In order to implement more ecall functions, it is necessary to
implement a general sgx entry point with ecall number to
corresponding ecall handler.
Signed-off-by: Jia Zhang <zhang.jia@linux.alibaba.com>

Signed-off-by: Njack.wxz <wangxiaozhe@linux.alibaba.com>
Signed-off-by: NTianjia Zhang <tianjia.zhang@linux.alibaba.com>

Because there is no re-exec operation, there is no need to use
environment variables to pass parameters between bootstrap and
runelet, use global variables instead of environment variables.
Signed-off-by: NTianjia Zhang <tianjia.zhang@linux.alibaba.com>

Support to retrieve quoting enclave's target information.
Signed-off-by: Jia Zhang <zhang.jia@linux.alibaba.com>

Support to retrieve quoting enclave's target information.
Signed-off-by: Jia Zhang <zhang.jia@linux.alibaba.com>

Signed-off-by: Jia Zhang <zhang.jia@linux.alibaba.com>

The interaction with aesmd can be shared with other aesm service messages.
Signed-off-by: Jia Zhang <zhang.jia@linux.alibaba.com>

In order to involve more aesm services, prepare to place all request
and response messages into the corresponding main sections.
Signed-off-by: Jia Zhang <zhang.jia@linux.alibaba.com>

Signed-off-by: Jia Zhang <zhang.jia@linux.alibaba.com>

Signed-off-by: Jia Zhang <zhang.jia@linux.alibaba.com>

Signed-off-by: Jia Zhang <zhang.jia@linux.alibaba.com>

Signed-off-by: Jia Zhang <zhang.jia@linux.alibaba.com>

If rune is used as runc, PAL path will not be specified, runc logic
should be followed.
Signed-off-by: NTianjia Zhang <tianjia.zhang@linux.alibaba.com>

Signed-off-by: Jia Zhang <zhang.jia@linux.alibaba.com>

Signed-off-by: Jia Zhang <zhang.jia@linux.alibaba.com>

Currently, PAL API only implements v1.
Signed-off-by: Jia Zhang <zhang.jia@linux.alibaba.com>

Signed-off-by: Jia Zhang <zhang.jia@linux.alibaba.com>

Signed-off-by: Jia Zhang <zhang.jia@linux.alibaba.com>

Use unified API symbols starting with 'pal_'.
Signed-off-by: Njack.wxz <wangxiaozhe@linux.alibaba.com>
Signed-off-by: NTianjia Zhang <tianjia.zhang@linux.alibaba.com>

Signed-off-by: Njack.wxz <wangxiaozhe@linux.alibaba.com>

Instead loading enclave runtime in container, rune should always load it at bootstrap,
in order to avoid dlopen issue.
Signed-off-by: NTianjia Zhang <tianjia.zhang@linux.alibaba.com>

This new implementation inspires the design of https://github.com/jsakkine-intel/linux-sgx/tree/next/tools/testing/selftests/x86/sgx, which is a real enclave runtime.
Signed-off-by: Njack.wxz <wangxiaozhe@linux.alibaba.com>

execute sgx_sign in the occlum container

shim: open source code

It should be not so complex to cast client agent pipe in so many forms.
Signed-off-by: Jia Zhang <zhang.jia@linux.alibaba.com>

Refer to docs/rune_quick_start.md available in occlum github repository instead
of docs/running_occlum_with_rune.md in this repository.
Signed-off-by: NYilin Li <YiLin.Li@linux.alibaba.com>

Signed-off-by: Njack.wxz <wangxiaozhe@linux.alibaba.com>

If the returned error is empty, don't raise an error in any way.
Signed-off-by: Jia Zhang <zhang.jia@linux.alibaba.com>

If the program launched by rune exec is terminated, runelet process
is unstoppable. Just kick off it through the channel notifyExit.
Signed-off-by: NXiaozhe Wang <wangxiaozhe@linux.alibaba.com>
Signed-off-by: Jia Zhang <zhang.jia@linux.alibaba.com>

Signed-off-by: Jia Zhang <zhang.jia@linux.alibaba.com>

1. Given the signature file of an Enclave, runectl gen-token command can generate the corresponding token file from Intel aesmd service.
2. runectl attest command can allow users to challenge the enclave with the help of Intel Attestation Service through remote attestation
requests. runectl command will open soon.
Signed-off-by: NYilin Li <YiLin.Li@linux.alibaba.com>
Signed-off-by: Jia Zhang <zhang.jia@linux.alibaba.com>

Unlike what is done in the process of initialization of container
entrypoint, the exec fifo fd is not closed without closing it
explicitly, resulting in rune start cannot be terminated.
Signed-off-by: Jia Zhang <zhang.jia@linux.alibaba.com>

It was intended to have fds without close-on-exec with the side
effect of dup(), but acutally all fds staged are already
close-on-exec clear. Thus dup() makes extra duplications of fds
passed to init-runelet.
Signed-off-by: Jia Zhang <zhang.jia@linux.alibaba.com>

If the enclave devices doesn't exist, don't add them into the default device list and cgroup whitelist.
Signed-off-by: NYilin Li <YiLin.Li@linux.alibaba.com>

Instead using the hard code "off".
Signed-off-by: NYilin Li <YiLin.Li@linux.alibaba.com>

The prototype declaration of pal_init() is wrong, this is a
copy-paste error, this patch fixes it.
Signed-off-by: NTianjia Zhang <tianjia.zhang@linux.alibaba.com>

Signed-off-by: Jia Zhang <zhang.jia@linux.alibaba.com>

Signed-off-by: Jia Zhang <zhang.jia@linux.alibaba.com>