- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
To gain a deeper understanding of what's going on behind the scenes I am currently looking into the Linux Intel SGX SDK source and also compiled code of applications and enclaves.
My problem is that I cannot find the instructions ENCLS and ENCLU - neither in the source nor in the binaries (with binaries I mean the application as well as the enclave).
My questions:
1. At what point are these instructions executed and how can I find their locations?
2. Do current tools like objdump recognize these instructions?
Link Copied
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello,
At the linux sdk sources (https://github.com/01org/linux-sgx) look at linux-sgx/psw/urts/linux/enter_enclave.s
There is a label called "do_eenter" (line 50, in my version which is pretty recent). There you will find:
.Ldo_eenter:
mov frame_arg0, %xbx /* tcs addr */
lea_pic .Lasync_exit_pointer, %xcx /* aep addr */
mov $SE_EENTER, %xax /* EENTER leaf */.Leenter_inst:
ENCLU
I personally like to search for things with grep: "grep ENCLU * -rn".
Ofir
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Well, this is embarassing. I actually used grep but messed up the parameters.
Thank you very much.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi all,
Actually you can find ENCLU in the enclave.so if you are using hardware mode.
But I still cannot find ENCLS. According to the intel programmer reference, encls should be used to create enclave and enclu to enter and exit enclave. So can someone tell me where can i find the code which creates enclave (i.e. ENCLS)?
Thank you!
Ruide
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi all,
In addition, I find in the disassembly of enclave.so, there exist enclu[ecreate], which is rax = 0x0 and enclu. That seems to contradict with encls[ecreate]. I wonder why is that? Can someone help me out?
Also, for the original post, you may want to use GNU assembler 2.25.1 or above, GNU assembler 2.24 cannot recognize enclu or encls.
Ruide
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
ECREATE is ENCLS with EAX=00.
EREPORT is ENCLU with EAX=00
You can find ENCLS instructions in the driver, EENTER and ERESUME in the uRTS, and EEXIT, EGETKEY, and EREPORT inside the enclave.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Juan del Cuvillo (Intel) wrote:
ECREATE is ENCLS with EAX=00.
EREPORT is ENCLU with EAX=00
You can find ENCLS instructions in the driver, EENTER and ERESUME in the uRTS, and EEXIT, EGETKEY, and EREPORT inside the enclave.
Hi, I am able to find EENTER, EEXIT, EGETKEY, and EREPORT. However, I cannot find ERESUME leaf functions in the sdk.
Could you explain how it is used to resume the enclave after a fault?
Thanks
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Francisco C. (Intel) wrote:
I think it's here:
Thank you for the reply. I used the SDK compiled in DEBUG=1 mode. However by looking at the SE_TRACE information, I think the "sig_handler" function was not triggered after page faults. ("sig_handler" is triggered if there is an exception such as "divided by zero".)
According to the manual, ERESUME should be used by the untrusted code to return to the enclave after a page fault.
I used the grep command to search from the SDK code, and found the only place of ERESUME was here too.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
When async exit happens, processor cook up something called synthetic state, which loads RAX with ERESUME leaf code, and so on.
So in uRTS we have the trampoline for ERESUME defined at line 110 in this file:https://github.com/01org/linux-sgx/blob/1115c195cd60d5ab2b80c12d07e21663e5aa8030/psw/urts/linux/enter_enclave.S#L110
See also SDM vol 3, section 39.3
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark
- Subscribe
- Printer Friendly Page