mirror of
https://github.com/bytecodealliance/wasm-micro-runtime.git
synced 2025-05-07 12:16:24 +00:00

This PR integrates an Intel SGX feature called Intel Protection File System Library (IPFS) into the runtime to create, operate and delete files inside the enclave, while guaranteeing the confidentiality and integrity of the data persisted. IPFS can be referred to here: https://www.intel.com/content/www/us/en/developer/articles/technical/overview-of-intel-protected-file-system-library-using-software-guard-extensions.html Introduce a cmake variable `WAMR_BUILD_SGX_IPFS`, when enabled, the files interaction API of WASI will leverage IPFS, instead of the regular POSIX OCALLs. The implementation has been written with light changes to sgx platform layer, so all the security aspects WAMR relies on are conserved. In addition to this integration, the following changes have been made: - The CI workflow has been adapted to test the compilation of the runtime and sample with the flag `WAMR_BUILD_SGX_IPFS` set to true - Introduction of a new sample that demonstrates the interaction of the files (called `file`), - Documentation of this new feature
34 lines
922 B
Plaintext
34 lines
922 B
Plaintext
/*
|
|
* Copyright (C) 2019 Intel Corporation. All rights reserved.
|
|
* SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
|
|
*/
|
|
|
|
#define LIB_RATS 0
|
|
#define SGX_IPFS 0
|
|
|
|
enclave {
|
|
from "sgx_tstdc.edl" import *;
|
|
from "sgx_pthread.edl" import *;
|
|
from "sgx_wamr.edl" import *;
|
|
#if LIB_RATS != 0
|
|
from "rats.edl" import *;
|
|
#endif
|
|
#if SGX_IPFS != 0
|
|
from "sgx_tprotected_fs.edl" import *;
|
|
#endif
|
|
|
|
trusted {
|
|
/* define ECALLs here. */
|
|
public void ecall_handle_command(unsigned cmd,
|
|
[in, out, size=cmd_buf_size]uint8_t *cmd_buf,
|
|
unsigned cmd_buf_size);
|
|
public void ecall_iwasm_main([user_check]uint8_t *wasm_file_buf,
|
|
uint32_t wasm_file_size);
|
|
};
|
|
|
|
untrusted {
|
|
/* define OCALLs here. */
|
|
int ocall_print([in, string]const char* str);
|
|
};
|
|
};
|