Ecall invocation from a remote enclave fails

[Daniel_ˢᵍˣ]

Hello,

I have a lib project that generates an enclave.signed.so and an app project that loads that .so using sgx_create_enclave_from_buffer_ex. The enclave is loaded successfully. However, when I attempt to invoke ecalls this fails.

I created a hello world to demo the problem: https://github.com/andrade/create-from-buffer-hello

I imagined sgx_create_enclave_from_buffer_ex would work similarly to dlopen and allow this scenario. Am I doing something wrong? Is this not possible with SGX?

* Right now this is all done locally but the endgame is having a server that can load client enclaves on request and invoke a well-defined API which all clients implement (clients may have other ecalls/ocalls which the server does not care about and ignores).

[Sahira_Intel]

Hi,

This is probably because the empty trusted enclave function gets compiled out. It should work if you put something in the enclave (it can be something simple like returning a value).

https://github.com/andrade/create-from-buffer-hello/blob/a5beed8111c5e5ec030d1f830635e80f83834a93/lib/enclave.c#L9

Sincerely,

Sahira

[Daniel_ˢᵍˣ]

Hello. Thank you for your reply.

I've tried with a non-empty ecall but it still fails with the same error.

https://github.com/andrade/create-from-buffer-hello/blob/fa2279b65cf0c3b9c329450c613847a47238fcc3/lib/enclave.c#L14

[Sahira_Intel]

Hi,

Can you send the errors you are getting? 

Sincerely,

Sahira

[Daniel_ˢᵍˣ]

Hello,

Library

The library that generates the enclave.signed.so has an ecall public int ecall_two(int n).

Application

When I invoke the application I get the error:

$ ./app_ex
./app_ex: symbol lookup error: ./app_ex: undefined symbol: ecall_two

But this happens when using -rdynamic in the makefile (I don't need it, was just trying to find a way to solve the problem).

Without -rdynamic the error is:

$ ./app_ex
Loads remote enclave using sgx_create_enclave_from_buffer_ex
sgx_create_enclave: success
Segmentation fault (core dumped)

[Daniel_ˢᵍˣ · Accepted solution]

Finally got it working.

Library generates enclave.signed.so and untrusted.so. Then application creates enclave from enclave.signed.so and loads untrusted.so using dlopen.

I wasn't generating untrusted code and passing it to the app which was causing the problem. I usually don't do this when I have no ocalls but in this case it won't work without it.

I've also updated the repository with the example I posted above, in case someone else needs it, since there is no other code using sgx_create_enclave_from_buffer_ex at the moment as far as I could find.