Skip to content

Commit

Permalink
Update SGX SDK to 2.23 (#492)
Browse files Browse the repository at this point in the history
  • Loading branch information
@nick-mobilecoin
nick-mobilecoin authored Mar 22, 2024
2 parents d1a56df + 232cddc commit 27c4310
Show file tree
Hide file tree
Showing 6 changed files with 88 additions and 33 deletions.
4 changes: 2 additions & 2 deletions .devcontainer/Dockerfile
View file
Original file line number Diff line number Diff line change
Expand Up @@ -12,14 +12,14 @@ RUN apt-get update \
&& rm -r /var/lib/apt/lists

# Install SGX_SDK
ARG SGX_URL=https://download.01.org/intel-sgx/sgx-linux/2.22/distro/ubuntu22.04-server/sgx_linux_x64_sdk_2.22.100.3.bin
ARG SGX_URL=https://download.01.org/intel-sgx/sgx-linux/2.23/distro/ubuntu22.04-server/sgx_linux_x64_sdk_2.23.100.2.bin
RUN curl -o sgx.bin "${SGX_URL}" \
&& chmod +x ./sgx.bin \
&& ./sgx.bin --prefix=/opt/intel \
&& rm ./sgx.bin

# Install DCAP libraries
ARG DCAP_VERSION=1.19.100.3-jammy1
ARG DCAP_VERSION=1.20.100.2-jammy1
RUN mkdir -p /etc/apt/keyrings \
&& wget -qO - https://download.01.org/intel-sgx/sgx_repo/ubuntu/intel-sgx-deb.key | gpg --dearmor | tee /etc/apt/keyrings/intel-sgx.gpg > /dev/null \
&& echo "deb [arch=amd64 signed-by=/etc/apt/keyrings/intel-sgx.gpg] https://download.01.org/intel-sgx/sgx_repo/ubuntu jammy main" | tee /etc/apt/sources.list.d/intel-sgx.list \
Expand Down
1 change: 1 addition & 0 deletions .devcontainer/devcontainer.json
View file
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,7 @@
"eamodio.gitlens",
"vadimcn.vscode-lldb",
"rust-lang.rust-analyzer",
"ms-azuretools.vscode-docker",
]
}
}
Expand Down
18 changes: 9 additions & 9 deletions .github/workflows/ci.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -69,7 +69,7 @@ jobs:
- uses: actions/checkout@v4
- uses: mobilecoinfoundation/actions/dcap-libs@main
with:
version: 1.19.100.3-jammy1
version: 1.20.100.2-jammy1
- uses: dtolnay/rust-toolchain@master
with:
toolchain: ${{ matrix.rust }}
Expand All @@ -91,10 +91,10 @@ jobs:
- uses: actions/checkout@v4
- uses: mobilecoinfoundation/actions/sgxsdk@main
with:
version: 2.22.100.3
version: 2.23.100.2
- uses: mobilecoinfoundation/actions/dcap-libs@main
with:
version: 1.19.100.3-jammy1
version: 1.20.100.2-jammy1
- uses: dtolnay/rust-toolchain@master
with:
toolchain: ${{ matrix.rust }}
Expand All @@ -115,10 +115,10 @@ jobs:
- uses: actions/checkout@v4
- uses: mobilecoinfoundation/actions/sgxsdk@main
with:
version: 2.22.100.3
version: 2.23.100.2
- uses: mobilecoinfoundation/actions/dcap-libs@main
with:
version: 1.19.100.3-jammy1
version: 1.20.100.2-jammy1
- uses: dtolnay/rust-toolchain@master
with:
toolchain: ${{ matrix.rust }}
Expand All @@ -139,10 +139,10 @@ jobs:
- uses: actions/checkout@v4
- uses: mobilecoinfoundation/actions/sgxsdk@main
with:
version: 2.22.100.3
version: 2.23.100.2
- uses: mobilecoinfoundation/actions/dcap-libs@main
with:
version: 1.19.100.3-jammy1
version: 1.20.100.2-jammy1
- uses: dtolnay/rust-toolchain@master
with:
toolchain: ${{ matrix.rust }}
Expand Down Expand Up @@ -180,10 +180,10 @@ jobs:
- uses: actions/checkout@v4
- uses: mobilecoinfoundation/actions/sgxsdk@main
with:
version: 2.22.100.3
version: 2.23.100.2
- uses: mobilecoinfoundation/actions/dcap-libs@main
with:
version: 1.19.100.3-jammy1
version: 1.20.100.2-jammy1
- uses: dtolnay/rust-toolchain@stable
with:
components: llvm-tools-preview
Expand Down
46 changes: 45 additions & 1 deletion core/build/headers/sgx_dcap_quoteverify.h
View file
Original file line number Diff line number Diff line change
Expand Up @@ -120,7 +120,6 @@ quote3_error_t sgx_qv_verify_quote(
uint8_t *p_supplemental_data);



/**
* Call quote provider library to get QvE identity.
*
Expand Down Expand Up @@ -165,6 +164,51 @@ typedef enum

quote3_error_t sgx_qv_set_path(sgx_qv_path_type_t path_type,
const char *p_path);

/**
* Get quote verification result token.
*
* @param p_quote[IN] - Pointer to SGX Quote.
* @param quote_size[IN] - Size of the buffer pointed to by p_quote (in bytes).
* @param p_quote_collateral[IN] - The parameter is optional. This is a pointer to the Quote Certification Collateral provided by the caller.
* @param p_qve_report_info[IN/OUT] - This parameter can be used in 2 ways.
* If p_qve_report_info is NOT NULL, the API will use Intel QvE to perform quote verification, and QvE will generate a report using the target_info in sgx_ql_qe_report_info_t structure.
* if p_qve_report_info is NULL, the API will use QVL library to perform quote verification, note that the results can not be cryptographically authenticated in this mode.
* @param p_user_data[IN] - User data.
* @param p_verification_result_token_buffer_size[OUT] - Size of the buffer pointed to by verification_result_token (in bytes).
* @param p_verification_result_token[OUT] - Pointer to the verification_result_token.
*
* @return Status code of the operation, one of:
* - SGX_QL_SUCCESS
* - SGX_QL_ERROR_INVALID_PARAMETER
* - SGX_QL_QUOTE_FORMAT_UNSUPPORTED
* - SGX_QL_QUOTE_CERTIFICATION_DATA_UNSUPPORTED
* - SGX_QL_UNABLE_TO_GENERATE_REPORT
* - SGX_QL_CRL_UNSUPPORTED_FORMAT
* - SGX_QL_ERROR_UNEXPECTED
**/
quote3_error_t tee_verify_quote_qvt(
const uint8_t *p_quote,
uint32_t quote_size,
const sgx_ql_qve_collateral_t *p_quote_collateral,
sgx_ql_qe_report_info_t *p_qve_report_info,
const uint8_t *p_user_data,
uint32_t *p_verification_result_token_buffer_size,
uint8_t **p_verification_result_token);

/**
* Free quote verification result token buffer, which returned by `tee_verify_quote_qvt`
*
* @param p_verification_result_token[IN] - Pointer to verification result token
* @param p_verification_result_token_buffer_size[IN] - Pointer to verification result token size
*
* @return Status code of the operation, one of:
* - SGX_QL_SUCCESS
* - SGX_QL_ERROR_INVALID_PARAMETER
**/
quote3_error_t tee_free_verify_quote_qvt(
uint8_t *p_verification_result_token,
uint32_t *p_verification_result_token_buffer_size);
#endif


Expand Down
49 changes: 28 additions & 21 deletions core/build/headers/sgx_qve_header.h
View file
Original file line number Diff line number Diff line change
Expand Up @@ -41,31 +41,33 @@
/** Contains the possible values of the quote verification result. */
typedef enum _sgx_ql_qv_result_t
{
SGX_QL_QV_RESULT_OK = 0x0000, ///< The Quote verification passed and is at the latest TCB level
SGX_QL_QV_RESULT_MIN = SGX_QL_QV_MK_ERROR(0x0001),
SGX_QL_QV_RESULT_CONFIG_NEEDED = SGX_QL_QV_MK_ERROR(0x0001), ///< The Quote verification passed and the platform is patched to
///< the latest TCB level but additional configuration of the SGX
///< platform may be needed
SGX_QL_QV_RESULT_OUT_OF_DATE = SGX_QL_QV_MK_ERROR(0x0002), ///< The Quote is good but TCB level of the platform is out of date.
///< The platform needs patching to be at the latest TCB level
SGX_QL_QV_RESULT_OUT_OF_DATE_CONFIG_NEEDED = SGX_QL_QV_MK_ERROR(0x0003), ///< The Quote is good but the TCB level of the platform is out of
///< date and additional configuration of the SGX Platform at its
///< current patching level may be needed. The platform needs
///< patching to be at the latest TCB level
SGX_QL_QV_RESULT_INVALID_SIGNATURE = SGX_QL_QV_MK_ERROR(0x0004), ///< The signature over the application report is invalid
SGX_QL_QV_RESULT_REVOKED = SGX_QL_QV_MK_ERROR(0x0005), ///< The attestation key or platform has been revoked
SGX_QL_QV_RESULT_UNSPECIFIED = SGX_QL_QV_MK_ERROR(0x0006), ///< The Quote verification failed due to an error in one of the input
SGX_QL_QV_RESULT_SW_HARDENING_NEEDED = SGX_QL_QV_MK_ERROR(0x0007), ///< The TCB level of the platform is up to date, but SGX SW Hardening
///< is needed
SGX_QL_QV_RESULT_CONFIG_AND_SW_HARDENING_NEEDED = SGX_QL_QV_MK_ERROR(0x0008), ///< The TCB level of the platform is up to date, but additional
///< configuration of the platform at its current patching level
///< may be needed. Moreove, SGX SW Hardening is also needed
SGX_QL_QV_RESULT_OK = 0x0000, ///< The Quote verification passed and is at the latest TCB level
SGX_QL_QV_RESULT_MIN = SGX_QL_QV_MK_ERROR(0x0001),
SGX_QL_QV_RESULT_CONFIG_NEEDED = SGX_QL_QV_MK_ERROR(0x0001), ///< The Quote verification passed and the platform is patched to
///< the latest TCB level but additional configuration of the SGX
///< platform may be needed
SGX_QL_QV_RESULT_OUT_OF_DATE = SGX_QL_QV_MK_ERROR(0x0002), ///< The Quote is good but TCB level of the platform is out of date.
///< The platform needs patching to be at the latest TCB level
SGX_QL_QV_RESULT_OUT_OF_DATE_CONFIG_NEEDED = SGX_QL_QV_MK_ERROR(0x0003), ///< The Quote is good but the TCB level of the platform is out of
///< date and additional configuration of the SGX Platform at its
///< current patching level may be needed. The platform needs
///< patching to be at the latest TCB level
SGX_QL_QV_RESULT_INVALID_SIGNATURE = SGX_QL_QV_MK_ERROR(0x0004), ///< The signature over the application report is invalid
SGX_QL_QV_RESULT_REVOKED = SGX_QL_QV_MK_ERROR(0x0005), ///< The attestation key or platform has been revoked
SGX_QL_QV_RESULT_UNSPECIFIED = SGX_QL_QV_MK_ERROR(0x0006), ///< The Quote verification failed due to an error in one of the input
SGX_QL_QV_RESULT_SW_HARDENING_NEEDED = SGX_QL_QV_MK_ERROR(0x0007), ///< The TCB level of the platform is up to date, but SGX SW Hardening
///< is needed
SGX_QL_QV_RESULT_CONFIG_AND_SW_HARDENING_NEEDED = SGX_QL_QV_MK_ERROR(0x0008), ///< The TCB level of the platform is up to date, but additional
///< configuration of the platform at its current patching level
///< may be needed. Moreove, SGX SW Hardening is also needed
SGX_QL_QV_RESULT_TD_RELAUNCH_ADVISED = SGX_QL_QV_MK_ERROR(0x0009), ///< For TDX only. All components in the TD’s TCB are latest, including the
///< TD preserving loaded TDX, but the TD was launched and ran for some time
///< with out-of-date TDX Module. Relaunching or re-provisioning your TD is advised

SGX_QL_QV_RESULT_MAX = SGX_QL_QV_MK_ERROR(0x00FF), ///< Indicate max result to allow better translation

} sgx_ql_qv_result_t;


typedef enum _pck_cert_flag_enum_t {
PCK_FLAG_FALSE = 0,
PCK_FLAG_TRUE,
Expand Down Expand Up @@ -126,7 +128,12 @@ typedef struct _sgx_ql_qv_supplemental_t
pck_cert_flag_enum_t smt_enabled; ///< Indicate whether a plat form has SMT (simultaneous multithreading) enabled

char sa_list[MAX_SA_LIST_SIZE]; ///< String of comma separated list of Security Advisory IDs

time_t qe_iden_earliest_issue_date; ///< Earliest issue date of QEIdentity (UTC)
time_t qe_iden_latest_issue_date; ///< Latest issue date of QEIdentity (UTC)
time_t qe_iden_earliest_expiration_date; ///< Earliest expiration date of QEIdentity (UTC)
time_t qe_iden_tcb_level_date_tag; ///< The SGX TCB of the platform that generated the quote is not vulnerable
uint32_t qe_iden_tcb_eval_ref_num; ///< Lower number of the QEIdentity
sgx_ql_qv_result_t qe_iden_status; /// QEIdentity status
} sgx_ql_qv_supplemental_t;

#ifdef _MSC_VER
Expand Down
3 changes: 3 additions & 0 deletions core/build/headers/tlibc/wchar.h
View file
Original file line number Diff line number Diff line change
Expand Up @@ -127,6 +127,9 @@ int _TLIBC_CDECL_ wmemcmp(const wchar_t *, const wchar_t *, size_t);
wchar_t * _TLIBC_CDECL_ wmemcpy(wchar_t *, const wchar_t *, size_t);
wchar_t * _TLIBC_CDECL_ wmemmove(wchar_t *, const wchar_t *, size_t);
wchar_t * _TLIBC_CDECL_ wmemset(wchar_t *, wchar_t, size_t);
int _TLIBC_CDECL_ wcsncasecmp(const wchar_t *, const wchar_t *, size_t);
size_t _TLIBC_CDECL_ wcsnrtombs(char *__restrict, const wchar_t **__restrict, size_t, size_t, mbstate_t *__restrict);
size_t _TLIBC_CDECL_ mbsnrtowcs(wchar_t *__restrict, const char **__restrict, size_t, size_t, mbstate_t *__restrict);

int _TLIBC_CDECL_ swprintf(wchar_t *, size_t, const wchar_t *, ...);
int _TLIBC_CDECL_ vswprintf(wchar_t *, size_t, const wchar_t *, __va_list);
Expand Down

0 comments on commit 27c4310

Please sign in to comment.