INTERNALS

self tests on sgx2 system with patches: self tests
run make
then run self test binary

3 ioctls in kernel interface. expects ptrs to types as u64s. these aren't public interfaces in kernel. so we have to use internal kernel types. look at make file lines 36 and 37.

look at x86 calling conv. order of functions passed into registers.

encl_body copies from rdi to rsi. thus output will be same as input.

pages to create an enclave:
SECS page
each thread has a TCS page; requires other pages to build this, but they are implicit in TCS page
SIGSTRUCT page (transient, used to contain signature and ID info about enclave)

page = 4096 bytes (4k)

.tcs section above that (lines 10-24 in enclave_bootstrap.S)
contains encl_entry: when you jump in using this tcs structure, it will start executing at this encl_entry function (technically a named address).

.text section of binary = code and data

EENTER will always start execution at encl_entry

NSSA = number of SSAs. not modified by running.
CSSA is current SSA. this is incremented / decremented.

xsave_area = ??


asynch exit vs. eexit.
one of them changes the SSA area, the other doesn't.

stack grows in opp direction of everything else.
code in .c file is appended after the stack.

this enclave_boostrap.S + encl.c (with linking script. encl.lds determining layout of ELF binary) = ELF binary

--> look at encl.elf file (output as final binary before it's signed) with readelf.
this requires kernel patches.
copy nixOS config. modify slightly for our usage. then do install using that config. = fully fledges.
alternative: send PR to n's config to add user account adding own ssh key.

---------------------------

EXTERNALS

our use case: we'll pull in components are runtime, reassemble, tool to sign it.

make enclave:
1. create (SECS page)
2. add pages (mult times maybe) (TCS and TEXT pages must be done separately)
3. init

sgxsign.c simulates this (eadd and eextend are two steps of add pages). code to measure binary is mimicking kernel API for creating enclave. result is structure SIGSTRUCT = signing info, internal kernel structure but is documented as part of hw interface by intel.

sgx/arch.h
sgx_sigstruct header and body defined
this is one of the structures we need to port to rust, then generate this by signing a binary, able to pass it using same mem rep to kernel.

convert 3 sigstruct structures to rust.

#[repr(c)] means mem layout must be same as it would be in C.
packed means fields aren't aligned.

possible constructors:
load from file, give hash of binary into mrenclave.

ON THIS HEADER:
asm/sgx.h
call bindgen, which should resolve the macros. then fix it because it is ugly, so we clean up by hand.

IOCTLS take only one argument, so we must bundle into struct.

for add_pages, kernel is going through one at a time of pages we put in bundle. EADD then EEXTEND (16 times) are happening behind page. kernel interface simplifies this.

go one struct at a time.
SECS, TECS, SIGINFO, SIGSTRUCT pages.
create a repo and merge them one struct at a time.

assembly of enclave currently done at compile time, this is how we are able to run static binary is that we do assembly at runtime intstead.
static binary will be .c file and stuff in .s file will be broken in to components: TCS dynamically constructed at runtime, same for SSAs (one array of SSA per TCS). all the stuff from .s file we'll instead take in as input and dynamically generate. create enclave, measure, load at runtime.