Gramine v1.5, seeing a suplpemental data size mismatch #1474

mgild · 2023-07-25T15:41:31Z

mgild
Jul 25, 2023

On verifying a quote in gramine:v1.5 with azure:

Warning: Quote supplemental data size is different between DCAP QVL and QvE, please make sure you installed DCAP QVL and QvE from same release

Installation steps in dockerfile:

FROM gramineproject/gramine:v1.5

RUN curl -fsSLo /usr/share/keyrings/microsoft.asc https://packages.microsoft.com/keys/microsoft.asc
RUN echo "deb [arch=amd64 signed-by=/usr/share/keyrings/microsoft.asc] https://packages.microsoft.com/ubuntu/20.04/prod focal main" | \
    tee /etc/apt/sources.list.d/msprod.list

RUN apt-get update
RUN apt-get upgrade -y
RUN apt install -y az-dcap-client

Im producing this quote in a container which is running graminev1.4. Do containers that produce the quotes need to match the gramine version verifying the quotes?

kailun-qin · 2023-07-26T02:24:04Z

kailun-qin
Jul 26, 2023
Maintainer

Thanks for the report!

Warning: Quote supplemental data size is different between DCAP QVL and QvE, please make sure you installed DCAP QVL and QvE from same release

But this is basically a warning from DCAP QVL which indicates a supplemental data version mismatch between QVL and QvE (see https://github.com/intel/SGXDataCenterAttestationPrimitives/blob/e7604e02331b3377f3766ed3653250e03af72d45/QuoteVerification/dcap_quoteverify/sgx_dcap_quoteverify.cpp#L411-L421)?

I assume that you're running the quote verification on an SGX platform. Would you pls kindly check the installed versions of the related SGX libs in your env (via sudo apt list --installed | grep sgx)?

0 replies

mgild · 2023-07-26T18:45:25Z

mgild
Jul 26, 2023
Author

so I have

libsgx-ae-epid/unknown,now 2.19.100.3-focal1 amd64 [installed,upgradable to: 2.20.100.4-focal1]
libsgx-ae-id-enclave/unknown,now 1.16.100.2-focal1 amd64 [installed,upgradable to: 1.17.100.4-focal1]
libsgx-ae-le/unknown,now 2.19.100.3-focal1 amd64 [installed,upgradable to: 2.20.100.4-focal1]
libsgx-ae-pce/unknown,now 2.19.100.3-focal1 amd64 [installed,upgradable to: 2.20.100.4-focal1]
libsgx-ae-qe3/unknown,now 1.16.100.2-focal1 amd64 [installed,upgradable to: 1.17.100.4-focal1]
libsgx-ae-qve/unknown,now 1.16.100.2-focal1 amd64 [installed,upgradable to: 1.17.100.4-focal1]
libsgx-aesm-ecdsa-plugin/unknown,now 2.19.100.3-focal1 amd64 [installed,upgradable to: 2.20.100.4-focal1]
libsgx-aesm-epid-plugin/unknown,now 2.19.100.3-focal1 amd64 [installed,upgradable to: 2.20.100.4-focal1]
libsgx-aesm-launch-plugin/unknown,now 2.19.100.3-focal1 amd64 [installed,upgradable to: 2.20.100.4-focal1]
libsgx-aesm-pce-plugin/unknown,now 2.19.100.3-focal1 amd64 [installed,upgradable to: 2.20.100.4-focal1]
libsgx-aesm-quote-ex-plugin/unknown,now 2.19.100.3-focal1 amd64 [installed,upgradable to: 2.20.100.4-focal1]
libsgx-dcap-default-qpl/unknown,now 1.17.100.4-focal1 amd64 [installed]
libsgx-dcap-quote-verify/unknown,now 1.16.100.2-focal1 amd64 [installed,upgradable to: 1.17.100.4-focal1]
libsgx-enclave-common/unknown,now 2.19.100.3-focal1 amd64 [installed,upgradable to: 2.20.100.4-focal1]
libsgx-launch/unknown,now 2.19.100.3-focal1 amd64 [installed,upgradable to: 2.20.100.4-focal1]
libsgx-pce-logic/unknown,now 1.16.100.2-focal1 amd64 [installed,upgradable to: 1.17.100.4-focal1]
libsgx-qe3-logic/unknown,now 1.16.100.2-focal1 amd64 [installed,upgradable to: 1.17.100.4-focal1]
libsgx-urts/unknown,now 2.19.100.3-focal1 amd64 [installed,upgradable to: 2.20.100.4-focal1]
sgx-aesm-service/unknown,now 2.19.100.3-focal1 amd64 [installed,upgradable to: 2.20.100.4-focal1]

But I am doing quote verification via a copy of this module:

https://github.com/intel/SGXDataCenterAttestationPrimitives/blob/master/QuoteVerification/dcap_quoteverify/sgx-dcap-quoteverify-rs/src/lib.rs

Should I use a certain version of this rust module (some git tag I should check out before copying to my code?)

@kailun-qin

8 replies

mgild Aug 9, 2023
Author

tee_get_supplemental_data_version_and_size provides a size of 336
mem::size_of::<sgx_ql_qv_supplemental_t>() as u32 == 496

mgild Aug 9, 2023
Author

I do seem to need to install libsgx-dcap-quote-verify-dev myself given its not included in gramine 1.5. Is there a version of this I should use?

mgild Aug 9, 2023
Author

Ah from https://download.01.org/intel-sgx/sgx_repo/ubuntu/pool/main/devel/libsgx-dcap-quote-verify-dev/ i believe im using 1.17 here, I will try 1.16

mgild Aug 9, 2023
Author

I believe same for libsgx-dcap-default-qpl_1.16.100.2-focal1_amd64.deb

mgild Aug 9, 2023
Author

That fixed it :)

mgild · 2023-07-27T09:58:49Z

mgild
Jul 27, 2023
Author

Thanks so much @kailun-qin!

Also a bit of an aside, I want to help people test gramine related code on any platform. Is there any way people can run gramine-direct on mac m2 chips? (Or anything arm compatible just to test log output of logs of a gramine direct run)

2 replies

kailun-qin Jul 27, 2023
Maintainer

Is there any way people can run gramine-direct on mac m2 chips? (Or anything arm compatible just to test log output of logs of a gramine direct run)

Unfortunately, Gramine currently only works on the x86_64 architecture :).

mkow Jul 27, 2023
Maintainer

And ppc64, although not officially :) (see https://github.com/stefanberger/gramine4ppc64)

mgild · 2023-07-27T12:58:55Z

mgild
Jul 27, 2023
Author

Hm got it. For gramine-direct what’s the exact reason there, isn’t everything simulated? Running in a docker environment and using Rosetta is fine for me. I’m making a generic dev platform using gramine and would love to reduce the barrier for entry of mac users just for testing before launching their applications.

8 replies

dimakuv Jul 28, 2023

@mgild Very interesting. This is the source code where the error happens:

gramine/pal/src/host/linux-sgx/host_main.c

Lines 1147 to 1155 in 4de6aa5

    
           else if (!(values[CPUID_WORD_ECX] & (1 << 26))) 
        
               missing = "XSAVE"; 
        
           else if (!(values[CPUID_WORD_ECX] & (1 << 30))) 
        
               missing = "RDRAND"; 
        
           if (missing) { 
        
               log_error("Gramine with Linux-SGX backend requires %s CPU instruction(s). " 
        
                         "Please upgrade your hardware.", missing); 
        
               return -EINVAL; 
        
           }

According to https://en.wikipedia.org/wiki/CPUID#EAX=1:_Processor_Info_and_Feature_Bits, the xsave bit 26 stands for:

Extensible processor state save/restore: XSAVE, XRSTOR, XSETBV, XGETBV instructions

So, surprisingly, your Mac with Rosetta either doesn't emulate the aforementioned x86 instructions, or it doesn't expose that it supports these instructions in CPUID leaf 0x1.

mgild Jul 30, 2023
Author

If there is any workaround, I would love to get my users testing through the gramine stack @dimakuv

dimakuv Jul 31, 2023

@mgild This page says that Rosetta doesn't support some newer processor features, though it talks mostly about Intel AVX. I wonder if Rosetta also doesn't support Extended State Enumeration at all. Unfortunately, Gramine relies on the XSAVE feature, and I don't know how to work around this.

mgild Jul 31, 2023
Author

Is there a way for just gramine-direct to work?

dimakuv Jul 31, 2023

@mgild Gramine-direct also uses mbedTLS (e.g. for Encrypted Files), and the XSAVE is required for mbedTLS. So no.

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Gramine v1.5, seeing a suplpemental data size mismatch #1474

{{title}}

Replies: 4 comments 18 replies

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{title}}

Select a reply

Gramine v1.5, seeing a suplpemental data size mismatch #1474

mgild Jul 25, 2023

Replies: 4 comments · 18 replies

kailun-qin Jul 26, 2023 Maintainer

mgild Jul 26, 2023 Author

mgild Aug 9, 2023 Author

mgild Aug 9, 2023 Author

mgild Aug 9, 2023 Author

mgild Aug 9, 2023 Author

mgild Aug 9, 2023 Author

mgild Jul 27, 2023 Author

kailun-qin Jul 27, 2023 Maintainer

mkow Jul 27, 2023 Maintainer

mgild Jul 27, 2023 Author

dimakuv Jul 28, 2023

mgild Jul 30, 2023 Author

dimakuv Jul 31, 2023

mgild Jul 31, 2023 Author

dimakuv Jul 31, 2023

mgild
Jul 25, 2023

Replies: 4 comments 18 replies

kailun-qin
Jul 26, 2023
Maintainer

mgild
Jul 26, 2023
Author

mgild Aug 9, 2023
Author

mgild Aug 9, 2023
Author

mgild Aug 9, 2023
Author

mgild Aug 9, 2023
Author

mgild Aug 9, 2023
Author

mgild
Jul 27, 2023
Author

kailun-qin Jul 27, 2023
Maintainer

mkow Jul 27, 2023
Maintainer

mgild
Jul 27, 2023
Author

mgild Jul 30, 2023
Author

mgild Jul 31, 2023
Author