so and untrusted.so. Then application creates enclave from enclave.signed.so and loads untrusted.so using dlopen.

I wasn't generating untrusted code and passing it to the app which was causing the problem. I usually don't do this when I have no ocalls but in this case it won't work without it.

I've also updated the repository with the example I posted above, in case someone else needs it, since there is no other code using sgx_create_enclave_from_buffer_ex at the moment as far as I could find.

0 Kudos
Reply