Skip to content

Commit 15a2607

Browse files
committed
Auto merge of #56066 - jethrogb:jb/sgx-target, r=alexcrichton
Add SGX target to std and dependencies This PR adds tier 3 `std` support for the `x86_64-fortanix-unknown-sgx` target. ### Background Intel Software Guard Extensions (SGX) is an instruction set extension for x86 that allows executing code in fully-isolated *secure enclaves*. These enclaves reside in the address space of a regular user process, but access to the enclave's address space from outside (by e.g. the OS or a hypervisor) is blocked. From within such enclaves, there is no access to the operating system or hardware peripherals. In order to communicate with the outside world, enclaves require an untrusted “helper” program that runs as a normal user process. SGX is **not** a sandboxing technology: code inside SGX has full access to all memory belonging to the process it is running in. ### Overview The Fortanix SGX ABI (compiler target `x86_64-fortanix-unknown-sgx`) is an interface for Intel SGX enclaves. It is a small yet functional interface suitable for writing larger enclaves. In contrast to other enclave interfaces, this interface is primarly designed for running entire applications in an enclave. The interface has been under development since early 2016 and builds on Fortanix's significant experience running enclaves in production. Also unlike other enclave interfaces, this is the only implementation of an enclave interface that is nearly pure-Rust (except for the entry point code). A description of the ABI may be found at https://docs.rs/fortanix-sgx-abi/ and https://github.com/fortanix/rust-sgx/blob/master/doc/FORTANIX-SGX-ABI.md. The following parts of `std` are not supported and most operations will error when used: * `std::fs` * `std::process` * `std::net::UdpSocket` ### Future plans A separate PR (#56067) will add the SGX target to the rust compiler. In the very near future, I expect to upgrade this target to tier 2. This PR is just the initial support to make things mostly work. There will be more work coming in the future, for example to add interfaces to the native SGX primitives, implement unwinding, optimize usercalls. UDP and some form of filesystem support may be added in the future, but process support seems unlikely given the platform's constraints. ### Testing build 1. Install [Xargo](https://github.com/japaric/xargo): `cargo install xargo` 2. Create a new Cargo project, for example: `cargo new --bin sgxtest`. 3. Put the following in a file `Xargo.toml` next to your `Cargo.toml`: ```toml [target.x86_64-fortanix-unknown-sgx.dependencies.std] git = "https://github.com/jethrogb/rust" branch = "jb/sgx-target" ``` NB. This can be quite slow. Instead, you can have a local checkout of that branch and use `path = "/path/to/rust/src/libstd"` instead. Don't forget to checkout the submodules too! 4. Build: ```sh xargo build --target x86_64-fortanix-unknown-sgx ``` ### Testing execution Execution is currently only supported on x86-64 Linux, but support for Windows is planned. 1. Install pre-requisites. In order to test execution, you'll need to have a CPU with Intel SGX support. SGX support needs to be enabled in the BIOS. You'll also need to install the SGX driver and Platform Software (PSW) from [Intel](https://01.org/intel-software-guard-extensions). 2. Install toolchain, executor: ```sh cargo install sgxs-tools --version 0.6.0-rc1 cargo install fortanix-sgx-tools --version 0.1.0-rc1 ``` 3. Start the enclave: ```sh ftxsgx-elf2sgxs target/x86_64-fortanix-unknown-sgx/debug/sgxtest --heap-size 0x20000 --ssaframesize 1 --stack-size 0x20000 --threads 1 --debug sgxs-append -i target/x86_64-fortanix-unknown-sgx/debug/sgxtest.sgxs ftxsgx-runner target/x86_64-fortanix-unknown-sgx/debug/sgxtest.sgxs ```
2 parents a2fb99b + 7bea6a1 commit 15a2607

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

80 files changed

+4978
-246
lines changed

.gitmodules

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -61,10 +61,12 @@
6161
path = src/tools/clang
6262
url = https://github.com/rust-lang-nursery/clang.git
6363
branch = rust-release-80-v2
64-
6564
[submodule "src/doc/rustc-guide"]
6665
path = src/doc/rustc-guide
6766
url = https://github.com/rust-lang/rustc-guide.git
6867
[submodule "src/doc/edition-guide"]
6968
path = src/doc/edition-guide
7069
url = https://github.com/rust-lang-nursery/edition-guide
70+
[submodule "src/rust-sgx"]
71+
path = src/rust-sgx
72+
url = https://github.com/fortanix/rust-sgx

Cargo.lock

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -797,6 +797,14 @@ name = "foreign-types-shared"
797797
version = "0.1.1"
798798
source = "registry+https://github.com/rust-lang/crates.io-index"
799799

800+
[[package]]
801+
name = "fortanix-sgx-abi"
802+
version = "0.0.0"
803+
dependencies = [
804+
"compiler_builtins 0.0.0",
805+
"core 0.0.0",
806+
]
807+
800808
[[package]]
801809
name = "fs2"
802810
version = "0.4.3"
@@ -2773,6 +2781,7 @@ dependencies = [
27732781
"compiler_builtins 0.0.0",
27742782
"core 0.0.0",
27752783
"dlmalloc 0.0.0",
2784+
"fortanix-sgx-abi 0.0.0",
27762785
"libc 0.0.0",
27772786
"panic_abort 0.0.0",
27782787
"panic_unwind 0.0.0",

src/bootstrap/dist.rs

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -874,6 +874,7 @@ impl Step for Src {
874874
"src/rustc/compiler_builtins_shim",
875875
"src/rustc/libc_shim",
876876
"src/rustc/dlmalloc_shim",
877+
"src/rustc/fortanix-sgx-abi_shim",
877878
"src/libtest",
878879
"src/libterm",
879880
"src/libprofiler_builtins",

src/liblibc

Submodule liblibc updated 65 files

src/libpanic_abort/lib.rs

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -66,6 +66,12 @@ pub unsafe extern fn __rust_start_panic(_payload: usize) -> u32 {
6666
unsafe fn abort() -> ! {
6767
core::intrinsics::abort();
6868
}
69+
70+
#[cfg(target_env="sgx")]
71+
unsafe fn abort() -> ! {
72+
extern "C" { pub fn panic_exit() -> !; }
73+
panic_exit();
74+
}
6975
}
7076

7177
// This... is a bit of an oddity. The tl;dr; is that this is required to link

src/libpanic_unwind/lib.rs

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -62,7 +62,7 @@ cfg_if! {
6262
if #[cfg(target_os = "emscripten")] {
6363
#[path = "emcc.rs"]
6464
mod imp;
65-
} else if #[cfg(target_arch = "wasm32")] {
65+
} else if #[cfg(any(target_arch = "wasm32", target_env = "sgx"))] {
6666
#[path = "dummy.rs"]
6767
mod imp;
6868
} else if #[cfg(all(target_env = "msvc", target_arch = "aarch64"))] {

src/libstd/Cargo.toml

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -35,9 +35,12 @@ rustc_lsan = { path = "../librustc_lsan" }
3535
rustc_msan = { path = "../librustc_msan" }
3636
rustc_tsan = { path = "../librustc_tsan" }
3737

38-
[target.'cfg(all(target_arch = "wasm32", not(target_os = "emscripten")))'.dependencies]
38+
[target.'cfg(any(all(target_arch = "wasm32", not(target_os = "emscripten")), target_env = "sgx"))'.dependencies]
3939
dlmalloc = { path = '../rustc/dlmalloc_shim' }
4040

41+
[target.x86_64-fortanix-unknown-sgx.dependencies]
42+
fortanix-sgx-abi = { path = "../rustc/fortanix-sgx-abi_shim" }
43+
4144
[build-dependencies]
4245
cc = "1.0"
4346
build_helper = { path = "../build_helper" }

src/libstd/io/error.rs

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -184,7 +184,7 @@ pub enum ErrorKind {
184184
}
185185

186186
impl ErrorKind {
187-
fn as_str(&self) -> &'static str {
187+
pub(crate) fn as_str(&self) -> &'static str {
188188
match *self {
189189
ErrorKind::NotFound => "entity not found",
190190
ErrorKind::PermissionDenied => "permission denied",

0 commit comments

Comments
 (0)