Revert "Linux 2.13.1 Open Source Gold Release"

Linux 2.13.1 is broken.

This reverts commit 63d0e65.

Signed-off-by: Li, Xun <[email protected]>

Author: llly

.gitmodules

@@ -12,4 +12,4 @@
 [submodule "ipp-crypto"]
 	path = external/ippcp_internal/ipp-crypto
 	url = https://github.com/intel/ipp-crypto.git
-	branch = ipp-crypto_2020_update3
+	branch = ipp-crypto_2019_update5

build-scripts/sgx-asm-pp.py

@@ -31,20 +31,20 @@
 #ifndef _SE_VERSION_H_
 #define _SE_VERSION_H_
 
-#define STRFILEVER    "2.13.101.2"
+#define STRFILEVER    "2.13.100.4"
 #define SGX_MAJOR_VERSION       2
 #define SGX_MINOR_VERSION       13
-#define SGX_REVISION_VERSION    101
+#define SGX_REVISION_VERSION    100
 #define MAKE_VERSION_UINT(major,minor,rev)  (((uint64_t)major)<<32 | ((uint64_t)minor) << 16 | rev)
 #define VERSION_UINT        MAKE_VERSION_UINT(SGX_MAJOR_VERSION, SGX_MINOR_VERSION, SGX_REVISION_VERSION)
 
 #define COPYRIGHT      "Copyright (C) 2021 Intel Corporation"
 
-#define UAE_SERVICE_VERSION       "2.3.208.2"
-#define URTS_VERSION              "1.1.112.2"
-#define ENCLAVE_COMMON_VERSION    "1.0.115.2"
-#define LAUNCH_VERSION            "1.0.110.2"
-#define EPID_VERSION              "1.0.110.2"
-#define QUOTE_EX_VERSION          "1.1.110.2"
+#define UAE_SERVICE_VERSION       "2.3.207.4"
+#define URTS_VERSION              "1.1.111.4"
+#define ENCLAVE_COMMON_VERSION    "1.0.114.4"
+#define LAUNCH_VERSION            "1.0.109.4"
+#define EPID_VERSION              "1.0.109.4"
+#define QUOTE_EX_VERSION          "1.1.109.4"
 
 #endif

common/inc/internal/se_version.h

@@ -33,11 +33,11 @@
 
 top_dir=`dirname $0`
 out_dir=$top_dir
-optlib_name=optimized_libs_2.13.1.tar.gz
-ae_file_name=prebuilt_ae_2.13.1.tar.gz
+optlib_name=optimized_libs_2.13.tar.gz
+ae_file_name=prebuilt_ae_2.13.tar.gz
 binutils_file_name=as.ld.objdump.gold.r3.tar.gz
-checksum_file=SHA256SUM_prebuilt_2.13.1.cfg
-server_url_path=https://download.01.org/intel-sgx/sgx-linux/2.13.1
+checksum_file=SHA256SUM_prebuilt_2.13.cfg
+server_url_path=https://download.01.org/intel-sgx/sgx-linux/2.13
 server_optlib_url=$server_url_path/$optlib_name
 server_ae_url=$server_url_path/$ae_file_name
 server_binutils_url=$server_url_path/$binutils_file_name

download_prebuilt.sh

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2011-2021 Intel Corporation. All rights reserved.
+ * Copyright (C) 2011-2019 Intel Corporation. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -83,7 +83,6 @@ extern "C" {
   #define ippsAESDecryptCTR sgx_disp_ippsAESDecryptCTR
   #define ippsAESEncryptXTS_Direct sgx_disp_ippsAESEncryptXTS_Direct
   #define ippsAESDecryptXTS_Direct sgx_disp_ippsAESDecryptXTS_Direct
-  #define ippsAES_EncryptCFB16_MB sgx_disp_ippsAES_EncryptCFB16_MB
   #define ippsSMS4GetSize sgx_disp_ippsSMS4GetSize
   #define ippsSMS4Init sgx_disp_ippsSMS4Init
   #define ippsSMS4SetKey sgx_disp_ippsSMS4SetKey
@@ -348,14 +347,6 @@ extern "C" {
   #define ippsRSAVerify_PKCS1v15 sgx_disp_ippsRSAVerify_PKCS1v15
   #define ippsRSASign_PKCS1v15_rmf sgx_disp_ippsRSASign_PKCS1v15_rmf
   #define ippsRSAVerify_PKCS1v15_rmf sgx_disp_ippsRSAVerify_PKCS1v15_rmf
-  #define ippsRSA_MB_GetBufferSizePublicKey sgx_disp_ippsRSA_MB_GetBufferSizePublicKey
-  #define ippsRSA_MB_GetBufferSizePrivateKey sgx_disp_ippsRSA_MB_GetBufferSizePrivateKey
-  #define ippsRSA_MB_Encrypt sgx_disp_ippsRSA_MB_Encrypt
-  #define ippsRSA_MB_Decrypt sgx_disp_ippsRSA_MB_Decrypt
-  #define ippsRSA_MB_Sign_PSS_rmf sgx_disp_ippsRSA_MB_Sign_PSS_rmf
-  #define ippsRSA_MB_Verify_PSS_rmf sgx_disp_ippsRSA_MB_Verify_PSS_rmf
-  #define ippsRSA_MB_Sign_PKCS1v15_rmf sgx_disp_ippsRSA_MB_Sign_PKCS1v15_rmf
-  #define ippsRSA_MB_Verify_PKCS1v15_rmf sgx_disp_ippsRSA_MB_Verify_PKCS1v15_rmf
   #define ippsDLGetResultString sgx_disp_ippsDLGetResultString
   #define ippsDLPGetSize sgx_disp_ippsDLPGetSize
   #define ippsDLPInit sgx_disp_ippsDLPInit
@@ -518,9 +509,7 @@ extern "C" {
   #define ippsGFpECSetPointRandom sgx_disp_ippsGFpECSetPointRandom
   #define ippsGFpECMakePoint sgx_disp_ippsGFpECMakePoint
   #define ippsGFpECSetPointHash sgx_disp_ippsGFpECSetPointHash
-  #define ippsGFpECSetPointHashBackCompatible sgx_disp_ippsGFpECSetPointHashBackCompatible
   #define ippsGFpECSetPointHash_rmf sgx_disp_ippsGFpECSetPointHash_rmf
-  #define ippsGFpECSetPointHashBackCompatible_rmf sgx_disp_ippsGFpECSetPointHashBackCompatible_rmf
   #define ippsGFpECGetPoint sgx_disp_ippsGFpECGetPoint
   #define ippsGFpECGetPointRegular sgx_disp_ippsGFpECGetPointRegular
   #define ippsGFpECSetPointOctString sgx_disp_ippsGFpECSetPointOctString

external/dcap_source

@@ -34,7 +34,8 @@ include ../../buildenv.mk
 DIR = $(CURDIR)
 
 IPP_CONFIG = -Bbuild -DCMAKE_VERBOSE_MAKEFILE=on
-
+# Set the mitigation version assembler for IPP assembly code build
+IPP_CONFIG += -DCMAKE_ASM-ATT_COMPILER="$(BINUTILS_DIR)/as"
 # Ignore the CMAKE C/C++ compiler check to avoid conflicts with mitigation options
 IPP_CONFIG += -DCMAKE_C_COMPILER_WORKS=TRUE -DCMAKE_CXX_COMPILER_WORKS=TRUE 
 IPP_SOURCE = ipp-crypto
@@ -48,23 +49,29 @@ ENC_CXXFLAGS = $(ENC_CFLAGS)
 
 IPP_CONFIG += -DCMAKE_C_FLAGS="$(ENC_CFLAGS)"
 IPP_CONFIG += -DCMAKE_CXX_FLAGS="$(ENC_CXXFLAGS)"
+comma:= ,
+ASM_FLAGS = $(subst -Wa$(comma),,$(MITIGATION_ASFLAGS))
+ENC_ASM_FLAGS = $(patsubst -fno-plt, , $(ASM_FLAGS))
+
+IPP_CONFIG += -DCMAKE_ENC_ASM_FLAGS="$(ENC_ASM_FLAGS)"
 
 SUB_DIR = no_mitigation
 ifeq ($(MITIGATION-CVE-2020-0551), LOAD)
 	SUB_DIR = cve_2020_0551_load
-	PRE_CONFIG= ASM_NASM="python $(DIR)/../../build-scripts/sgx-asm-pp.py --assembler=nasm --MITIGATION-CVE-2020-0551=LOAD"
 else ifeq ($(MITIGATION-CVE-2020-0551), CF)
 	SUB_DIR = cve_2020_0551_cf
-	PRE_CONFIG= ASM_NASM="python $(DIR)/../../build-scripts/sgx-asm-pp.py --assembler=nasm --MITIGATION-CVE-2020-0551=CF"
 endif
 OUT_DIR = lib/linux/$(ARCH)/$(SUB_DIR)/
 
-CHECK_SOURCE :=
+PATCH_LOG = $(shell cd ./$(IPP_SOURCE) && git log --oneline --grep='Add mitigation support to assembly code' | cut -d' ' -f 3)
+CHECK_PATCHED :=
 # For reproducibility build in docker, the code should be 
 # prepared before build. So skip the code check to avoid
 # triggering network request 
 ifneq ($(origin NIX_PATH), environment)
-CHECK_SOURCE:= ipp_source
+ifneq ($(PATCH_LOG), mitigation)
+CHECK_PATCHED:= ipp_source
+endif
 endif
 
 .PHONY: all build_ipp
@@ -73,21 +80,23 @@ all: build_ipp
 	$(MKDIR) $(OUT_DIR)
 	$(CP) ipp-crypto/build/.build/RELEASE/lib/libippcp.a $(OUT_DIR)
 	$(CP) ipp-crypto/include/* ./inc/
-	patch ipp-crypto/include/ippcp.h -i ./inc/ippcp20u3.patch -o ./inc/ippcp.h
+	patch ipp-crypto/include/ippcp.h -i ./inc/ippcp19u5.patch -o ./inc/ippcp.h
 	$(MKDIR) license
 	$(CP) ipp-crypto/LICENSE ./license/
 
-build_ipp: $(CHECK_SOURCE)
-	cd $(IPP_SOURCE) && $(PRE_CONFIG) cmake CMakeLists.txt $(IPP_CONFIG) && cd build && make ippcp_s
+build_ipp: $(CHECK_PATCHED)
+	cd $(IPP_SOURCE) && cmake CMakeLists.txt $(IPP_CONFIG) && cd build && make ippcp_s
 
 .PHONY: ipp_source
 ipp_source:
-ifeq ($(shell git rev-parse --is-inside-work-tree), true)
-	git submodule update -f --init --recursive --remote -- $(IPP_SOURCE)
-else
+## Need to enable below code when release
+#ifeq ($(shell git rev-parse --is-inside-work-tree), true)
+#	git submodule update -f --init --recursive --remote -- $(IPP_SOURCE)
+#else
 	$(RM) -rf $(IPP_SOURCE)
-	git clone -b ipp-crypto_2020_update3 https://github.com/intel/ipp-crypto.git --depth 1 $(IPP_SOURCE)
-endif
+	git clone -b ipp-crypto_2019_update5  https://github.com/intel/ipp-crypto.git --depth 1 $(IPP_SOURCE)
+#endif
+	cd $(IPP_SOURCE) && git am ../0001-Add-mitigation-support-to-assembly-code.patch
 
 .PHONY: clean
 clean:

external/epid-sdk/ext/ipp/include/sgx_ippcp.h

@@ -0,0 +1,34 @@
+--- ipp-crypto/include/ippcp.h	2019-10-16 18:12:26.157669380 +0800
++++ inc/ippcp.h	2019-10-28 23:53:28.871586537 +0800
+@@ -49,6 +49,11 @@
+ #define IPPCP_H__
+ 
+ 
++#ifndef _SGX_IPPCP_H_
++#include "sgx_ippcp.h"
++#endif
++
++
+ #ifndef IPPCPDEFS_H__
+   #include "ippcpdefs.h"
+ #endif
+@@ -70,11 +75,6 @@
+   #endif
+ #endif
+ 
+-#pragma warning(push)
+-#ifdef _MSC_VER
+-#pragma warning(disable : 4100) // for MSVC, unreferenced param
+-#endif
+-
+ /* /////////////////////////////////////////////////////////////////////////////
+ //  Name:       ippcpGetLibVersion
+ //  Purpose:    getting of the library version
+@@ -1331,7 +1331,6 @@
+ IPPAPI(IppStatus, ippsGFpECESGetBuffersSize_SM2, (int* pPublicKeySize,
+                         int* pMaximumTagSize, const IppsECESState_SM2* pState))
+ 
+-#pragma warning(pop)
+ #ifdef  __cplusplus
+ }
+ #endif