Panic on Enclave Fatal Error

enclave-boundary/src/untrusted.rs

@@ -35,7 +35,7 @@ pub fn make_variable_length_ecall(
         }
 
         let mut outbuf = vec![0u8; outbuf_used];
-        match unsafe {
+        let result = unsafe {
             ecall_fcn(
                 eid,
                 &mut retval,
@@ -46,7 +46,20 @@ pub fn make_variable_length_ecall(
                 &mut outbuf_used,
                 &mut outbuf_retry_id,
             )
-        } {
+        };
+        if is_fatal_sgx_status(retval) {
+            panic!(
+                "Enclave reported fatal error: ecall retval: {:?}. Panicking to restart.",
+                retval
+            );
+        }
+        if is_fatal_sgx_status(result) {
+            panic!(
+                "Enclave reported fatal error: ecall returned {:?}. Panicking to restart.",
+                result
+            );
+        }
+        match result {
             sgx_status_t::SGX_SUCCESS => match retval {
                 sgx_status_t::SGX_ERROR_OUT_OF_MEMORY => continue,
                 sgx_status_t::SGX_SUCCESS => {
@@ -59,3 +72,16 @@ pub fn make_variable_length_ecall(
         }
     }
 }
+
+fn is_fatal_sgx_status(status: sgx_status_t) -> bool {
+    match status {
+        // SGX Fatal runtime errors
+        sgx_status_t::SGX_ERROR_INVALID_FUNCTION
+        | sgx_status_t::SGX_ERROR_OUT_OF_TCS
+        | sgx_status_t::SGX_ERROR_ENCLAVE_CRASHED
+        | sgx_status_t::SGX_ERROR_ECALL_NOT_ALLOWED
+        | sgx_status_t::SGX_ERROR_OCALL_NOT_ALLOWED
+        | sgx_status_t::SGX_ERROR_STACK_OVERRUN => true,
+        _ => false,
+    }
+}

fog/ledger/server/src/bin/router.rs

@@ -5,7 +5,7 @@ use std::env;
 use clap::Parser;
 use mc_attest_net::{Client, RaClient};
 use mc_common::logger::log;
-use mc_fog_ledger_enclave::{LedgerEnclave, LedgerSgxEnclave, ENCLAVE_FILE};
+use mc_fog_ledger_enclave::{LedgerSgxEnclave, ENCLAVE_FILE};
 use mc_fog_ledger_server::{LedgerRouterConfig, LedgerRouterServer};
 use mc_ledger_db::LedgerDB;
 use mc_watcher::watcher_db::WatcherDB;
@@ -53,21 +53,11 @@ fn main() {
         WatcherDB::open_ro(&config.watcher_db, logger.clone()).expect("Could not open watcher DB");
 
     let ias_client = Client::new(&config.ias_api_key).expect("Could not create IAS client");
-    let mut router_server = LedgerRouterServer::new(
-        config,
-        enclave.clone(),
-        ias_client,
-        ledger_db,
-        watcher_db,
-        logger.clone(),
-    );
+    let mut router_server =
+        LedgerRouterServer::new(config, enclave, ias_client, ledger_db, watcher_db, logger);
     router_server.start();
 
     loop {
         std::thread::sleep(std::time::Duration::from_millis(1000));
-        if enclave.get_identity().is_err() {
-            mc_common::logger::log::crit!(logger, "get_identity call to ledger enclave failed. Enclave may not be running or is not in a healthy state.");
-            panic!("Panicking to restart enclave");
-        }
     }
 }