Signed-off-by: NShirong Hao <shirong@linux.alibaba.com>

The --debug option of rune should be enabled to show IAS report when running RA.
Signed-off-by: NYilin Li <YiLin.Li@linux.alibaba.com>

iberpal-skeleton is constantly being updated, it may not be compatible with the previous images.

 Signed-off-by: Shirong Hao shirong@linux.alibaba.com

rune/libenclave/skeleton && sgx-tools: Resolve the launch token adaptation problem on sgx2 + in-tree

- sgx-tools gen-token command reports an error when running on machine with FLC
- Operations related to lanunch token are not supported on machine with FLC

Signed-off-by: Shirong Hao shirong@linux.alibaba.com

Signed-off-by: NShirong Hao <shirong@linux.alibaba.com>

Xfrm needs support the same xsave feature in encalve as in OS.
By cpuid, it can get the same value between xfrm and xcr0.
Signed-off-by: NLiang Yang <liang3.yang@intel.com>
Reviewed-by: Jia Zhang <zhang.jia@linux.alibaba.com>

Signed-off-by: NShirong Hao <shirong@linux.alibaba.com>

- Add Dragonwell and Skeleton images in reference container image
- Update Version number
Signed-off-by: NShirong Hao <shirong@linux.alibaba.com>

- Update centos version from 7.5 to 8.1
- Update occlum version from 0.14.0 to 0.15.1
- Update the way to Install SGX SDK and SGX PSW
- Update tht value of ENCLAVE_RUNTIME_ARGS
Signed-off-by: NShirong Hao <shirong@linux.alibaba.com>

Signed-off-by: NYilin Li <YiLin.Li@linux.alibaba.com>

skeleton_remote_attestation_with_rune.md.

Only `liberpal-skeleton-v3.so` supports `rune attest` command.
Signed-off-by: NYilin Li <YiLin.Li@linux.alibaba.com>

1. Support PAL API V3.
2. Support `rune attest` command.
3. Add skeleton_remote_attestation_with_rune.md.
Signed-off-by: NYilin Li <YiLin.Li@linux.alibaba.com>

Signed-off-by: NYilin Li <YiLin.Li@linux.alibaba.com>

Signed-off-by: NYilin Li <YiLin.Li@linux.alibaba.com>

Signed-off-by: NYilin Li <YiLin.Li@linux.alibaba.com>

Signed-off-by: NYilin Li <YiLin.Li@linux.alibaba.com>

Move the implementation of skeleton PAL V2 APIs from liberpal-skeleton-v2.c
to liberpal-skeleton.c
Signed-off-by: NYilin Li <YiLin.Li@linux.alibaba.com>

Since the pal_create_process interface of PAI API v2 has achieved a similar function, fork-test argument is useless.
Signed-off-by: NShirong Hao <shirong@linux.alibaba.com>

sgxsign now supports --product option to enable product enclave build and launch.
Signed-off-by: NShirong Hao <shirong@linux.alibaba.com>

- Use liberpal-skeleton to replace liberpal-skeleton.so in README.
- Use liberpal-skeleton-v1.so to replace liberpal-skeleton.so in rune/libcontainer/specconv/example.go
- Use liberpal-skeleton*.so to repalce liberpal-skeleton.so in rune/Makefile and .gitignore
Signed-off-by: NShirong Hao <shirong@linux.alibaba.com>

Use liberpal-skeleton-v${SKELETON_PAL_VERSION}.so to replace liberpal-skeleton.so in README.
Signed-off-by: NYilin Li <YiLin.Li@linux.alibaba.com>

Signed-off-by: NShirong Hao <shirong@linux.alibaba.com>

Leave v1 implementation in a separate file.
Signed-off-by: NShirong Hao <shirong@linux.alibaba.com>

This argument is used to test whether enclave share mapping between
parent and child process is usable.
Signed-off-by: Jia Zhang <zhang.jia@linux.alibaba.com>

In the GNU C Library, "major" is defined by <sys/sysmacros.h> starting from glibc-2.25,
the macros major and minor are only available in <sys/sysmacros.h>. This fix is for historical compatibility.
Signed-off-by: NLiang Yang <liang3.yang@intel.com>

Signed-off-by: Jia Zhang <zhang.jia@linux.alibaba.com>

There are still lots of SGX1 machines without FLC support deployed
in filed. These machines eventually needs to be migrated to be supported
by SGX in-tree driver which is product-ready and well-maintained.

This patch targets to address the gap between SGX1 machine and SGX
in-tree driver.
Signed-off-by: Jia Zhang <zhang.jia@linux.alibaba.com>

Signed-off-by: Jia Zhang <zhang.jia@linux.alibaba.com>

Signed-off-by: Jia Zhang <zhang.jia@linux.alibaba.com>

SGX in-tree driver has a different way to go agains SGX out-of-tree
driver. The enclave range is mapped to EPC memory after executing
EINIT, so the anonymous mapping occupying enclave range must be done
early instead of creating it based on the fd of /dev/isgx.
Signed-off-by: Jia Zhang <zhang.jia@linux.alibaba.com>

Use st_rdev to retrieve the major number of device.
Signed-off-by: Jia Zhang <zhang.jia@linux.alibaba.com>

Signed-off-by: Jia Zhang <zhang.jia@linux.alibaba.com>

Signed-off-by: Jia Zhang <zhang.jia@linux.alibaba.com>

Signed-off-by: NYilin Li <YiLin.Li@linux.alibaba.com>

Signed-off-by: NTianjia Zhang <tianjia.zhang@linux.alibaba.com>

Signed-off-by: NYilin Li <YiLin.Li@linux.alibaba.com>

Signed-off-by: Jia Zhang <zhang.jia@linux.alibaba.com>

- Add docs/running_rune_with_occlum_bundle.md
- Remove docs/running_rune_with_docker.md
- Update skeleton README.md to add way to run rune with skeleton bundle
- Update README.md of inclavare-containers
- Add docs/running_rune_with_occlum.md
Signed-off-by: NYilin Li <YiLin.Li@linux.alibaba.com>

Signed-off-by: Jia Zhang <zhang.jia@linux.alibaba.com>

1. Add way to build and install rune.
2. Add way to configure rune to Docker runtimes.
Signed-off-by: NYilin Li <YiLin.Li@linux.alibaba.com>