一、前言

Intel SGX是Intel架构新的扩展, 在原有架构上增加了一组新的指令集和内存访问机制处理器，需要Intel 6代处理器及以上才支持。

二、环境准备

1、安装依赖

参考:https://github.com/intel/linux-sgx

使用以下命令安装构建SGX 驱动程序所需的工具：

sudo apt install dkms

使用以下命令安装构建SGX SDK所需的工具：

# Ubuntu 16.04
sudo apt-get install build-essential ocaml automake autoconf libtool wget python libssl-dev git cmake perl
# Ubuntu 18.04
sudo apt-get install build-essential ocaml ocamlbuild automake autoconf libtool wget python libssl-dev git cmake perl
# Ubuntu 20.04
sudo apt-get install build-essential ocaml ocamlbuild automake autoconf libtool wget python-is-python3 libssl-dev git cmake perl

2、BIOS设置

• 通过BIOS，打开SGX服务
• 通过BIOS，关闭SECURE BOOT

3、检查硬件

通过编译运行一个小程序判断环境是否支持SGX

git clone https://github.com/ayeks/SGX-hardware.git
cd SGX-hardware
gcc test-sgx.c -o test-sgx
./test-sgx

如果环境支持，则上述程序输出以下结果

...
Extended feature bits (EAX=07H, ECX=0H)
eax: 0 ebx: 29c6fbf ecx: 0 edx: 0
sgx available: 1

CPUID Leaf 12H, Sub-Leaf 0 of Intel SGX Capabilities (EAX=12H,ECX=0)
eax: 1 ebx: 0 ecx: 0 edx: 241f
sgx 1 supported: 1
sgx 2 supported: 0
MaxEnclaveSize_Not64: 1f
MaxEnclaveSize_64: 24
...

三、安装SGX

1、SGX驱动

1）下载SGX DCAP 驱动包

2）运行以下命令

sudo chmod 777 ./sgx_linux_x64_driver_1.36.bin
sudo ./sgx_linux_x64_driver_1.36.bin

2 、安装SGX PSW

从SGX仓库安装Debian包

1）添加仓库到源

echo 'deb [arch=amd64] https://download.01.org/intel-sgx/sgx_repo/ubuntu bionic main'| sudo tee /etc/apt/sources.list.d/intel-sgx.list

2）添加密钥到apt使用的可信密钥列表中，用于认证包

wget -qO - https://download.01.org/intel-sgx/sgx_repo/ubuntu/intel-sgx-deb.key | sudo apt-key add -

3）更新apt并安装包

sudo apt-get update

4）安装aptitude

sudo apt install aptitude

5）安装launch服务、基于EPID的认证服务以及algorithm agnostic服务

sudo aptitude install libsgx-launch libsgx-urts
sudo aptitude install libsgx-epid libsgx-urts
sudo aptitude install libsgx-quote-ex libsgx-urts

3 安装SGX SDK

1）下载 SGX SDK包

2）运行以下命令进行安装

建议安装在/opt/intel/里，否则需要在Makefile里修改

chmod 777 ./sgx_linux_x64_sdk_2.11.100.2.bin
./sgx_linux_x64_sdk_2.11.100.2.bin

3）设置环境变量

编辑环境变量。

vim ~/.bashrc

增加以下内容，{sgx_path}是上一步安装的位置。

export SGX_SDK={sgx_path}/sgxsdk
export PATH=$PATH:$SGX_SDK/bin:$SGX_SDK/bin/x64
export PKG_CONFIG_PATH=$PKG_CONFIG_PATH:$SGX_SDK/pkgconfig
if [ -z "$LD_LIBRARY_PATH" ]; then
     export LD_LIBRARY_PATH=$SGX_SDK/sdk_libs
else
     export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:$SGX_SDK/sdk_libs
fi

生效

source ~/.bashrc

四、测试

1、进入sdk安装路径下的SampleEnclave

cd {sgx_path}/sgxsdk/SampleCode/SampleEnclave

2、查看当前文件目录：

# ls
App  Enclave  Include  Makefile  README.txt

3、编译：

# make
....
The required memory is 0x3df000, 3964 KB.
Succeed.
SIGN =>  enclave.signed.so
The project has been built in debug hardware mode.

4、再次查看文件目录：

# ls
app  App  Enclave  enclave.signed.so  enclave.so  Include  Makefile  README.txt

5、运行：

# ./app
Checksum(0x0x7ffd6d822ff0, 100) = 0xfffd4143
Info: executing thread synchronization, please wait...  
Info: SampleEnclave successfully returned.
Enter a character before exit ...

五、完成

至此，SGX已经安装完成。
过程中如果一直用root用户进行，可能更加顺利。