diff --git a/doc/linux_sgx.md b/doc/linux_sgx.md index 935a35ac..ee4fbefc 100644 --- a/doc/linux_sgx.md +++ b/doc/linux_sgx.md @@ -17,8 +17,6 @@ cmake .. make ``` -**Note:** By default, the generated SGX application assumes it is signed with production key and running on simulation mode. In order to build a debug enclave on hardware-based SGX platform, execute `make SGX_DEBUG=1 SGX_MODE=HW` instead. - This builds two libraries required by SGX application: - libvmlib.a for Enclave part - libvmlib_untrusted.a for App part @@ -32,6 +30,8 @@ cd enclave-sample make ``` +**Note:** By default, the generated SGX application assumes it is signed with production key and running on simulation mode. The user can explicitly specify the relative variables in commandline to overwrite the default settings. For example, to build a debug enclave, please build the enclave with `make SGX_DEBUG=1`. To build the enclave running on a hardware-based SGX platform, execute `make SGX_MODE=HW`. + The binary file iwasm will be generated. To run the sample: ``` Bash diff --git a/product-mini/platforms/linux-sgx/enclave-sample/App/README.md b/product-mini/platforms/linux-sgx/enclave-sample/App/README.md index ee2cf492..78d8b25a 100644 --- a/product-mini/platforms/linux-sgx/enclave-sample/App/README.md +++ b/product-mini/platforms/linux-sgx/enclave-sample/App/README.md @@ -1,53 +1,48 @@ -# WAMR as an Enclave Runtime for Rune +# Running WAMR as an [Enclave Runtime](https://github.com/alibaba/inclavare-containers/blob/master/docs/design/terminology.md#enclave-runtime) for [Inclavare Containers](https://github.com/alibaba/inclavare-containers) -## Build WAMR vmcore (iwasm) for Linux-SGX +In order to establish with `rune`, a novel OCI Runtime for spawning and running enclaves in containers, it is required to implement an [enclave runtime PAL](https://github.com/alibaba/inclavare-containers/blob/master/docs/design/terminology.md#enclave-runtime-pal) to make the communications with WAMR. -Please follow [this guide](https://github.com/bytecodealliance/wasm-micro-runtime/blob/main/doc/linux_sgx.md#build-wamr-vmcore-iwasm-for-linux-sgx) to build iwasm as the prerequisite. +With the assist of `rune`, WAMR is brought to the cloud-native ecosystem beyond the basis. This is the so-called term "WAMR enclave runtime". -Then build enclave image and sign it: +This guide will provide the information about the build, integration and deployment for WAMR enclave runtime. Eventually, the resulting docker image will be launched by `rune`, and the WARM application as the entrypoint of docker image will run in Intel SGX enclave with the hardware-enforced isolation and cryptographically data protection. -```shell -cd enclave-sample -make -/opt/intel/sgxsdk/bin/x64/sgx_sign sign -key Enclave/Enclave_private.pem -enclave enclave.so -out enclave.signed.so -config Enclave/Enclave.config.xml -``` +## Build WAMR vmcore (iwasm) and enclave image -The generated enclave.signed.so is required by PAL. +Please follow [this guide](https://github.com/bytecodealliance/wasm-micro-runtime/blob/main/doc/linux_sgx.md#build-wamr-vmcore-iwasm-for-linux-sgx) to build iwasm and enclave image as the prerequisite. + +The generated enclave image enclave.signed.so will be consumed by WAMR enclave runtime mentioned below. --- -## Build PAL dynamically linked shared object - -To build WAMR as an Enclave Runtime for [Inclavare Containers](https://github.com/alibaba/inclavare-containers), we should implement the [PAL API v2](https://github.com/alibaba/inclavare-containers/blob/master/rune/libenclave/internal/runtime/pal/spec_v2.md) in WAMR for rune to call the PAL to create the enclave with WAMR and run applications. +## Build and install the PAL of WAMR enclave runtime ```shell g++ -shared -fPIC -o libwamr-pal.so App/*.o libvmlib_untrusted.a -L/opt/intel/sgxsdk/lib64 -lsgx_urts -lpthread -lssl -lcrypto cp ./libwamr-pal.so /usr/lib/libwamr-pal.so ``` -Note: Assuming `/opt/intel/sgxsdk/` is where you installed the SGX SDK. - --- ## Build WAMR application -To Build a WAMR application, please refer to [this guide](https://github.com/bytecodealliance/wasm-micro-runtime/blob/main/doc/build_wasm_app.md#build-wasm-applications) - -To run a WAMR application with Intel SGX enclave by `rune`, please refer to [this guide](https://github.com/bytecodealliance/wasm-micro-runtime#build-wamrc-aot-compiler) to generate wamrc AoT compiler, and then refer to [this guide](https://github.com/bytecodealliance/wasm-micro-runtime/blob/main/doc/build_wasm_app.md#compile-wasm-to-aot-module) to compile the `.wasm` file to `.aot` file. - -Note: the AoT file must be generated using --size-level=1 to set a bigger code size, e.g, +As the prerequisite, please +- refer to [this step](https://github.com/bytecodealliance/wasm-micro-runtime/blob/main/doc/build_wasm_app.md#prepare-wasm-building-environments) to install wasi-sdk. Note that the binaries of wasi-sdk must be installed at `/opt/wasi-sdk/bin/`. +- refer to [this guide](https://github.com/bytecodealliance/wasm-micro-runtime#build-wamrc-aot-compiler) to generate wamrc AoT compiler. +The sample WAMR application test.c is provided in [this guide](https://github.com/bytecodealliance/wasm-micro-runtime/blob/main/doc/build_wasm_app.md#build-wasm-applications). Don't forget to compile the `.wasm` file to `.aot` file: ```shell -wamrc --size-level=1 -o test.aot test.wasm +wamrc -sgx -o test.aot test.wasm ``` +The generated test.aot is the WAMR application launched by WAMR enclave runtime. + --- ## Build WAMR docker image Under the `enclave-sample` directory, to create the WAMR docker images to load the `enclave.signed.so` and target application wasm files, please type the following commands to create a `Dockerfile`: -For centos: +For CentOS: ```shell cat >Dockerfile <