Enclave creation failure #34
Comments
|
hm, this is an issue with the Top of my head, try this: $ dmesg | tail
$ sudo service aesmd status
$ sudo service aesmd stop
$ sudo serivce aesmd start
$ sudo service aesmd statusIf that doesn't work, you might want to check the SDK and driver are of compatible versions and you don't have the sgx-sdk Ubuntu packages installed? |
|
see also here for the error code you get: Did you install the SGX driver using |
|
Thanks for the prompt response. dmesg | tail resulted in: We tried restarting aesmd, didn't help. We installed SGX driver using We do not have /dev/isgx. |
Hm that's the problem. This means you don't have a working SGX driver running. Are you even sure your machine supports SGX? See eg https://github.com/ayeks/SGX-hardware
This is the output of the install_sdk.sh script. The driver should normally output "SGX driver succesfully installed". But even if it outputs this text, it doesn't mean everything is always okay as there's no error checking in the script.
There's nothing SGX related here it seems. To see if there's any error messages from the SGX driver or so, try (with reference output on my machine): |
Really sorry, my bad.
My device is a Dell XPS 13 9360 (processor: Intel® Core™ i5-8250U) and it does support SGX (ayeks/SGX-hardware#16). The issue was that by default SGX is disabled in the BIOS, so on enabling it there, this problem was solved and But I realize the original issue has been solved, so thank you for that. But is there a workaround for my CPU not supporting RTM, or am I doomed? |
|
Hi akkapakasaikiran, Glad to hear your original issue got solved and you can run SGX enclaves on your system! Some further guidance below:
The "Device is already opened" dmesg error is thrown by the sgx-step driver if you try to open the driver several times w/o closing (at the moment only one sgx-step app is supported at a time), but I figure it's no problem as you seem to have figured it out :) In your dmesg output you do seem to have a kernel panic crash, prob because of the illegal instruction crash and the device is not properly closed etc. Make sure to reboot your machine when you see kernel panics in dmesg. Also make sure to pass the required kernel boot command line arguments as described in the README.
Yes, the Foreshadow app is unoptimized and uses TSX by default, but it also supports an elementary PoC mode w/o TSX. Be aware: this is a highly unoptimized proof-of-concept, only showcasing the general concept and suffering from a relatively low success rate. However, after running the PoC a few times, you should see leakage if your CPU is vulnerable to Foreshadow and has not been patched with recent microcode that flushes L1D cache on enclave entry. See also issue #13 . Your i5-8250U Kaby Lake R CPU should be vulnerable to Foreshadow, I think. You can disable microcode updates from Linux boot with the Hope this helps! |
I see. I had a look at issue #13. For me, The line I added in /etc/default/grub was I am attaching some runs of We are doing this in the context of a project to understand Foreshadow and show a demo. We are trying to find devices which support TSX, but could you suggest (relatively easy) alternate approaches to show that Foreshadow works, maybe even other PoCs if you don't mind. I guess you can close this issue though. Thanks! |
Yes your CPU is indeed vulnerable to Foreshadow.
Yes, boot-time ucode updates are disabled this way. You can check the current ucode level of the CPU by means of
Yes, this seems to indicate your microcode is flushing L1D on enclave exit so there's no leakage. Regarding the noise, erratice outputs, this Foreshadow app is a bit hacky and esp the Flush+Reload channel is not optimized, which can lead to errors in the output (esp when using the signal handler non-TSX approach).
Cool project! TSX can generally help for exception-based transient-execution attacks like Foreshadow, but it's not necessary and will not fix your ucode problem here. My advice: first get Foreshadow to work outside of SGX, then the microcode will not flush L1D cache and it should work. This should be simple: e.g., replace the enclave ecall with a normal function call just as a proof-of-concept. Alternatively, for a bit cleaner and non-SGX Foreshadow proof-of-concept, have a look at our overview paper and website (https://transient.fail/). The corresponding Foreshadow (aka "Meltdown-P") PoC is here: https://github.com/IAIK/transientfail/tree/master/pocs/meltdown/P
Okay, closing as this is not an issue in SGX-Step, but feel free to follow-up or let know how it goes ^^ |
Thanks a lot! |
|
hm, in pocs/libpte/module try |
|
Hi, jovanbulck.
That worked! Now when I did I tried printing out It feels like flush-and-reload isn't working only. What may I be doing wrong? Should I open an issue in transientfail (rather than commenting here)? Thanks. |
|
HI akkapakasaikiran,
Yes, best to open an issue in the transientfail repo for issues in that project. Meanwhile I quickly hacked together a PoC to demonstrate Foreshadow w/o entering the enclave, as I suggested earlier:
You can see it here (set SIM_ENCLAVE to 1): As I said, the F+R implementation in libsgxstep is unoptimized and you may get some noise, but after a few runs you should clearly see FS working ^^ Hope it helps! Let me know how it turns out for you. |
|
jovanbulck, It works like a charm! I can't thank you enough. Really really grateful for all the help you've provided over the past few days. To think you went ahead and added a commit for our issue is heartwarming. Thanks a lot! |
|
Glad to hear it worked out! Happy hacking :-) |
Hey, we're currently trying to build the 'foreshadow' app but when we run the makefile we get this error:
[main.c] Creating enclave...
Error calling enclave at main.c:153 (rv=0x2006)
Makefile:48: recipe for target 'run' failed
make: *** [run] Aborted
We followed the instructions from the README.md of sgx-step and then executed make run in app/foreshadow.
This is a slight time-critical issue, @jovanbulck we'd appreciate it a lot if you could help us out. Thanks!
The text was updated successfully, but these errors were encountered: