Community
cancel
Showing results for 
Search instead for 
Did you mean: 
sz
Beginner
422 Views

Failed to load QE3: 0x4004

when i run a SGX remote attestation example (EPID attestation mode),

it's failed:

error: aesm_service returned error: 12
error: load_enclave() failed with error -1

so i checked the aesm service with `service aesm service status` command,

it is said:

[load_qe ../qe_logic.cpp:641] Error, call sgx_create_enclave QE fail [load_qe], SGXError:4004.
Failed to load QE3: 0x4004

and 

[ADMIN]EPID Provisioning failed due to network error.

I tried reinstall sgx driver、sgx PSW、sgx sdk,but there is no effect。

how can i fix this problem?thanks a lot!

0 Kudos
16 Replies
JesusG_Intel
Moderator
385 Views

Hello sz,


You may need to configure your proxy for the aesmd service.


https://github.com/intel/linux-sgx#configure-the-proxy-for-aesmd-service


Sincerely,

Jesus G.

Intel Customer Support


JesusG_Intel
Moderator
352 Views

Hello sz,


The instructions from https://github.com/intel/linux-sgx#configure-the-proxy-for-aesmd-service are:


The aesmd service uses the HTTP protocol to initialize some services.

If a proxy is required for the HTTP protocol, you may need to manually set up the proxy for the aesmd service.

You should manually edit the file /etc/aesmd.conf (refer to the comments in the file) to set the proxy for the aesmd service.

After you configure the proxy, you need to restart the service to enable the proxy.


As an example, my /etc/aesmd.conf file is:

#Line with comments only


     #empty line with comment

#proxy type  = direct #direct type means no proxy used

#proxy type  = default #system default proxy

proxy type  = manual #aesm proxy should be specified for manual proxy type

aesm proxy  = http://proxy.url.com:123

#whitelist url = http://sample_whitelist_url

#default quoting type = ecdsa_256

#default quoting type = epid_linkable

#default quoting type = epid_unlinkable


Sincerely,

Jesus G.

Intel Customer Support


sz
Beginner
343 Views

That's very nice of you! Thanks @JesusG_Intel 

But I think the key is `failed to load QE3`.

Is this issue(failed to load QE3) related to the configuration of aesmd.conf?

By the way,

I tried set the aesmd.conf,but it still went wrong.

May be I had a wrong config of aesmd.conf.

What is proxy value should be ?

I have no idea to set the right value of proxy.

JesusG_Intel
Moderator
293 Views

Hello sz,

Make sure you have installed all of these PSW components:

$ sudo apt-get install libsgx-launch libsgx-epid libsgx-quote-ex libsgx-uae-service libsgx-urts

You can check your system's proxy settings in your Network settings on your OS and enter the same proxy settings in the aesmd.conf file. You can also try uncommenting proxy type = default line. This will use the system's proxy instead of the manual entry.

Sincerely,
Jesus G.
Intel Customer Support

 

sz
Beginner
287 Views

微信图片_20210420103336.png

Yes,I am sure there is on my system.

And I found the issue (fialed to load QE3) was appeared when I restarted the aesmd service(`service aesmd restart`).

I tried set your lastest advice,it's still not work.

if we ignore (fialed to load QE3) and set proxy is default,the aesmd logs shows that:

微信图片_20210420104146.png

this logs was created via run a remote attestation examples(use graphene EPID remote attestaion).

and the graphene said :

error: aesm_service returned error: 20
error: load_enclave() failed with error -1.

 

Recently,I tried install oot driver 、PSW、sgxsdk via github source code to make,also fail.

 

sz
Beginner
285 Views

微信图片_20210420103336.png

Yes,I am sure there is on my system.

And I found the issue (fialed to load QE3) was appeared when I restarted the aesmd service(`service aesmd restart`).

I tried set your lastest advice,it's still not work.

if we ignore (fialed to load QE3) and set proxy is default,the aesmd logs shows that:

微信图片_20210420104146.png

this logs was created via run a remote attestation examples(use graphene EPID remote attestaion).

and the graphene said :

error: aesm_service returned error: 20
error: load_enclave() failed with error -1.

 

Recently,I tried reinstall oot driver 、PSW、sgxsdk via github source code to make,also fail.

Thanks @JesusG_Intel .

JesusG_Intel
Moderator
270 Views

Hello sz,


I noticed that your network error went away after you set the proxy in aesmd.conf. Aesmd error 20 corresponds to AESM_UPDATE_AVAILABLE.


Run sudo apt list --installed | grep sgx to check which version of the PSW you have installed.


What is the output from sudo systemctl status aesmd?


What happens when you run the RemoteAttestation sample in the SGX SDK?


You provided output from Graphene, but what is the current state of sgx-ra-sample?


Sincerely,

Jesus G.

Intel Customer Support


sz
Beginner
257 Views

Thank you for your follow-up and many suggestions.

I just reinstall my computer's operating system because I think it might have something to do with the fact that I upgraded the Linux kernel(5.4 ---> 5.9),or may be not.

so I decided to start over this work.

Thanks a lot @JesusG_Intel !

JesusG_Intel
Moderator
249 Views

Hello sz,


That's a great idea. Please let us know if you continue to have problems after re-installing everything.


Sincerely,

Jesus G.

Intel Customer Support


sz
Beginner
234 Views

JesusG_Intel
Moderator
182 Views

Hello sz,


Were you successful in running the sgx-ra-sample after reinstalling everything from scratch?


Sincerely,

Jesus G.

Intel Customer Support


sz
Beginner
168 Views

Yes, I did have some troubles when I reinstalled the operating system...

When I run a Grahene Dcap remote attestation example(End-To-End Confidential PyTorch Workflow),
I got an error with aesm_service:

error: aesm_service returned error: 1
error: load_enclave() failed with error -1

I describe in more detail in this Issue https://github.com/intel/linux-sgx/issues/702 .

Thanks!

JesusG_Intel
Moderator
144 Views

Hello sz,


I looked at your issue on Github and noticed that you are trying to use the DCAP driver on a 10th Gen Intel Core processor. Your processor may not support Flexible Launch Control (FLC), which is required to use the DCAP driver. Use this article to find out if your processor supports FLC: https://www.intel.com/content/www/us/en/support/articles/000057420/software/intel-security-products....


If your processor does not support FLC, which I suspect it does not, you must use the OOT driver available here: https://github.com/intel/linux-sgx-driver or the binary here: sgx_linux_x64_driver_2.11.0_0373e2e.bin (https://download.01.org/intel-sgx/sgx-linux/2.13/distro/ubuntu18.04-server/).


Sincerely,

Jesus G.

Intel Customer Support


sz
Beginner
135 Views

Thanks @JesusG_Intel 

I checked the status.My computer really support FLC.

flcflc

JesusG_Intel
Moderator
107 Views

Hello sz,


The error you received in the screenshot above: "[ADMIN]EPID Provisioning protocol error reported by Backend (9)," translates to PVE_PROV_ATTEST_KEY_TCB_OUT_OF_DATE.


This means your TCB is out of date so you need to update your BIOS to the latest available version so that your platform can be properly provisioned.


The 404 errors you are getting may have to do with the fact that the PCCS cannot find certs for your platform because it has not been provisioned.


Sincerely,

Jesus G.

Intel Customer Support


sz
Beginner
16 Views

“The 404 errors you are getting may have to do with the fact that the PCCS cannot find certs for your platform because it has not been provisioned.”

But how?

I follow this Guide to install,all step was succeeded expect one:

sz_0-1620379060466.png

in my system,it said:

root@ltinerary-QiTianM435-N000:/etc/intel/gitSource/graphene/Examples/pytorch-confidential# PCKIDRetrievalTool

Intel(R) Software Guard Extensions PCK Cert ID Retrieval Tool Version 1.10.100.4

Warning: platform manifest is not available or current platform is not multi-package platform.
Error: unexpected error happend during sending data to cache server.
pckid_retrieval.csv has been generated successfully, however the data couldn't be sent to cache server!

so I think this cause the 404 error.

But I can't found the reason why the data couldn't be sent to cache server.

Thanks.

Reply