Intel SGX development on Vultr

Introduction

This post explains how to set up development box with Intel SGX on Vultr bare metal server, but the same principle applies to any other Supermicro server which has supported CPU.

Setup

Assuming you have an account with Vultr, provision bare metal machine with Ubuntu 20.04. Once the machine has been provisioned, open Web console and press top right button: Send CtrlAltDel, after that keep pressing DEL until you get to BIOS and see the following screen:

Then go to the following Menu: Advanced -> Chipset Configuration and enable SW Guard Extensions (SGX) which is disabled by default:

Save and reset. Once SGX is enabled in BIOS settings, the system is prepared for Intel SGX drivers installation, full guide provided by Intel can be found here.

Commands to follow

1. Download driver:

wget https://download.01.org/intel-sgx/sgx-linux/2.12/distro/ubuntu20.04-server/sgx_linux_x64_driver_2.11.0_4505f07.bin 

2. Download sdk:

wget https://download.01.org/intel-sgx/sgx-linux/2.12/distro/ubuntu20.04-server/sgx_linux_x64_sdk_2.12.100.3.bin

3. Set executable bit:

chmod +x *.bin 

4. Add Intel’s Ubuntu repository:

echo 'deb [arch=amd64] https://download.01.org/intel-sgx/sgx_repo/ubuntu focal main' | tee /etc/apt/sources.list.d/intel-sgx.list
wget -qO - https://download.01.org/intel-sgx/sgx_repo/ubuntu/intel-sgx-deb.key | sudo apt-key add - 

5. Install driver:

./sgx_linux_x64_driver_2.11.0_4505f07.bin
reboot

6. After reboot, install required packages:

apt update
apt install -y libssl-dev libcurl4-openssl-dev libprotobuf-dev build-essential dkms libsgx-epid libsgx-urts libsgx-quote-ex python-is-python3

7. Install Intel SDK, to /opt/intel/sgxsdk:

./sgx_linux_x64_sdk_2.12.100.3.bin
*** choose no to current directory and specify: /opt/intel [this will create /opt/intel/sgxsdk]***
source /opt/intel/sgxsdk/environment

8. Check if SGX device is present in the system:

~$ ls -l /dev/isgx
crw-rw-rw- 1 root root 10, 58 Dec  8 16:56 /dev/isgx

At this point system is ready for Intel SGX development. Optionally you can download Docker and start developing with Apache Teaclave.

9. Install docker:

curl -fsSL https://get.docker.com -o get-docker.sh
chmod +x ./get-docker.sh
./get-docker.sh

10. For Rust SDK use the following image:

docker run --rm -it --device /dev/isgx baiduxlab/sgx-rust:latest bash
git clone https://github.com/apache/incubator-teaclave-sgx-sdk
cd incubator-teaclave-sgx-sdk/samplecode/hello-rust
make

11. Run sample application:

cd bin
$~/incubator-teaclave-sgx-sdk/samplecode/hello-rust/bin# ./app
[+] Init Enclave Successful 2!
This is a normal world string passed into Enclave!
This is a in-Enclave Rust string!
[+] say_something success...

For more information follow Teaclave docs.

Article first appeared at:
https://blog.zenlot.xyz/post/vultr_intel_sgx/