linux-sgx: Implement SGX IPFS as POSIX backend for file interaction (#1489)
This PR integrates an Intel SGX feature called Intel Protection File System Library (IPFS) into the runtime to create, operate and delete files inside the enclave, while guaranteeing the confidentiality and integrity of the data persisted. IPFS can be referred to here: https://www.intel.com/content/www/us/en/developer/articles/technical/overview-of-intel-protected-file-system-library-using-software-guard-extensions.html Introduce a cmake variable `WAMR_BUILD_SGX_IPFS`, when enabled, the files interaction API of WASI will leverage IPFS, instead of the regular POSIX OCALLs. The implementation has been written with light changes to sgx platform layer, so all the security aspects WAMR relies on are conserved. In addition to this integration, the following changes have been made: - The CI workflow has been adapted to test the compilation of the runtime and sample with the flag `WAMR_BUILD_SGX_IPFS` set to true - Introduction of a new sample that demonstrates the interaction of the files (called `file`), - Documentation of this new feature
This commit is contained in:
Jämes Ménétrey
87
samples/file/src/CMakeLists.txt
Normal file
87
samples/file/src/CMakeLists.txt
Normal file
@ -0,0 +1,87 @@
|
||||
# Copyright (C) 2022 Intel Corporation. All rights reserved.
|
||||
# SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
|
||||
|
||||
cmake_minimum_required (VERSION 3.0)
|
||||
|
||||
if (NOT WAMR_BUILD_PLATFORM STREQUAL "windows")
|
||||
project (iwasm)
|
||||
else()
|
||||
project (iwasm C ASM)
|
||||
enable_language (ASM_MASM)
|
||||
endif()
|
||||
|
||||
################ runtime settings ################
|
||||
string (TOLOWER ${CMAKE_HOST_SYSTEM_NAME} WAMR_BUILD_PLATFORM)
|
||||
if (APPLE)
|
||||
add_definitions(-DBH_PLATFORM_DARWIN)
|
||||
endif ()
|
||||
|
||||
# Reset default linker flags
|
||||
set (CMAKE_SHARED_LIBRARY_LINK_C_FLAGS "")
|
||||
set (CMAKE_SHARED_LIBRARY_LINK_CXX_FLAGS "")
|
||||
|
||||
# WAMR features switch
|
||||
|
||||
# Set WAMR_BUILD_TARGET, currently values supported:
|
||||
# "X86_64", "AMD_64", "X86_32", "AARCH64[sub]", "ARM[sub]", "THUMB[sub]",
|
||||
# "MIPS", "XTENSA", "RISCV64[sub]", "RISCV32[sub]"
|
||||
if (NOT DEFINED WAMR_BUILD_TARGET)
|
||||
if (CMAKE_SYSTEM_PROCESSOR MATCHES "^(arm64|aarch64)")
|
||||
set (WAMR_BUILD_TARGET "AARCH64")
|
||||
elseif (CMAKE_SYSTEM_PROCESSOR STREQUAL "riscv64")
|
||||
set (WAMR_BUILD_TARGET "RISCV64")
|
||||
elseif (CMAKE_SIZEOF_VOID_P EQUAL 8)
|
||||
# Build as X86_64 by default in 64-bit platform
|
||||
set (WAMR_BUILD_TARGET "X86_64")
|
||||
elseif (CMAKE_SIZEOF_VOID_P EQUAL 4)
|
||||
# Build as X86_32 by default in 32-bit platform
|
||||
set (WAMR_BUILD_TARGET "X86_32")
|
||||
else ()
|
||||
message(SEND_ERROR "Unsupported build target platform!")
|
||||
endif ()
|
||||
endif ()
|
||||
|
||||
if (NOT CMAKE_BUILD_TYPE)
|
||||
set (CMAKE_BUILD_TYPE Release)
|
||||
endif ()
|
||||
|
||||
set (WAMR_BUILD_INTERP 1)
|
||||
set (WAMR_BUILD_AOT 1)
|
||||
set (WAMR_BUILD_JIT 0)
|
||||
set (WAMR_BUILD_LIBC_BUILTIN 1)
|
||||
|
||||
if (NOT MSVC)
|
||||
set (WAMR_BUILD_LIBC_WASI 1)
|
||||
endif ()
|
||||
|
||||
if (NOT MSVC)
|
||||
# linker flags
|
||||
set (CMAKE_EXE_LINKER_FLAGS "${CMAKE_EXE_LINKER_FLAGS} -pie -fPIE")
|
||||
if (NOT (CMAKE_C_COMPILER MATCHES ".*clang.*" OR CMAKE_C_COMPILER_ID MATCHES ".*Clang"))
|
||||
set (CMAKE_EXE_LINKER_FLAGS "${CMAKE_EXE_LINKER_FLAGS} -Wl,--gc-sections")
|
||||
endif ()
|
||||
set (CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -Wall -Wextra -Wformat -Wformat-security")
|
||||
if (WAMR_BUILD_TARGET MATCHES "X86_.*" OR WAMR_BUILD_TARGET STREQUAL "AMD_64")
|
||||
if (NOT (CMAKE_C_COMPILER MATCHES ".*clang.*" OR CMAKE_C_COMPILER_ID MATCHES ".*Clang"))
|
||||
set (CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -mindirect-branch-register")
|
||||
endif ()
|
||||
endif ()
|
||||
endif ()
|
||||
|
||||
# build out vmlib
|
||||
set (WAMR_ROOT_DIR ${CMAKE_CURRENT_LIST_DIR}/../../..)
|
||||
include (${WAMR_ROOT_DIR}/build-scripts/runtime_lib.cmake)
|
||||
|
||||
add_library(vmlib ${WAMR_RUNTIME_LIB_SOURCE})
|
||||
|
||||
################ application related ################
|
||||
include_directories(${CMAKE_CURRENT_LIST_DIR})
|
||||
include (${SHARED_DIR}/utils/uncommon/shared_uncommon.cmake)
|
||||
|
||||
add_executable (iwasm main.c ${UNCOMMON_SHARED_SOURCE})
|
||||
|
||||
if (APPLE)
|
||||
target_link_libraries (iwasm vmlib -lm -ldl -lpthread)
|
||||
else ()
|
||||
target_link_libraries (iwasm vmlib -lm -ldl -lpthread -lrt)
|
||||
endif ()
|
||||
117
samples/file/src/main.c
Normal file
117
samples/file/src/main.c
Normal file
@ -0,0 +1,117 @@
|
||||
/*
|
||||
* Copyright (C) 2022 Intel Corporation. All rights reserved.
|
||||
* SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
|
||||
*/
|
||||
|
||||
#include "wasm_export.h"
|
||||
#include "bh_read_file.h"
|
||||
|
||||
void
|
||||
print_usage(void)
|
||||
{
|
||||
fprintf(stdout, "Required arguments:\r\n");
|
||||
fprintf(stdout, " -f [path of wasm file] \n");
|
||||
fprintf(stdout, " -d [path of host directory] \n");
|
||||
}
|
||||
|
||||
int
|
||||
main(int argc, char *argv_main[])
|
||||
{
|
||||
static char global_heap_buf[512 * 1024];
|
||||
char *buffer, error_buf[128];
|
||||
const char *wasm_path = NULL, *wasi_dir = NULL;
|
||||
int opt;
|
||||
|
||||
wasm_module_t module = NULL;
|
||||
wasm_module_inst_t module_inst = NULL;
|
||||
wasm_exec_env_t exec_env = NULL;
|
||||
uint32 buf_size, stack_size = 8092, heap_size = 8092;
|
||||
uint32_t wasm_buffer = 0;
|
||||
|
||||
RuntimeInitArgs init_args;
|
||||
memset(&init_args, 0, sizeof(RuntimeInitArgs));
|
||||
|
||||
while ((opt = getopt(argc, argv_main, "hf:d:")) != -1) {
|
||||
switch (opt) {
|
||||
case 'f':
|
||||
wasm_path = optarg;
|
||||
break;
|
||||
case 'd':
|
||||
wasi_dir = optarg;
|
||||
break;
|
||||
case 'h':
|
||||
print_usage();
|
||||
return 0;
|
||||
case '?':
|
||||
print_usage();
|
||||
return 0;
|
||||
}
|
||||
}
|
||||
if (wasm_path == NULL || wasi_dir == NULL) {
|
||||
print_usage();
|
||||
return 0;
|
||||
}
|
||||
|
||||
init_args.mem_alloc_type = Alloc_With_Pool;
|
||||
init_args.mem_alloc_option.pool.heap_buf = global_heap_buf;
|
||||
init_args.mem_alloc_option.pool.heap_size = sizeof(global_heap_buf);
|
||||
|
||||
if (!wasm_runtime_full_init(&init_args)) {
|
||||
printf("Init runtime environment failed.\n");
|
||||
return -1;
|
||||
}
|
||||
|
||||
buffer = bh_read_file_to_buffer(wasm_path, &buf_size);
|
||||
|
||||
if (!buffer) {
|
||||
printf("Open wasm app file [%s] failed.\n", wasm_path);
|
||||
goto fail;
|
||||
}
|
||||
|
||||
module = wasm_runtime_load(buffer, buf_size, error_buf, sizeof(error_buf));
|
||||
if (!module) {
|
||||
printf("Load wasm module failed. error: %s\n", error_buf);
|
||||
goto fail;
|
||||
}
|
||||
|
||||
wasm_runtime_set_wasi_args_ex(module, &wasi_dir, 1, NULL, 0, NULL, 0, NULL,
|
||||
0, 0, 1, 2);
|
||||
|
||||
module_inst = wasm_runtime_instantiate(module, stack_size, heap_size,
|
||||
error_buf, sizeof(error_buf));
|
||||
|
||||
if (!module_inst) {
|
||||
printf("Instantiate wasm module failed. error: %s\n", error_buf);
|
||||
goto fail;
|
||||
}
|
||||
|
||||
exec_env = wasm_runtime_create_exec_env(module_inst, stack_size);
|
||||
if (!exec_env) {
|
||||
printf("Create wasm execution environment failed.\n");
|
||||
goto fail;
|
||||
}
|
||||
|
||||
if (wasm_application_execute_main(module_inst, 0, NULL)) {
|
||||
printf("Main wasm function successfully finished.\n");
|
||||
}
|
||||
else {
|
||||
printf("call wasm function main failed. error: %s\n",
|
||||
wasm_runtime_get_exception(module_inst));
|
||||
goto fail;
|
||||
}
|
||||
|
||||
fail:
|
||||
if (exec_env)
|
||||
wasm_runtime_destroy_exec_env(exec_env);
|
||||
if (module_inst) {
|
||||
if (wasm_buffer)
|
||||
wasm_runtime_module_free(module_inst, wasm_buffer);
|
||||
wasm_runtime_deinstantiate(module_inst);
|
||||
}
|
||||
if (module)
|
||||
wasm_runtime_unload(module);
|
||||
if (buffer)
|
||||
BH_FREE(buffer);
|
||||
wasm_runtime_destroy();
|
||||
return 0;
|
||||
}
|
||||
Reference in New Issue
Block a user