search

keystone-enclave / keystone

Keystone Enclave (QEMU + HiFive Unleashed)
Other
460 stars 131 forks source link

Access net device from inside enclave #458

Open ahmrr opened 1 month ago

ahmrr commented 1 month ago

Hello! Thank you for this wonderful project.

I wish to access a net device (SPI CAN bus) from within an enclave. I was looking at @grg-haas's mmio-peripherals branch; is using this version the only way to access a net device, or is there a more straightforward method—preferably one that allows me to use preexisting Linux SPI and CAN drivers?

I would greatly appreciate any help :)

its-valentinvp commented 1 week ago

Hey @ahmrr, If you want exclusive access to a device, https://github.com/keystone-enclave/keystone/pull/418 is the only way to do this now. Since the eyrie runtime is minimal to reduce the TCB, it does not have the functionality that some Linux drivers rely on (e.g. device tree parsing and timer functionality). So, your only option would be to port the Linux drivers to the eyrie runtime, which will be quite challenging. However, we (@f1bu and I) made a comment to https://github.com/keystone-enclave/keystone/pull/418, where we provided some changes to the PR and also shortly discussed how we did the claiming of a network card (on real hardware). Maybe this is helpful for you.

If you don't need exclusive access to the device and don't mind that the untrusted OS has access to it too, you can activate NET_SYSCALL, IO_SYSCALL or LINUX_SYSCALL in runtime/CMakeLists.txt to get support for some Linux syscalls in the EAPP. A list of available syscalls is in runtime/include/call/io_wrap.h, runtime/include/call/linux_wrap.h and runtime/include/call/net_wrap.h.

ahmrr commented 5 days ago

Thanks @its-valentinvp!

I have written a working driver since I opened the issue, but I do appreciate the extra insight. Your case study is interesting; thanks for documenting it!