sgx_main.c 30 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911912913914915916917918919920921922923924925926927928929930931932933934935936937938939940941942943944945946947948949950951952
  1. /* -*- mode:c; c-file-style:"k&r"; c-basic-offset: 4; tab-width:4; indent-tabs-mode:nil; mode:auto-fill; fill-column:78; -*- */
  2. /* vim: set ts=4 sw=4 et tw=78 fo=cqt wm=0: */
  3. #include <pal_linux.h>
  4. #include <pal_rtld.h>
  5. #include "sgx_internal.h"
  6. #include "sgx_tls.h"
  7. #include "sgx_enclave.h"
  8. #include "debugger/sgx_gdb.h"
  9. #include <asm/fcntl.h>
  10. #include <asm/socket.h>
  11. #include <linux/fs.h>
  12. #include <linux/in.h>
  13. #include <linux/in6.h>
  14. #include <asm/errno.h>
  15. #include <sysdep.h>
  16. #include <sysdeps/generic/ldsodefs.h>
  17. #define ENCLAVE_FILENAME RUNTIME_FILE("libpal-Linux-SGX.so")
  18. unsigned long pagesize = PRESET_PAGESIZE;
  19. unsigned long pagemask = ~(PRESET_PAGESIZE - 1);
  20. unsigned long pageshift = PRESET_PAGESIZE - 1;
  21. static inline
  22. const char * alloc_concat(const char * p, int plen,
  23. const char * s, int slen)
  24. {
  25. plen = (plen != -1) ? plen : (p ? strlen(p) : 0);
  26. slen = (slen != -1) ? slen : (s ? strlen(s) : 0);
  27. char * buf = malloc(plen + slen + 1);
  28. if (plen)
  29. memcpy(buf, p, plen);
  30. if (slen)
  31. memcpy(buf + plen, s, slen);
  32. buf[plen + slen] = '\0';
  33. return buf;
  34. }
  35. static unsigned long parse_int (const char * str)
  36. {
  37. unsigned long num = 0;
  38. int radix = 10;
  39. char c;
  40. if (str[0] == '0') {
  41. str++;
  42. radix = 8;
  43. if (str[0] == 'x') {
  44. str++;
  45. radix = 16;
  46. }
  47. }
  48. while ((c = *(str++))) {
  49. int val;
  50. if (c >= 'A' && c <= 'F')
  51. val = c - 'A' + 10;
  52. else if (c >= 'a' && c <= 'f')
  53. val = c - 'a' + 10;
  54. else if (c >= '0' && c <= '9')
  55. val = c - '0';
  56. else
  57. break;
  58. if (val >= radix)
  59. break;
  60. num = num * radix + val;
  61. }
  62. if (c == 'G' || c == 'g')
  63. num *= 1024 * 1024 * 1024;
  64. else if (c == 'M' || c == 'm')
  65. num *= 1024 * 1024;
  66. else if (c == 'K' || c == 'k')
  67. num *= 1024;
  68. return num;
  69. }
  70. static const char * resolve_uri (const char * uri, const char ** errstring)
  71. {
  72. if (!strpartcmp_static(uri, "file:")) {
  73. *errstring = "Invalid URI";
  74. return NULL;
  75. }
  76. char path_buf[URI_MAX];
  77. int len = get_norm_path(uri + 5, path_buf, 0, URI_MAX);
  78. if (len < 0) {
  79. *errstring = "Invalid URI";
  80. return NULL;
  81. }
  82. return alloc_concat("file:", static_strlen("file:"), path_buf, len);
  83. }
  84. static
  85. int scan_enclave_binary (int fd, unsigned long * base, unsigned long * size,
  86. unsigned long * entry)
  87. {
  88. int ret = 0;
  89. if (IS_ERR(ret = INLINE_SYSCALL(lseek, 3, fd, 0, SEEK_SET)))
  90. return -ERRNO(ret);
  91. char filebuf[FILEBUF_SIZE];
  92. ret = INLINE_SYSCALL(read, 3, fd, filebuf, FILEBUF_SIZE);
  93. if (IS_ERR(ret))
  94. return -ERRNO(ret);
  95. const ElfW(Ehdr) * header = (void *) filebuf;
  96. const ElfW(Phdr) * phdr = (void *) filebuf + header->e_phoff;
  97. const ElfW(Phdr) * ph;
  98. struct loadcmd {
  99. ElfW(Addr) mapstart, mapend;
  100. } loadcmds[16], *c;
  101. int nloadcmds = 0;
  102. for (ph = phdr ; ph < &phdr[header->e_phnum] ; ph++)
  103. if (ph->p_type == PT_LOAD) {
  104. if (nloadcmds == 16)
  105. return -EINVAL;
  106. c = &loadcmds[nloadcmds++];
  107. c->mapstart = ALLOC_ALIGNDOWN(ph->p_vaddr);
  108. c->mapend = ALLOC_ALIGNUP(ph->p_vaddr + ph->p_memsz);
  109. }
  110. *base = loadcmds[0].mapstart;
  111. *size = loadcmds[nloadcmds - 1].mapend - loadcmds[0].mapstart;
  112. if (entry)
  113. *entry = header->e_entry;
  114. return 0;
  115. }
  116. static
  117. int load_enclave_binary (sgx_arch_secs_t * secs, int fd,
  118. unsigned long base, unsigned long prot)
  119. {
  120. int ret = 0;
  121. if (IS_ERR(ret = INLINE_SYSCALL(lseek, 3, fd, 0, SEEK_SET)))
  122. return -ERRNO(ret);
  123. char filebuf[FILEBUF_SIZE];
  124. ret = INLINE_SYSCALL(read, 3, fd, filebuf, FILEBUF_SIZE);
  125. if (IS_ERR(ret))
  126. return -ERRNO(ret);
  127. const ElfW(Ehdr) * header = (void *) filebuf;
  128. const ElfW(Phdr) * phdr = (void *) filebuf + header->e_phoff;
  129. const ElfW(Phdr) * ph;
  130. struct loadcmd {
  131. ElfW(Addr) mapstart, mapend, datastart, dataend, allocend;
  132. unsigned int mapoff;
  133. int prot;
  134. } loadcmds[16], *c;
  135. int nloadcmds = 0;
  136. for (ph = phdr ; ph < &phdr[header->e_phnum] ; ph++)
  137. if (ph->p_type == PT_LOAD) {
  138. if (nloadcmds == 16)
  139. return -EINVAL;
  140. c = &loadcmds[nloadcmds++];
  141. c->mapstart = ALLOC_ALIGNDOWN(ph->p_vaddr);
  142. c->mapend = ALLOC_ALIGNUP(ph->p_vaddr + ph->p_filesz);
  143. c->datastart = ph->p_vaddr;
  144. c->dataend = ph->p_vaddr + ph->p_filesz;
  145. c->allocend = ph->p_vaddr + ph->p_memsz;
  146. c->mapoff = ALLOC_ALIGNDOWN(ph->p_offset);
  147. c->prot = (ph->p_flags & PF_R ? PROT_READ : 0)|
  148. (ph->p_flags & PF_W ? PROT_WRITE : 0)|
  149. (ph->p_flags & PF_X ? PROT_EXEC : 0)|prot;
  150. #define SGX_SECINFO_FLAGS_R 0x001
  151. }
  152. base -= loadcmds[0].mapstart;
  153. for (c = loadcmds; c < &loadcmds[nloadcmds] ; c++) {
  154. ElfW(Addr) zero = c->dataend;
  155. ElfW(Addr) zeroend = ALLOC_ALIGNUP(c->allocend);
  156. ElfW(Addr) zeropage = ALLOC_ALIGNUP(zero);
  157. if (zeroend < zeropage)
  158. zeropage = zeroend;
  159. if (c->mapend > c->mapstart) {
  160. void * addr = (void *) INLINE_SYSCALL(mmap, 6, NULL,
  161. c->mapend - c->mapstart,
  162. PROT_READ|PROT_WRITE,
  163. MAP_PRIVATE | MAP_FILE,
  164. fd, c->mapoff);
  165. if (IS_ERR_P(addr))
  166. return -ERRNO_P(addr);
  167. if (c->datastart > c->mapstart)
  168. memset(addr, 0, c->datastart - c->mapstart);
  169. if (zeropage > zero)
  170. memset(addr + zero - c->mapstart, 0, zeropage - zero);
  171. ret = add_pages_to_enclave(secs, (void *) base + c->mapstart, addr,
  172. c->mapend - c->mapstart,
  173. SGX_PAGE_REG, c->prot, 0,
  174. (c->prot & PROT_EXEC) ? "code" : "data");
  175. INLINE_SYSCALL(munmap, 2, addr, c->mapend - c->mapstart);
  176. if (ret < 0)
  177. return ret;
  178. }
  179. if (zeroend > zeropage) {
  180. ret = add_pages_to_enclave(secs, (void *) base + zeropage, NULL,
  181. zeroend - zeropage,
  182. SGX_PAGE_REG, c->prot, 1, "bss");
  183. if (ret < 0)
  184. return ret;
  185. }
  186. }
  187. return 0;
  188. }
  189. int initialize_enclave (struct pal_enclave * enclave)
  190. {
  191. int ret = 0;
  192. int enclave_image;
  193. int enclave_thread_num = 1;
  194. sgx_arch_token_t enclave_token;
  195. sgx_arch_sigstruct_t enclave_sigstruct;
  196. sgx_arch_secs_t enclave_secs;
  197. unsigned long enclave_entry_addr;
  198. unsigned long enclave_thread_gprs[MAX_DBG_THREADS];
  199. unsigned long heap_min = DEAFULT_HEAP_MIN;
  200. #define TRY(func, ...) \
  201. ({ \
  202. ret = func(__VA_ARGS__); \
  203. if (ret < 0) { \
  204. SGX_DBG(DBG_E, "initializing enclave failed: " #func ": %d\n", \
  205. -ret); \
  206. goto err; \
  207. } ret; \
  208. })
  209. enclave_image = INLINE_SYSCALL(open, 3, ENCLAVE_FILENAME, O_RDONLY, 0);
  210. if (IS_ERR(enclave_image)) {
  211. SGX_DBG(DBG_E, "cannot find %s\n", ENCLAVE_FILENAME);
  212. ret = -ERRNO(ret);
  213. goto err;
  214. }
  215. char cfgbuf[CONFIG_MAX];
  216. /* Reading sgx.enclave_size from manifest */
  217. if (get_config(enclave->config, "sgx.enclave_size", cfgbuf, CONFIG_MAX) <= 0) {
  218. SGX_DBG(DBG_E, "enclave_size is not specified\n");
  219. ret = -EINVAL;
  220. goto err;
  221. }
  222. enclave->size = parse_int(cfgbuf);
  223. /* DEP 1/21/17: SGX currently only supports power-of-two enclaves.
  224. * Give users a better warning about this. */
  225. if (enclave->size & (enclave->size - 1)) {
  226. SGX_DBG(DBG_E, "Enclave size not a power of two. SGX requires power-of-two enclaves.\n");
  227. ret = -EINVAL;
  228. goto err;
  229. }
  230. /* Reading sgx.thread_num from manifest */
  231. if (get_config(enclave->config, "sgx.thread_num", cfgbuf, CONFIG_MAX) > 0)
  232. enclave->thread_num = parse_int(cfgbuf);
  233. if (enclave_thread_num > MAX_DBG_THREADS) {
  234. SGX_DBG(DBG_E, "Too many threads to debug\n");
  235. ret = -EINVAL;
  236. goto err;
  237. }
  238. /* Reading sgx.static_address from manifest */
  239. if (get_config(enclave->config, "sgx.static_address", cfgbuf, CONFIG_MAX) > 0 &&
  240. cfgbuf[0] == '1')
  241. enclave->baseaddr = heap_min;
  242. else
  243. enclave->baseaddr = heap_min = 0;
  244. TRY(read_enclave_token, enclave->token, &enclave_token);
  245. TRY(read_enclave_sigstruct, enclave->sigfile, &enclave_sigstruct);
  246. TRY(create_enclave,
  247. &enclave_secs, enclave->baseaddr, enclave->size, &enclave_token);
  248. enclave->baseaddr = enclave_secs.baseaddr;
  249. enclave->size = enclave_secs.size;
  250. enclave->ssaframesize = enclave_secs.ssaframesize * pagesize;
  251. struct stat stat;
  252. ret = INLINE_SYSCALL(fstat, 2, enclave->manifest, &stat);
  253. if (IS_ERR(ret))
  254. return -ERRNO(ret);
  255. int manifest_size = stat.st_size;
  256. /* Start populating enclave memory */
  257. struct mem_area {
  258. const char * desc;
  259. bool skip_eextend;
  260. bool is_binary;
  261. int fd;
  262. unsigned long addr, size, prot;
  263. enum sgx_page_type type;
  264. };
  265. struct mem_area * areas =
  266. __alloca(sizeof(areas[0]) * (10 + enclave->thread_num));
  267. int area_num = 0;
  268. #define set_area(_desc, _skip_eextend, _is_binary, _fd, _addr, _size, _prot, _type)\
  269. ({ \
  270. struct mem_area * _a = &areas[area_num++]; \
  271. _a->desc = _desc; _a->skip_eextend = _skip_eextend; \
  272. _a->is_binary = _is_binary; \
  273. _a->fd = _fd; _a->addr = _addr; _a->size = _size; \
  274. _a->prot = _prot; _a->type = _type; _a; \
  275. })
  276. struct mem_area * manifest_area =
  277. set_area("manifest", false, false, enclave->manifest,
  278. 0, ALLOC_ALIGNUP(manifest_size),
  279. PROT_READ, SGX_PAGE_REG);
  280. struct mem_area * ssa_area =
  281. set_area("ssa", true, false, -1, 0,
  282. enclave->thread_num * enclave->ssaframesize * SSAFRAMENUM,
  283. PROT_READ|PROT_WRITE, SGX_PAGE_REG);
  284. /* XXX: TCS should be part of measurement */
  285. struct mem_area * tcs_area =
  286. set_area("tcs", true, false, -1, 0, enclave->thread_num * pagesize,
  287. 0, SGX_PAGE_TCS);
  288. /* XXX: TLS should be part of measurement */
  289. struct mem_area * tls_area =
  290. set_area("tls", true, false, -1, 0, enclave->thread_num * pagesize,
  291. PROT_READ|PROT_WRITE, SGX_PAGE_REG);
  292. /* XXX: the enclave stack should be part of measurement */
  293. struct mem_area * stack_areas = &areas[area_num];
  294. for (int t = 0 ; t < enclave->thread_num ; t++)
  295. set_area("stack", true, false, -1, 0, ENCLAVE_STACK_SIZE,
  296. PROT_READ|PROT_WRITE, SGX_PAGE_REG);
  297. struct mem_area * pal_area =
  298. set_area("pal", false, true, enclave_image, 0, 0, 0, SGX_PAGE_REG);
  299. TRY(scan_enclave_binary,
  300. enclave_image, &pal_area->addr, &pal_area->size, &enclave_entry_addr);
  301. struct mem_area * exec_area = NULL;
  302. if (enclave->exec != -1) {
  303. exec_area = set_area("exec", false, true, enclave->exec, 0, 0,
  304. PROT_WRITE, SGX_PAGE_REG);
  305. TRY(scan_enclave_binary,
  306. enclave->exec, &exec_area->addr, &exec_area->size, NULL);
  307. }
  308. unsigned long populating = enclave->size;
  309. for (int i = 0 ; i < area_num ; i++) {
  310. if (areas[i].addr)
  311. continue;
  312. areas[i].addr = populating - areas[i].size;
  313. if (&areas[i] == exec_area)
  314. populating = areas[i].addr;
  315. else
  316. populating = areas[i].addr - MEMORY_GAP;
  317. }
  318. enclave_entry_addr += pal_area->addr;
  319. if (exec_area) {
  320. if (exec_area->addr + exec_area->size > pal_area->addr)
  321. return -EINVAL;
  322. if (exec_area->addr + exec_area->size < populating) {
  323. if (populating > heap_min) {
  324. unsigned long addr = exec_area->addr + exec_area->size;
  325. if (addr < heap_min)
  326. addr = heap_min;
  327. set_area("free", true, false, -1, addr, populating - addr,
  328. PROT_READ|PROT_WRITE|PROT_EXEC, SGX_PAGE_REG);
  329. }
  330. populating = exec_area->addr;
  331. }
  332. }
  333. if (populating > heap_min) {
  334. set_area("free", true, false, -1, heap_min, populating - heap_min,
  335. PROT_READ|PROT_WRITE|PROT_EXEC, SGX_PAGE_REG);
  336. }
  337. for (int i = 0 ; i < area_num ; i++) {
  338. if (areas[i].fd != -1 && areas[i].is_binary) {
  339. TRY(load_enclave_binary,
  340. &enclave_secs, areas[i].fd, areas[i].addr, areas[i].prot);
  341. continue;
  342. }
  343. void * data = NULL;
  344. if (strcmp_static(areas[i].desc, "tls")) {
  345. data = (void *) INLINE_SYSCALL(mmap, 6, NULL, areas[i].size,
  346. PROT_READ|PROT_WRITE,
  347. MAP_ANON|MAP_PRIVATE, -1, 0);
  348. for (int t = 0 ; t < enclave->thread_num ; t++) {
  349. struct enclave_tls * gs = data + pagesize * t;
  350. gs->enclave_size = enclave->size;
  351. gs->tcs_offset = tcs_area->addr + pagesize * t;
  352. gs->initial_stack_offset =
  353. stack_areas[t].addr + ENCLAVE_STACK_SIZE;
  354. gs->ssa = (void *) ssa_area->addr +
  355. enclave->ssaframesize * SSAFRAMENUM * t +
  356. enclave_secs.baseaddr;
  357. gs->gpr = gs->ssa +
  358. enclave->ssaframesize - sizeof(sgx_arch_gpr_t);
  359. enclave_thread_gprs[t] = (unsigned long) gs->gpr;
  360. }
  361. goto add_pages;
  362. }
  363. if (strcmp_static(areas[i].desc, "tcs")) {
  364. data = (void *) INLINE_SYSCALL(mmap, 6, NULL, areas[i].size,
  365. PROT_READ|PROT_WRITE,
  366. MAP_ANON|MAP_PRIVATE, -1, 0);
  367. for (int t = 0 ; t < enclave->thread_num ; t++) {
  368. sgx_arch_tcs_t * tcs = data + pagesize * t;
  369. memset(tcs, 0, pagesize);
  370. tcs->ossa = ssa_area->addr +
  371. enclave->ssaframesize * SSAFRAMENUM * t;
  372. tcs->nssa = 2;
  373. tcs->oentry = enclave_entry_addr;
  374. tcs->ofsbasgx = 0;
  375. tcs->ogsbasgx = tls_area->addr + t * pagesize;
  376. tcs->fslimit = 0xfff;
  377. tcs->gslimit = 0xfff;
  378. }
  379. goto add_pages;
  380. }
  381. if (areas[i].fd != -1)
  382. data = (void *) INLINE_SYSCALL(mmap, 6, NULL, areas[i].size,
  383. PROT_READ,
  384. MAP_FILE|MAP_PRIVATE,
  385. areas[i].fd, 0);
  386. add_pages:
  387. TRY(add_pages_to_enclave,
  388. &enclave_secs, (void *) areas[i].addr, data, areas[i].size,
  389. areas[i].type, areas[i].prot, areas[i].skip_eextend,
  390. areas[i].desc);
  391. if (data)
  392. INLINE_SYSCALL(munmap, 2, data, areas[i].size);
  393. }
  394. TRY(init_enclave, &enclave_secs, &enclave_sigstruct, &enclave_token);
  395. create_tcs_mapper((void *) enclave_secs.baseaddr + tcs_area->addr,
  396. enclave->thread_num);
  397. struct pal_sec * pal_sec = &enclave->pal_sec;
  398. pal_sec->enclave_addr = (PAL_PTR) (enclave_secs.baseaddr + pal_area->addr);
  399. pal_sec->heap_min = (void *) enclave_secs.baseaddr + heap_min;
  400. pal_sec->heap_max = (void *) enclave_secs.baseaddr + pal_area->addr - MEMORY_GAP;
  401. if (exec_area) {
  402. pal_sec->exec_addr = (void *) enclave_secs.baseaddr + exec_area->addr;
  403. pal_sec->exec_size = exec_area->size;
  404. }
  405. pal_sec->manifest_addr = (void *) enclave_secs.baseaddr + manifest_area->addr;
  406. pal_sec->manifest_size = manifest_size;
  407. memcpy(pal_sec->mrenclave, enclave_secs.mrenclave,
  408. sizeof(sgx_arch_hash_t));
  409. memcpy(pal_sec->mrsigner, enclave_secs.mrsigner,
  410. sizeof(sgx_arch_hash_t));
  411. memcpy(&pal_sec->enclave_attributes, &enclave_secs.attributes,
  412. sizeof(sgx_arch_attributes_t));
  413. struct enclave_dbginfo * dbg = (void *)
  414. INLINE_SYSCALL(mmap, 6, DBGINFO_ADDR,
  415. sizeof(struct enclave_dbginfo),
  416. PROT_READ|PROT_WRITE,
  417. MAP_PRIVATE|MAP_ANONYMOUS|MAP_FIXED,
  418. -1, 0);
  419. if (IS_ERR_P(dbg)) {
  420. SGX_DBG(DBG_E, "Cannot allocate debug info\n");
  421. return 0;
  422. }
  423. dbg->pid = INLINE_SYSCALL(getpid, 0);
  424. dbg->base = enclave->baseaddr;
  425. dbg->size = enclave->size;
  426. dbg->aep = (unsigned long) async_exit_pointer;
  427. dbg->thread_tids[0] = dbg->pid;
  428. for (int i = 0 ; i < MAX_DBG_THREADS ; i++)
  429. dbg->thread_gprs[i] = enclave_thread_gprs[i];
  430. return 0;
  431. err:
  432. return ret;
  433. }
  434. static int mcast_s (int port)
  435. {
  436. struct sockaddr_in addr;
  437. int ret = 0;
  438. addr.sin_family = AF_INET;
  439. addr.sin_addr.s_addr = INADDR_ANY;
  440. addr.sin_port = htons(port);
  441. int fd = INLINE_SYSCALL(socket, 3, AF_INET, SOCK_DGRAM, 0);
  442. if (IS_ERR(fd))
  443. return -PAL_ERROR_DENIED;
  444. ret = INLINE_SYSCALL(setsockopt, 5, fd, IPPROTO_IP, IP_MULTICAST_IF,
  445. &addr.sin_addr.s_addr, sizeof(addr.sin_addr.s_addr));
  446. if (IS_ERR(ret))
  447. return -PAL_ERROR_DENIED;
  448. return fd;
  449. }
  450. static int mcast_c (int port)
  451. {
  452. int ret = 0, fd;
  453. struct sockaddr_in addr;
  454. addr.sin_family = AF_INET;
  455. addr.sin_addr.s_addr = INADDR_ANY;
  456. addr.sin_port = htons(port);
  457. fd = INLINE_SYSCALL(socket, 3, AF_INET, SOCK_DGRAM, 0);
  458. if (IS_ERR(fd))
  459. return -PAL_ERROR_DENIED;
  460. int reuse = 1;
  461. INLINE_SYSCALL(setsockopt, 5, fd, SOL_SOCKET, SO_REUSEADDR,
  462. &reuse, sizeof(reuse));
  463. ret = INLINE_SYSCALL(bind, 3, fd, &addr, sizeof(addr));
  464. if (IS_ERR(ret))
  465. return -PAL_ERROR_DENIED;
  466. ret = INLINE_SYSCALL(setsockopt, 5, fd, IPPROTO_IP, IP_MULTICAST_IF,
  467. &addr.sin_addr.s_addr, sizeof(addr.sin_addr.s_addr));
  468. if (IS_ERR(ret))
  469. return -PAL_ERROR_DENIED;
  470. inet_pton4(MCAST_GROUP, sizeof(MCAST_GROUP) - 1,
  471. &addr.sin_addr.s_addr);
  472. struct ip_mreq group;
  473. group.imr_multiaddr.s_addr = addr.sin_addr.s_addr;
  474. group.imr_interface.s_addr = INADDR_ANY;
  475. ret = INLINE_SYSCALL(setsockopt, 5, fd, IPPROTO_IP, IP_ADD_MEMBERSHIP,
  476. &group, sizeof(group));
  477. if (IS_ERR(ret))
  478. return -PAL_ERROR_DENIED;
  479. return fd;
  480. }
  481. static unsigned long randval = 0;
  482. int getrand (void * buffer, int size)
  483. {
  484. unsigned long val;
  485. int bytes = 0;
  486. val = randval;
  487. randval++;
  488. while (bytes + sizeof(unsigned long) <= size) {
  489. *(unsigned long *) (buffer + bytes) = val;
  490. val = hash64(val);
  491. bytes += sizeof(unsigned long);
  492. }
  493. if (bytes < size) {
  494. switch (size - bytes) {
  495. case 4:
  496. *(unsigned int *) (buffer + bytes) = randval & 0xffffffff;
  497. bytes += 4;
  498. break;
  499. case 2:
  500. *(unsigned short *) (buffer + bytes) = randval & 0xffff;
  501. bytes += 2;
  502. break;
  503. case 1:
  504. *(unsigned char *) (buffer + bytes) = randval & 0xff;
  505. bytes++;
  506. break;
  507. default: break;
  508. }
  509. randval = hash64(randval);
  510. }
  511. randval = val;
  512. return bytes;
  513. }
  514. static int create_instance (struct pal_sec * pal_sec)
  515. {
  516. unsigned int id;
  517. if (!getrand(&id, sizeof(unsigned int))) {
  518. SGX_DBG(DBG_E, "Unable to generate random numbers\n");
  519. return -PAL_ERROR_DENIED;
  520. }
  521. snprintf(pal_sec->pipe_prefix, sizeof(pal_sec->pipe_prefix),
  522. "/graphene/%x/", id);
  523. pal_sec->instance_id = id;
  524. return 0;
  525. }
  526. int load_manifest (int fd, struct config_store ** config_ptr)
  527. {
  528. int nbytes = INLINE_SYSCALL(lseek, 3, fd, 0, SEEK_END);
  529. if (IS_ERR(nbytes))
  530. return -ERRNO(nbytes);
  531. struct config_store * config = malloc(sizeof(struct config_store));
  532. if (!config)
  533. return -ENOMEM;
  534. void * config_raw = (void *)
  535. INLINE_SYSCALL(mmap, 6, NULL, nbytes,
  536. PROT_READ|PROT_WRITE, MAP_PRIVATE,
  537. fd, 0);
  538. if (IS_ERR_P(config_raw))
  539. return -ERRNO_P(config_raw);
  540. config->raw_data = config_raw;
  541. config->raw_size = nbytes;
  542. config->malloc = malloc;
  543. config->free = NULL;
  544. const char * errstring = NULL;
  545. int ret = read_config(config, NULL, &errstring);
  546. if (ret < 0) {
  547. SGX_DBG(DBG_E, "can't read manifest: %s\n", errstring);
  548. return ret;
  549. }
  550. *config_ptr = config;
  551. return 0;
  552. }
  553. static int load_enclave (struct pal_enclave * enclave,
  554. const char * manifest_uri,
  555. const char * exec_uri,
  556. const char ** arguments, const char ** environments)
  557. {
  558. struct pal_sec * pal_sec = &enclave->pal_sec;
  559. int ret;
  560. const char * errstring;
  561. struct timeval tv;
  562. #if PRINT_ENCLAVE_STAT == 1
  563. INLINE_SYSCALL(gettimeofday, 2, &tv, NULL);
  564. pal_sec->start_time = tv.tv_sec * 1000000UL + tv.tv_usec;
  565. #endif
  566. ret = open_gsgx();
  567. if (ret < 0) {
  568. SGX_DBG(DBG_E, "cannot open device /dev/gsgx, possibly the kernel "
  569. "module is not loaded.\n");
  570. return ret;
  571. }
  572. ret = check_wrfsbase_support();
  573. if (ret < 0)
  574. return ret;
  575. if (!ret)
  576. return -EPERM;
  577. INLINE_SYSCALL(gettimeofday, 2, &tv, NULL);
  578. randval = tv.tv_sec * 1000000UL + tv.tv_usec;
  579. pal_sec->pid = INLINE_SYSCALL(getpid, 0);
  580. pal_sec->uid = INLINE_SYSCALL(getuid, 0);
  581. pal_sec->gid = INLINE_SYSCALL(getgid, 0);
  582. #ifdef DEBUG
  583. for (const char ** e = environments ; *e ; e++) {
  584. if (strcmp_static(*e, "IN_GDB=1")) {
  585. SGX_DBG(DBG_I, "being GDB'ed!!!\n");
  586. pal_sec->in_gdb = true;
  587. }
  588. if (strcmp_static(*e, "LD_PRELOAD="))
  589. *e = "\0";
  590. }
  591. #endif
  592. char cfgbuf[CONFIG_MAX];
  593. enclave->manifest = INLINE_SYSCALL(open, 3, manifest_uri + 5,
  594. O_RDONLY|O_CLOEXEC, 0);
  595. if (IS_ERR(enclave->manifest)) {
  596. SGX_DBG(DBG_E, "cannot open manifest %s\n", manifest_uri);
  597. return -EINVAL;
  598. }
  599. ret = load_manifest(enclave->manifest, &enclave->config);
  600. if (ret < 0) {
  601. SGX_DBG(DBG_E, "invalid manifest: %s\n", manifest_uri);
  602. return -EINVAL;
  603. }
  604. if (exec_uri == NULL) {
  605. if (get_config(enclave->config, "loader.exec", cfgbuf, CONFIG_MAX) > 0) {
  606. exec_uri = resolve_uri(cfgbuf, &errstring);
  607. if (!exec_uri) {
  608. SGX_DBG(DBG_E, "%s: %s\n", errstring, cfgbuf);
  609. return -EINVAL;
  610. }
  611. }
  612. }
  613. if (exec_uri) {
  614. enclave->exec = INLINE_SYSCALL(open, 3,
  615. exec_uri + static_strlen("file:"),
  616. O_RDONLY|O_CLOEXEC, 0);
  617. if (IS_ERR(enclave->exec)) {
  618. SGX_DBG(DBG_E, "cannot open executable %s\n", exec_uri);
  619. return -EINVAL;
  620. }
  621. } else {
  622. enclave->exec = -1;
  623. }
  624. if (get_config(enclave->config, "sgx.sigfile", cfgbuf, CONFIG_MAX) < 0) {
  625. SGX_DBG(DBG_E, "sigstruct file not found. Must have \'sgx.sigfile\' in the manifest\n");
  626. return -EINVAL;
  627. }
  628. const char * uri = resolve_uri(cfgbuf, &errstring);
  629. if (!uri) {
  630. SGX_DBG(DBG_E, "%s: %s\n", errstring, cfgbuf);
  631. return -EINVAL;
  632. }
  633. if (!strcmp_static(uri + strlen(uri) - 4, ".sig")) {
  634. SGX_DBG(DBG_E, "Invalid sigstruct file URI as %s\n", cfgbuf);
  635. return -EINVAL;
  636. }
  637. enclave->sigfile = INLINE_SYSCALL(open, 3, uri + 5, O_RDONLY|O_CLOEXEC, 0);
  638. if (IS_ERR(enclave->sigfile)) {
  639. SGX_DBG(DBG_E, "cannot open sigstruct file %s\n", uri);
  640. return -EINVAL;
  641. }
  642. uri = alloc_concat(uri, strlen(uri) - 4, ".token", -1);
  643. enclave->token = INLINE_SYSCALL(open, 3, uri + 5, O_RDONLY|O_CLOEXEC, 0);
  644. if (IS_ERR(enclave->token)) {
  645. SGX_DBG(DBG_E, "cannot open token \'%s\'. Use \'"
  646. PAL_FILE("pal-sgx-get-token")
  647. "\' on the runtime host, or run \'make SGX_RUN=1\' "
  648. "in the Graphene source, to create the token file.\n",
  649. uri);
  650. return -EINVAL;
  651. }
  652. /* Initialize the enclave */
  653. ret = initialize_enclave(enclave);
  654. if (ret < 0)
  655. return ret;
  656. snprintf(pal_sec->enclave_image, sizeof(PAL_SEC_STR), "%s",
  657. ENCLAVE_FILENAME);
  658. if (!pal_sec->instance_id)
  659. create_instance(&enclave->pal_sec);
  660. pal_sec->manifest_fd = enclave->manifest;
  661. memcpy(pal_sec->manifest_name, manifest_uri, strlen(manifest_uri) + 1);
  662. if (enclave->exec == -1) {
  663. pal_sec->exec_fd = PAL_IDX_POISON;
  664. memset(pal_sec->exec_name, 0, sizeof(PAL_SEC_STR));
  665. } else {
  666. pal_sec->exec_fd = enclave->exec;
  667. memcpy(pal_sec->exec_name, exec_uri, strlen(exec_uri) + 1);
  668. }
  669. if (!pal_sec->mcast_port) {
  670. unsigned short mcast_port;
  671. getrand(&mcast_port, sizeof(unsigned short));
  672. pal_sec->mcast_port = mcast_port > 1024 ? mcast_port : mcast_port + 1024;
  673. }
  674. if ((ret = mcast_s(pal_sec->mcast_port)) >= 0) {
  675. pal_sec->mcast_srv = ret;
  676. if ((ret = mcast_c(pal_sec->mcast_port)) >= 0) {
  677. pal_sec->mcast_cli = ret;
  678. } else {
  679. INLINE_SYSCALL(close, 1, pal_sec->mcast_srv);
  680. pal_sec->mcast_srv = 0;
  681. }
  682. }
  683. /* setup signal handling */
  684. ret = sgx_signal_setup();
  685. if (ret < 0)
  686. return ret;
  687. current_enclave = enclave;
  688. map_tcs(INLINE_SYSCALL(gettid, 0));
  689. /* start running trusted PAL */
  690. ecall_enclave_start(arguments, environments);
  691. PAL_NUM exit_time = 0;
  692. #if PRINT_ENCLAVE_STAT == 1
  693. INLINE_SYSCALL(gettimeofday, 2, &tv, NULL);
  694. exit_time = tv.tv_sec * 1000000UL + tv.tv_usec;
  695. #endif
  696. unmap_tcs();
  697. INLINE_SYSCALL(exit, 0);
  698. return 0;
  699. }
  700. int main (int argc, const char ** argv, const char ** envp)
  701. {
  702. const char * manifest_uri = NULL, * exec_uri = NULL;
  703. const char * pal_loader = argv[0];
  704. argc--;
  705. argv++;
  706. struct pal_enclave * enclave = malloc(sizeof(struct pal_enclave));
  707. if (!enclave)
  708. return -ENOMEM;
  709. memset(enclave, 0, sizeof(struct pal_enclave));
  710. int is_child = sgx_init_child_process(&enclave->pal_sec);
  711. if (is_child < 0)
  712. return is_child;
  713. if (!is_child) {
  714. /* occupy PROC_INIT_FD so no one will use it */
  715. INLINE_SYSCALL(dup2, 2, 0, PROC_INIT_FD);
  716. if (!argc)
  717. goto usage;
  718. if (strcmp_static(argv[0], "file:")) {
  719. exec_uri = alloc_concat(argv[0], -1, NULL, -1);
  720. } else {
  721. exec_uri = alloc_concat("file:", -1, argv[0], -1);
  722. }
  723. } else {
  724. exec_uri = alloc_concat(enclave->pal_sec.exec_name, -1, NULL, -1);
  725. }
  726. int fd = INLINE_SYSCALL(open, 3, exec_uri + 5, O_RDONLY|O_CLOEXEC, 0);
  727. if (IS_ERR(fd))
  728. return -ERRNO(fd);
  729. char filebuf[4];
  730. /* check if the first argument is a executable. If it is, try finding
  731. all the possible manifest files */
  732. INLINE_SYSCALL(read, 3, fd, filebuf, 4);
  733. INLINE_SYSCALL(close, 1, fd);
  734. char sgx_manifest[URI_MAX];
  735. int len = get_base_name(exec_uri + static_strlen("file:"), sgx_manifest,
  736. URI_MAX);
  737. if (len < 0)
  738. return len;
  739. if (strcmp_static(sgx_manifest + len - strlen(".manifest"), ".manifest")) {
  740. strcpy_static(sgx_manifest + len, ".sgx", URI_MAX - len);
  741. } else if (!strcmp_static(sgx_manifest + len - strlen(".manifest.sgx"),
  742. ".manifest.sgx")) {
  743. strcpy_static(sgx_manifest + len, ".manifest.sgx", URI_MAX - len);
  744. }
  745. if (memcmp(filebuf, "\177ELF", 4)) {
  746. manifest_uri = exec_uri;
  747. exec_uri = NULL;
  748. }
  749. fd = INLINE_SYSCALL(open, 3, sgx_manifest, O_RDONLY|O_CLOEXEC, 0);
  750. if (!IS_ERR(fd)) {
  751. manifest_uri = alloc_concat("file:", static_strlen("file:"),
  752. sgx_manifest, -1);
  753. INLINE_SYSCALL(close, 1, fd);
  754. } else if (!manifest_uri) {
  755. SGX_DBG(DBG_E, "cannot open manifest file: %s\n", sgx_manifest);
  756. goto usage;
  757. }
  758. SGX_DBG(DBG_I, "manifest file: %s\n", manifest_uri);
  759. return load_enclave(enclave, manifest_uri, exec_uri, argv, envp);
  760. usage:
  761. SGX_DBG(DBG_E, "USAGE: %s [executable|manifest] args ...\n", pal_loader);
  762. return -EINVAL;
  763. }
  764. int pal_init_enclave (const char * manifest_uri,
  765. const char * exec_uri,
  766. const char ** arguments, const char ** environments)
  767. {
  768. if (!manifest_uri)
  769. return -PAL_ERROR_INVAL;
  770. struct pal_enclave * enclave = malloc(sizeof(struct pal_enclave));
  771. if (!enclave)
  772. return -PAL_ERROR_NOMEM;
  773. memset(enclave, 0, sizeof(struct pal_enclave));
  774. return load_enclave(enclave, manifest_uri, exec_uri,
  775. arguments, environments);
  776. }