incubator-teaclave-sgx-sdk
incubator-teaclave-sgx-sdk copied to clipboard
Using std Aware Cargo
"std Aware Cargo" (https://github.com/rust-lang/wg-cargo-std-aware) is one of the most important building blocks for Teaclave SGX SDK. With this, we can build SGX enclave without worry about the complexity brought by Xargo or no-std Cargo. However this is a long-term plan for Cargo, which doesn't gain higher priority from the community.
Recently, I found that they already has an MVP implementation (https://github.com/rust-lang/wg-cargo-std-aware#mvp-implementation). This supports an option called build-std to build std/core/compiler-builtins from sources. However, the MVP implementation only partially solves our issue. I didn't see any further plan further.
However, I found the build-std option may good enough for us. I created a repository to show the possibility of using it: https://github.com/mssun/build-std.
If you're interested in this, please help me to figure out if there're any potential difficulties of using build-std.
I think the build-std option will improve this SDK greatly, which will helps in stuff like removing the std::prelude::v1::* from SGX-ported crates. So I will give it a shot this weekend 😄
@mssun thanks! i'll create a branch for rust-sgx-sdk, based on your build-std repo :-)
Related tracking issue / discussion: https://github.com/rust-lang/wg-cargo-std-aware/issues/3
I happened to give this a try and built a drop-in replacement for std, see https://github.com/yaxitech/incubator-teaclave-sgx-sdk/commit/41ae223d6458db488b938927015c643720b416ef. I can build an internal project that depends on things like reqwest just fine with the resulting sysroot. The only patch I have to apply is to remove the cdylib crate-type from hyper.
Of course the result cannot actually run as syscalls get linked in from glibc via the libc crate, heavily used by mio and socket2. Such crates either still have to get adapted "sgx-world-style" or be provided with a libc replacement / extension that builds on ocalls or whatever is appropriate for the required syscall functions.
(By the way, this is basically a duplicate of #75.)
@cschramm Thank you very much for your detailed problem analysis and test report.
I plan to support three build strategies in the next release:
no_std- build-std in
xargo(usingxargo build) - build-std in
cargo(usingcargo-std-aware)
In my current work in progress, most of the base crates builds are good using build-std build strategy, e.g. mio, serde, rustls, etc.
But compatibility is still a tricky issue, e.g., the problem mentioned in your report, SGX unsupported instructions (cpuid, syscall, etc.).
Compatibility issues that I often encounter in my testing.
libc::syscall- unsupported
libcapi (not implemented via ocall insgx_libc) cpuidinstruction
For incompatible third-party crates, it can be resolved by the following ways:
- Provide a compatible API.
- Manually port the third-party crates to adapt to SGX env, and then override the dependent crate on crate.io with
[patch]in Cargo.toml.
@cschramm @PiDelport teaclave-sgx-sdk v2.0.0(https://github.com/apache/incubator-teaclave-sgx-sdk/tree/v2.0.0-preview) already supports compiling enclave with cargo-std-aware.