SW_HARDENING_NEEDED

[hiram-abif]

Hello,

We are trying to run servers on your network and would like to get a Tier 1 rating, but we keep getting the SW_HARDENING_NEEDED error. We tried multiple kernels, also tried recompiling drivers.

I see that this has been added to your code in the constants:

phala-blockchain/pallets/phala/src/utils/constants.rs

Line 11 in 309e465

"SW_HARDENING_NEEDED",

However Intel sees to acknowledge this as a false positive:

• https://community.intel.com/t5/Intel-Software-Guard-Extensions/SW-HARDENING-NEEDED-quot-INTEL-SA-00657-quot-but-microcode-it-s/td-p/1435751
• https://community.intel.com/t5/Intel-Software-Guard-Extensions/SW-HARDENING-NEEDED-quot-INTEL-SA-00657-quot-but-microcode-it-s/m-p/1436546

My questions, if you can please help with answers cause I am confused:

• Is SW_HARDENING_NEEDED a false positive?
• Is there any software operation that can by executed on a server to fix this error?
• Are there any servers specific servers that you can can be Tier 1? Is it a hardware thing?

Thank you!

[h4x3rotab]

SW_HARDENING_NEEDED doesn't necessary mean it's unusable. It means there are known vulnerabilities that can be mitigated by upgrading software, and usually it depends on the SGX SDK and the compiler. Usually we ship the code with the latest compiler and thus it shouldn't be an issue. Tier 1-3 are basically the same and they have the same reward. Can you show us the worker id so we can check why you got a lower tier?

[hiram-abif]

It means there are known vulnerabilities that can be mitigated by upgrading software, and usually it depends on the SGX SDK and the compiler.

Can you please let me know which software upgrades are required? I have already tried:

• upgrading to the latest TCB
• the latest Linux kernel
• the latest SGX drivers

The error is however still popping.

Can you show us the worker id so we can check why you got a lower tier?

I can share the worker ID in private if this is really needed, but from the code of the Phala blockchain is very clear and the error will happen only under this specific condition:

pub const SGX_QUOTE_STATUS_LEVEL_2: &[&str] = &[
	// IAS
	"SW_HARDENING_NEEDED",
	// DCAP
	"SWHardeningNeeded",
];

[h4x3rotab]

No you don't need to upgrade it on your side. It's related to the code on our side. And in fact Tier 1, 2, and 3 don't have a real difference.