This repository was archived by the owner on Jun 21, 2020. It is now read-only.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Introduction
The way threads inside the enclave works is by multiple threads trying the access the enclave from the untrusted.
The amount of threads that can do that in parallel is decided by the value of
TCSNum
in thexml
As written here: https://download.01.org/intel-sgx/linux-2.5/docs/Intel_SGX_Developer_Reference_Linux_2.5_Open_Source.pdf page 65.We don't know enough what's the security implications of launching multiple threads in the enclave, because they share the same memory.
The problem
Right now there are 2 problems:
Both
get_state_keys
andwatch_blocks
try to access the enclave while running in separate threads.The current JSON-RPC server initiates 2 threads even though it should only initiate 1. (Somehow the server always spawn at least 2 threads. paritytech/jsonrpc#425)
Temporary Solution
This PR will temporarly increase the number of allowed threads to 3 to answer the 3 threads I stated above.
This solution cannot go into production without seriously understanding and evaluating the risks.
Future Solution
I think the right solution for production is as follow:
Only 1 entity would control the enclave itself. the eid won’t be passed around and only that entity will make ecalls.
we will try to minimize the amount of threads to the minimum required (it seems that 2 unless we can try and make everything async which isn’t too easy in rust)
The enclave object itself will be guarded by a Mutex so that no 2 threads can make an ecall at the same time. that way they won’t be able to interfere with each other.
CC @fredfortier @lacabra @moriaab @AvishaiW #137