rune/libenclave/skeleton && sgx-tools: Resolve the launch token adaptation problem on sgx2 + in-tree

- sgx-tools gen-token command reports an error when running on machine with FLC
- Operations related to lanunch token are not supported on machine with FLC

Signed-off-by: Shirong Hao shirong@linux.alibaba.com

Xfrm needs support the same xsave feature in encalve as in OS.
By cpuid, it can get the same value between xfrm and xcr0.
Signed-off-by: NLiang Yang <liang3.yang@intel.com>
Reviewed-by: Jia Zhang <zhang.jia@linux.alibaba.com>

1. Support PAL API V3.
2. Support `rune attest` command.
3. Add skeleton_remote_attestation_with_rune.md.
Signed-off-by: NYilin Li <YiLin.Li@linux.alibaba.com>

Signed-off-by: NYilin Li <YiLin.Li@linux.alibaba.com>

Signed-off-by: NYilin Li <YiLin.Li@linux.alibaba.com>

Signed-off-by: NYilin Li <YiLin.Li@linux.alibaba.com>

Move the implementation of skeleton PAL V2 APIs from liberpal-skeleton-v2.c
to liberpal-skeleton.c
Signed-off-by: NYilin Li <YiLin.Li@linux.alibaba.com>

Since the pal_create_process interface of PAI API v2 has achieved a similar function, fork-test argument is useless.
Signed-off-by: NShirong Hao <shirong@linux.alibaba.com>

sgxsign now supports --product option to enable product enclave build and launch.
Signed-off-by: NShirong Hao <shirong@linux.alibaba.com>

Signed-off-by: NShirong Hao <shirong@linux.alibaba.com>

Leave v1 implementation in a separate file.
Signed-off-by: NShirong Hao <shirong@linux.alibaba.com>

This argument is used to test whether enclave share mapping between
parent and child process is usable.
Signed-off-by: Jia Zhang <zhang.jia@linux.alibaba.com>

In the GNU C Library, "major" is defined by <sys/sysmacros.h> starting from glibc-2.25,
the macros major and minor are only available in <sys/sysmacros.h>. This fix is for historical compatibility.
Signed-off-by: NLiang Yang <liang3.yang@intel.com>

Signed-off-by: Jia Zhang <zhang.jia@linux.alibaba.com>

There are still lots of SGX1 machines without FLC support deployed
in filed. These machines eventually needs to be migrated to be supported
by SGX in-tree driver which is product-ready and well-maintained.

This patch targets to address the gap between SGX1 machine and SGX
in-tree driver.
Signed-off-by: Jia Zhang <zhang.jia@linux.alibaba.com>

Signed-off-by: Jia Zhang <zhang.jia@linux.alibaba.com>

SGX in-tree driver has a different way to go agains SGX out-of-tree
driver. The enclave range is mapped to EPC memory after executing
EINIT, so the anonymous mapping occupying enclave range must be done
early instead of creating it based on the fd of /dev/isgx.
Signed-off-by: Jia Zhang <zhang.jia@linux.alibaba.com>

Use st_rdev to retrieve the major number of device.
Signed-off-by: Jia Zhang <zhang.jia@linux.alibaba.com>

Signed-off-by: Jia Zhang <zhang.jia@linux.alibaba.com>

Signed-off-by: NTianjia Zhang <tianjia.zhang@linux.alibaba.com>

Signed-off-by: Jia Zhang <zhang.jia@linux.alibaba.com>

In order to implement more ecall functions, it is necessary to
implement a general sgx entry point with ecall number to
corresponding ecall handler.
Signed-off-by: Jia Zhang <zhang.jia@linux.alibaba.com>

Signed-off-by: Jia Zhang <zhang.jia@linux.alibaba.com>

Signed-off-by: Jia Zhang <zhang.jia@linux.alibaba.com>

Currently, PAL API only implements v1.
Signed-off-by: Jia Zhang <zhang.jia@linux.alibaba.com>

This new implementation inspires the design of https://github.com/jsakkine-intel/linux-sgx/tree/next/tools/testing/selftests/x86/sgx, which is a real enclave runtime.
Signed-off-by: Njack.wxz <wangxiaozhe@linux.alibaba.com>

inclavare-containers is a set of tools for running trusted
applications in containers with the hardware-assisted enclave
technology. Enclave, referred to as a protected execution
environment, prevents the untrusted entity from accessing the
sensitive and confidential assets in use.

Currently, inclavare-containers consists of two core components:
rune and enclave runtime.

rune is a CLI tool for spawning and running enclaves in containers
according to the OCI specification. The codebase of rune is
a fork of runc, so rune can be used as runc if enclave is not
configured or available.

Enclave runtime is the backend of rune, which is responsible
for loading and running applications inside enclaves. The
interface between rune and enclave runtime is Enclave Runtime PAL
API, which allows invoking enclave runtime through well-defined
functions. The software for confidential computing may benefit
from this interface to interact with OCI runtime.

Additionally, this commit includes additional information about the
use of inclavare-containers.
- Run sample enclave runtime skeleton with rune
- Run enclave runtime Occlum with rune

See README.md for more details.
Signed-off-by: Jia Zhang <zhang.jia@linux.alibaba.com>
Signed-off-by: NXiaozhe Wang <wangxiaozhe@linux.alibaba.com>
Signed-off-by: NYilin Li <YiLin.Li@linux.alibaba.com>