Apache Teaclave SGX SDK

Apache Teaclave™ SGX SDK is a Rust-based development environment for building Intel SGX (Software Guard Extensions) applications. It allows developers to create secure, privacy-preserving enclaves using Rust's safety and performance features.

Key features include:

• Support for modern Rust ecosystems like Tokio and Tonic directly within enclaves.
• A lightweight architecture that refactors Intel's SGX SDK using Rust.
• A robust testing framework and a well-tested sgx_tstd standard library.
• High compatibility with most Rust crates without requiring modifications.

libbacktrace is a C library used to produce symbolic backtraces in C/C++ programs. It is commonly used to print detailed backtraces during error handling or to collect profiling information.

To use the library:

1. Include the backtrace.h header in your project.
2. Link the libbacktrace library into your program or library.

Supported executable formats (as of January 2018) include ELF, PE/COFF, and XCOFF with DWARF debugging information. The library relies on the C++ unwind API provided by GCC.

Performance

hashbrown is significantly faster than the previous Rust standard library implementation (pre-1.36). It uses SIMD lookups to scan multiple hash entries in parallel and has lower memory overhead (approximately 1 byte per entry instead of 8).

Security (HashDoS)

By default, hashbrown uses AHash, which is much faster than the standard library's SipHash. However, AHash does not provide the same level of HashDoS resistance as SipHash. If your application requires protection against HashDoS attacks, you should consider using a different hasher.

The SGX system is partitioned into two domains enforced by hardware. Understanding this asymmetry is critical for security: the enclave can read host memory, but the host cannot read enclave memory. Therefore, the primary security hazard is untrusted input coming from the host into the enclave.

Note: The SDK provides a trusted std and ergonomic Rust bindings, but it does not protect against microarchitectural side-channel attacks (e.g., cache timing, L1TF) or physical attacks beyond memory encryption. These are platform-level responsibilities.

The sgx_cov mechanism automates the collection of coverage data through the following lifecycle:

1. Data Injection: An on exit function is injected using the global_dtor macro, which invokes sgx_cov::cov_writeout().
2. Compile Time: .gcno files are generated at the RustEnclave_Out_Path.
3. Runtime: .gcna files are generated at the RustEnclave_Out_Path.
4. Reporting: Running make gen_cov_report processes the .gcno and .gcna files to produce an HTML report.

When using Tokio in an enclave, you must ensure the number of Thread Control Structures (TCS) is correctly configured.

Using #[tokio::main]

By default, #[tokio::main] creates a worker pool with a number of threads equal to the logical core count. Because 1 TCS is always reserved for the initializer thread, your total TCSnum must be logical core count + 1.

Example: On a server with 128 logical cores, you must set TCSnum to 129 to run the server enclave natively.

Using tokio::runtime::Builder

For more granular control, use tokio::runtime::Builder. This allows you to explicitly set the number of worker threads. The required TCSnum will be worker_threads + 1.

Example: Setting .worker_threads(32) requires a TCSnum of 33.

Tonic (gRPC) and Tokio (async runtime) are supported within the enclave. To use them, add the following dependencies to your Cargo.toml:

[dependencies]
prost = "0.9"
tokio = { version = "1.0", features = ["rt-multi-thread", "time", "fs", "macros", "net"] }
tonic = { version = "0.6.2", features = ["tls", "compression"]  }

[build-dependencies]
tonic-build = { version = "0.6.2", features = ["prost", "compression"] }

You can generate coverage reports using the make system. The process involves running the application with the COV=1 flag and then generating the report.

Standard Build

$ COV=1 make run
$ make gen_cov_report

Using cargo-std

If your build uses cargo-std, set the BUILD_STD environment variable:

$ BUILD_STD=cargo COV=1 make run
$ BUILD_STD=cargo make gen_cov_report

Using xargo

If your build uses xargo, set the BUILD_STD environment variable:

$ BUILD_STD=xargo COV=1 make run
$ BUILD_STD=xargo make gen_cov_report

After running these commands, open html/index.html to view the coverage results.

On HP-UX, libunwind must be built using GCC. Note that unwinding of 32-bit (ILP32) binaries is currently not supported.

Use the following configuration to enable 64-bit mode via -mlp64:

$ ./configure CFLAGS="-g -O2 -mlp64" CXXFLAGS="-g -O2 -mlp64"