Veracruz working on IceCap RealmOS in CCA

execution-engine/src/engines/mod.rs

@@ -14,3 +14,11 @@ pub mod strace;
 pub(crate) mod wasmi;
 #[cfg(feature = "std")]
 pub(crate) mod wasmtime;
+#[cfg(all(feature = "icecap", not(feature = "icecap-cca")))]
+pub mod icecap;
+#[cfg(feature = "icecap-cca")]
+pub mod icecap_cca;
+#[cfg(feature = "linux")]
+pub mod linux;
+#[cfg(feature = "nitro")]
+pub mod nitro;

icecap-runtime-manager/Cargo.toml

@@ -4,6 +4,8 @@ version = "0.3.0"
 edition = "2018"
 
 [features]
+icecap-lkvm = []
+icecap-lkvm_realm = []
 icecap-qemu = []
 
 [dependencies]

icecap-runtime-manager/src/main.rs

@@ -24,9 +24,33 @@ use icecap_core::{
 };
 use icecap_start_generic::declare_generic_main;
 use icecap_std_external;
-use runtime_manager::common_runtime::CommonRuntime;
+use runtime_manager::{
+    common_runtime::CommonRuntime,
+    managers::session_manager::init_session_manager,
+};
+
+use veracruz_utils::{
+    runtime_manager_message::{ RuntimeManagerRequest, RuntimeManagerResponse, Status },
+};
+
 use serde::{Deserialize, Serialize};
 
+use core::fmt::{self, Write};
+use icecap_core::ring_buffer::*;
+
+pub(crate) struct Writer<'a>(pub &'a mut BufferedRingBuffer);
+
+macro_rules! out {
+    ($dst:expr, $($arg:tt)*) => (Writer($dst).write_fmt(format_args!($($arg)*)).unwrap());
+}
+
+impl fmt::Write for Writer<'_> {
+    fn write_str(&mut self, s: &str) -> fmt::Result {
+        self.0.tx(s.as_bytes());
+        Ok(())
+    }
+}
+
 mod icecap_runtime;
 
 declare_generic_main!(main);
@@ -40,48 +64,50 @@ struct Config {
 
 #[derive(Debug, Clone, Serialize, Deserialize)]
 struct Badges {
-    virtio_console_server_ring_buffer: Badge,
+    virtio_console_server_tx: Badge,
+    virtio_console_server_rx: Badge,
+    //virtio_console_server_ring_buffer: Badge,
 }
 
 fn main(config: Config) -> Fallible<()> {
     // TODO why do we need this?
     icecap_runtime_init();
-
-    debug_println!("icecap-realmos: initializing...");
-
     // enable ring buffer to serial-server
-    let virtio_console_client =
-        RingBuffer::unmanaged_from_config(&config.virtio_console_server_ring_buffer);
-    virtio_console_client.enable_notify_read();
-    virtio_console_client.enable_notify_write();
-    debug_println!("icecap-realmos: enabled ring buffer");
-
+    let mut virtio_console_client = BufferedRingBuffer::new(
+        RingBuffer::unmanaged_from_config(
+            &config.virtio_console_server_ring_buffer,
+        )
+    );
     debug_println!("icecap-realmos: running...");
     RuntimeManager::new(
         virtio_console_client,
         config.event_nfn,
-        config.badges.virtio_console_server_ring_buffer,
+        config.badges.virtio_console_server_tx,
+        config.badges.virtio_console_server_rx,
     )
     .run()
 }
 
 struct RuntimeManager {
-    channel: RingBuffer,
+    channel: BufferedRingBuffer,
     event: Notification,
-    virtio_console_server_ring_buffer_badge: Badge,
+    virtio_console_server_tx: Badge,
+    virtio_console_server_rx: Badge,
     active: bool,
 }
 
 impl RuntimeManager {
     fn new(
-        channel: RingBuffer,
+        channel: BufferedRingBuffer,
         event: Notification,
-        virtio_console_server_ring_buffer_badge: Badge,
+        virtio_console_server_tx: Badge,
+        virtio_console_server_rx: Badge,
     ) -> Self {
         Self {
             channel: channel,
             event: event,
-            virtio_console_server_ring_buffer_badge: virtio_console_server_ring_buffer_badge,
+            virtio_console_server_tx: virtio_console_server_tx,
+            virtio_console_server_rx: virtio_console_server_rx,
             active: true,
         }
     }
@@ -93,57 +119,45 @@ impl RuntimeManager {
         let mut runtime = CommonRuntime::new(&icecap_runtime);
         loop {
             let badge = self.event.wait();
-            if badge & self.virtio_console_server_ring_buffer_badge != 0 {
-                self.process(&mut runtime)?;
-                self.channel.enable_notify_read();
-                self.channel.enable_notify_write();
-
-                if !self.active {
-                    return Ok(());
-                }
+            if badge &  self.virtio_console_server_rx != 0 {
+                let received_buffer = self.receive_buffer()?;
+                let response_buffer = runtime.decode_dispatch(&received_buffer)
+                    .map_err(|e| format_err!("Failed to dispatch request: {}", e))?;
+                debug_println!("IceCap Runtime Manager::main_loop received:{:02x?}", response_buffer);
+                self.send_buffer(&response_buffer)?;
+
+                self.channel.rx_callback();
             }
+            self.channel.tx_callback();
         }
     }
 
-    fn process(&mut self, runtime: &mut CommonRuntime) -> Fallible<()> {
-        // recv request if we have a full request in our ring buffer
-        if self.channel.poll_read() < size_of::<u32>() {
-            return Ok(());
+    pub fn receive_buffer(&mut self) -> Result<Vec<u8>, Error> {
+        let mut raw_header = vec![];
+        while raw_header.len() < size_of::<u32>() {
+            if let Some(raw) = self.channel.rx() {
+                raw_header = [&raw_header[..], &raw[..]].concat();
+            }
+        }
+        let mut raw_request = vec![];
+        //header containers part of the request
+        if raw_header.len() > size_of::<u32>() {
+            raw_request = raw_header[size_of::<u32>()..].to_vec();
         }
-        let mut raw_header = [0; size_of::<u32>()];
-        self.channel.peek(&mut raw_header);
-        let header = bincode::deserialize::<u32>(&raw_header)
+        let header = bincode::deserialize::<u32>(&raw_header[..size_of::<u32>()])
             .map_err(|e| format_err!("Failed to deserialize request: {}", e))?;
         let size = usize::try_from(header)
             .map_err(|e| format_err!("Failed to deserialize request: {}", e))?;
-
-        if self.channel.poll_read() < size_of::<u32>() + size {
-            return Ok(());
+        while raw_request.len() < size {
+            if let Some(raw) = self.channel.rx() {
+                raw_request = [&raw_request[..], &raw[..]].concat();
+            }
         }
-        let mut raw_request = vec![0; usize::try_from(header).unwrap()];
-        self.channel.skip(size_of::<u32>());
-        self.channel.read(&mut raw_request);
-        // let request = bincode::deserialize::<RuntimeManagerRequest>(&raw_request)
-        //     .map_err(|e| format_err!("Failed to deserialize request: {}", e))?;
-
-        // process requests
-        //let response = self.handle(request)?;
-        let response_buffer = runtime
-            .decode_dispatch(&raw_request)
-            .map_err(|err| format_err!("runtime.decode_dispatch failed: {}", err))?;
-
-        // send response
-        // let raw_response = bincode::serialize(&response_buffer)
-        //     .map_err(|e| format_err!("Failed to serialize response: {}", e))?;
-        let raw_header = bincode::serialize(&u32::try_from(response_buffer.len()).unwrap())
-            .map_err(|e| format_err!("Failed to serialize response: {}", e))?;
-
-        self.channel.write(&raw_header);
-        self.channel.write(&response_buffer);
-
-        self.channel.notify_read();
-        self.channel.notify_write();
+        Ok(raw_request)
+    }
 
+    pub fn send_buffer(&mut self, buffer: &[u8]) -> Result<(), Error> {
+        self.channel.tx(&buffer);
         Ok(())
     }
 }

icecap-veracruz-server/src/server.rs

@@ -350,6 +350,43 @@ impl VeracruzServer for VeracruzServerIceCap {
             .read_exact(&mut buffer)
             .map_err(|e| anyhow!(e))?;
         return Ok(buffer);
+    fn tls_data(
+        &mut self,
+        session_id: u32,
+        input: Vec<u8>,
+    ) -> Result<(bool, Option<Vec<Vec<u8>>>), VeracruzServerError> {
+        match self.communicate(&RuntimeManagerRequest::SendTlsData(session_id, input))? {
+            RuntimeManagerResponse::Status(Status::Success) => (),
+            resp => {
+                return Err(VeracruzServerError::IceCapError(
+                    IceCapError::UnexpectedRuntimeManagerResponse(resp),
+                ))
+            }
+        }
+
+        let mut acc = Vec::new();
+        let active = loop {
+            if !self.tls_data_needed(session_id)? {
+                break true;
+            }
+            match self.communicate(&RuntimeManagerRequest::GetTlsData(session_id))? {
+                RuntimeManagerResponse::TlsData(data, active) => {
+                    acc.push(data);
+                    if !active {
+                        break false;
+                    }
+                }
+                resp => return Err(IceCapError::UnexpectedRuntimeManagerResponse(resp).into()),
+            };
+        };
+
+        Ok((
+            active,
+            match acc.len() {
+                0 => None,
+                _ => Some(acc),
+            },
+        ))
     }
 }
 

runtime-manager/Cargo.toml

@@ -19,6 +19,7 @@ icecap = [
   "veracruz-utils/icecap",
 ]
 icecap-lkvm = []
+icecap-lkvm_realm = []
 icecap-qemu = []
 linux = [
   "bincode",

tests/Cargo.toml

@@ -22,13 +22,14 @@ icecap = [
   "veracruz-server/icecap",
   "veracruz-utils/icecap",
 ]
-icecap-lkvm = [
-  "veracruz-server/icecap-lkvm"
-]
-icecap-qemu = [
-  "veracruz-server/icecap-qemu",
-  "icecap-veracruz-server"
+icecap-cca = [
+  "policy-utils/icecap",
+  "veracruz-server/icecap-cca",
+  "veracruz-utils/icecap",
 ]
+icecap-lkvm = ["veracruz-server/icecap-lkvm"]
+icecap-lkvm_realm = ["veracruz-server/icecap-lkvm_realm"]
+icecap-qemu = ["veracruz-server/icecap-qemu"]
 linux = [
   "linux-veracruz-server",
   "policy-utils/std",

tests/tests/server_test.rs

@@ -44,6 +44,14 @@ use std::{
 };
 use transport_protocol;
 use veracruz_server::common::*;
+#[cfg(feature = "icecap-cca")]
+use veracruz_server::icecap_cca::VeracruzServerIceCapCCA as VeracruzServerEnclave;
+#[cfg(feature = "icecap")]
+use veracruz_server::icecap::VeracruzServerIceCap as VeracruzServerEnclave;
+#[cfg(feature = "linux")]
+use veracruz_server::linux::veracruz_server_linux::VeracruzServerLinux as VeracruzServerEnclave;
+#[cfg(feature = "nitro")]
+use veracruz_server::nitro::veracruz_server_nitro::VeracruzServerNitro as VeracruzServerEnclave;
 use veracruz_utils::VERACRUZ_RUNTIME_HASH_EXTENSION_ID;
 
 // Policy files

veracruz-server/Cargo.toml

@@ -27,6 +27,15 @@ icecap = [
   "veracruz-utils/icecap",
 ]
 icecap-lkvm = []
+icecap-cca = [
+  "io-utils/icecap",
+  "policy-utils/icecap",
+  "psa-attestation",
+  "signal-hook",
+  "tempfile",
+  "veracruz-utils/icecap",
+]
+icecap-lkvm_realm = []
 icecap-qemu = []
 linux = [
   "data-encoding",

veracruz-server/src/common.rs

@@ -9,6 +9,10 @@
 //! See the `LICENSE_MIT.markdown` file in the Veracruz root directory for
 //! information on licensing and copyright.
 
+#[cfg(all(feature = "icecap", not(feature = "icecap-cca")))]
+use crate::platforms::icecap::IceCapError;
+#[cfg(feature = "icecap-cca")]
+use crate::platforms::icecap_cca::IceCapError;
 use err_derive::Error;
 #[cfg(feature = "nitro")]
 use nitro_enclave::NitroError;
@@ -49,7 +53,12 @@ pub enum VeracruzServerError {
     #[cfg(feature = "nitro")]
     #[error(display = "VeracruzServer: Nitro Error:{:?}", _0)]
     NitroError(#[error(source)] NitroError),
-    #[cfg(feature = "icecap")]
+    #[cfg(feature = "icecap-cca")]
+    #[error(display = "VeracruzServer: IceCap CCA error: {:?}", _0)]
+    IceCapError(#[error(source)] IceCapError),
+    #[cfg(all(feature = "icecap", not(feature = "icecap-cca")))]
+    #[error(display = "VeracruzServer: IceCap error: {:?}", _0)]
+    IceCapError(#[error(source)] IceCapError),
     #[error(display = "VeracruzServer: TransportProtocolError: {:?}.", _0)]
     TransportProtocolError(#[error(source)] transport_protocol::TransportProtocolError),
     #[error(display = "VeracruzServer: Join Error: {:?}.", _0)]