trts_veh.cpp 13 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411
  1. /*
  2. * Copyright (C) 2011-2017 Intel Corporation. All rights reserved.
  3. *
  4. * Redistribution and use in source and binary forms, with or without
  5. * modification, are permitted provided that the following conditions
  6. * are met:
  7. *
  8. * * Redistributions of source code must retain the above copyright
  9. * notice, this list of conditions and the following disclaimer.
  10. * * Redistributions in binary form must reproduce the above copyright
  11. * notice, this list of conditions and the following disclaimer in
  12. * the documentation and/or other materials provided with the
  13. * distribution.
  14. * * Neither the name of Intel Corporation nor the names of its
  15. * contributors may be used to endorse or promote products derived
  16. * from this software without specific prior written permission.
  17. *
  18. * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  19. * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  20. * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
  21. * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
  22. * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  23. * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
  24. * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
  25. * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
  26. * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  27. * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  28. * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  29. *
  30. */
  31. /**
  32. * File: trts_veh.cpp
  33. * Description:
  34. * This file implements the support of custom exception handling.
  35. */
  36. #include "sgx_trts_exception.h"
  37. #include <stdlib.h>
  38. #include "sgx_trts.h"
  39. #include "xsave.h"
  40. #include "arch.h"
  41. #include "sgx_spinlock.h"
  42. #include "thread_data.h"
  43. #include "global_data.h"
  44. #include "trts_internal.h"
  45. typedef struct _handler_node_t
  46. {
  47. uintptr_t callback;
  48. struct _handler_node_t *next;
  49. } handler_node_t;
  50. static handler_node_t *g_first_node = NULL;
  51. static sgx_spinlock_t g_handler_lock = SGX_SPINLOCK_INITIALIZER;
  52. static uintptr_t g_veh_cookie = 0;
  53. #define ENC_VEH_POINTER(x) (uintptr_t)(x) ^ g_veh_cookie
  54. #define DEC_VEH_POINTER(x) (sgx_exception_handler_t)((x) ^ g_veh_cookie)
  55. static bool is_stack_addr(void *address, size_t size)
  56. {
  57. thread_data_t *thread_data = get_thread_data();
  58. size_t stack_base = thread_data->stack_base_addr;
  59. size_t stack_limit = thread_data->stack_limit_addr;
  60. size_t addr = (size_t) address;
  61. return (addr <= (addr + size)) && (stack_base >= (addr + size)) && (stack_limit <= addr);
  62. }
  63. static bool is_valid_sp(uintptr_t sp)
  64. {
  65. return ( !(sp & (sizeof(uintptr_t) - 1)) // sp is expected to be 4/8 bytes aligned
  66. && is_stack_addr((void*)sp, 0) ); // sp points to the top/bottom of stack are accepted
  67. }
  68. // sgx_register_exception_handler()
  69. // register a custom exception handler
  70. // Parameter
  71. // is_first_handler - the order in which the handler should be called.
  72. // if the parameter is nonzero, the handler is the first handler to be called.
  73. // if the parameter is zero, the handler is the last handler to be called.
  74. // exception_handler - a pointer to the handler to be called.
  75. // Return Value
  76. // handler - success
  77. // NULL - fail
  78. void *sgx_register_exception_handler(int is_first_handler, sgx_exception_handler_t exception_handler)
  79. {
  80. // initialize g_veh_cookie for the first time sgx_register_exception_handler is called.
  81. if(unlikely(g_veh_cookie == 0))
  82. {
  83. uintptr_t rand = 0;
  84. do
  85. {
  86. if(SGX_SUCCESS != sgx_read_rand((unsigned char *)&rand, sizeof(rand)))
  87. {
  88. return NULL;
  89. }
  90. } while(rand == 0);
  91. sgx_spin_lock(&g_handler_lock);
  92. if(g_veh_cookie == 0)
  93. {
  94. g_veh_cookie = rand;
  95. }
  96. sgx_spin_unlock(&g_handler_lock);
  97. }
  98. if(!sgx_is_within_enclave((const void*)exception_handler, 0))
  99. {
  100. return NULL;
  101. }
  102. handler_node_t *node = (handler_node_t *)malloc(sizeof(handler_node_t));
  103. if(!node)
  104. {
  105. return NULL;
  106. }
  107. node->callback = ENC_VEH_POINTER(exception_handler);
  108. // write lock
  109. sgx_spin_lock(&g_handler_lock);
  110. if((g_first_node == NULL) || is_first_handler)
  111. {
  112. node->next = g_first_node;
  113. g_first_node = node;
  114. }
  115. else
  116. {
  117. handler_node_t *tmp = g_first_node;
  118. while(tmp->next != NULL)
  119. {
  120. tmp = tmp->next;
  121. }
  122. node->next = NULL;
  123. tmp->next = node;
  124. }
  125. // write unlock
  126. sgx_spin_unlock(&g_handler_lock);
  127. return node;
  128. }
  129. // sgx_unregister_exception_handler()
  130. // unregister a custom exception handler.
  131. // Parameter
  132. // handler - a handler to the custom exception handler previously
  133. // registered using the sgx_register_exception_handler function.
  134. // Return Value
  135. // none zero - success
  136. // 0 - fail
  137. int sgx_unregister_exception_handler(void *handler)
  138. {
  139. if(!handler)
  140. {
  141. return 0;
  142. }
  143. int status = 0;
  144. // write lock
  145. sgx_spin_lock(&g_handler_lock);
  146. if(g_first_node)
  147. {
  148. handler_node_t *node = g_first_node;
  149. if(node == handler)
  150. {
  151. g_first_node = node->next;
  152. status = 1;
  153. }
  154. else
  155. {
  156. while(node->next != NULL)
  157. {
  158. if(node->next == handler)
  159. {
  160. node->next = node->next->next;
  161. status = 1;
  162. break;
  163. }
  164. node = node->next;
  165. }
  166. }
  167. }
  168. // write unlock
  169. sgx_spin_unlock(&g_handler_lock);
  170. if(status) free(handler);
  171. return status;
  172. }
  173. // continue_execution(sgx_exception_info_t *info):
  174. // try to restore the thread context saved in info to current execution context.
  175. extern "C" __attribute__((regparm(1))) void continue_execution(sgx_exception_info_t *info);
  176. // internal_handle_exception(sgx_exception_info_t *info):
  177. // the 2nd phrase exception handing, which traverse registered exception handlers.
  178. // if the exception can be handled, then continue execution
  179. // otherwise, throw abortion, go back to 1st phrase, and call the default handler.
  180. extern "C" __attribute__((regparm(1))) void internal_handle_exception(sgx_exception_info_t *info)
  181. {
  182. int status = EXCEPTION_CONTINUE_SEARCH;
  183. handler_node_t *node = NULL;
  184. thread_data_t *thread_data = get_thread_data();
  185. size_t size = 0;
  186. uintptr_t *nhead = NULL;
  187. uintptr_t *ntmp = NULL;
  188. uintptr_t xsp = 0;
  189. if (thread_data->exception_flag < 0)
  190. goto failed_end;
  191. thread_data->exception_flag++;
  192. // read lock
  193. sgx_spin_lock(&g_handler_lock);
  194. node = g_first_node;
  195. while(node != NULL)
  196. {
  197. size += sizeof(uintptr_t);
  198. node = node->next;
  199. }
  200. // There's no exception handler registered
  201. if (size == 0)
  202. {
  203. sgx_spin_unlock(&g_handler_lock);
  204. //exception cannot be handled
  205. thread_data->exception_flag = -1;
  206. //instruction triggering the exception will be executed again.
  207. continue_execution(info);
  208. }
  209. if ((nhead = (uintptr_t *)malloc(size)) == NULL)
  210. {
  211. sgx_spin_unlock(&g_handler_lock);
  212. goto failed_end;
  213. }
  214. ntmp = nhead;
  215. node = g_first_node;
  216. while(node != NULL)
  217. {
  218. *ntmp = node->callback;
  219. ntmp++;
  220. node = node->next;
  221. }
  222. // read unlock
  223. sgx_spin_unlock(&g_handler_lock);
  224. // call exception handler until EXCEPTION_CONTINUE_EXECUTION is returned
  225. ntmp = nhead;
  226. while(size > 0)
  227. {
  228. sgx_exception_handler_t handler = DEC_VEH_POINTER(*ntmp);
  229. status = handler(info);
  230. if(EXCEPTION_CONTINUE_EXECUTION == status)
  231. {
  232. break;
  233. }
  234. ntmp++;
  235. size -= sizeof(sgx_exception_handler_t);
  236. }
  237. free(nhead);
  238. // call default handler
  239. // ignore invalid return value, treat to EXCEPTION_CONTINUE_SEARCH
  240. // check SP to be written on SSA is pointing to the trusted stack
  241. xsp = info->cpu_context.REG(sp);
  242. if (!is_valid_sp(xsp))
  243. {
  244. goto failed_end;
  245. }
  246. if(EXCEPTION_CONTINUE_EXECUTION == status)
  247. {
  248. //exception is handled, decrease the nested exception count
  249. thread_data->exception_flag--;
  250. }
  251. else
  252. {
  253. //exception cannot be handled
  254. thread_data->exception_flag = -1;
  255. }
  256. //instruction triggering the exception will be executed again.
  257. continue_execution(info);
  258. failed_end:
  259. thread_data->exception_flag = -1; // mark the current exception cannot be handled
  260. abort(); // throw abortion
  261. }
  262. // trts_handle_exception(void *tcs)
  263. // the entry point for the exceptoin handling
  264. // Parameter
  265. // the pointer of TCS
  266. // Return Value
  267. // none zero - success
  268. // 0 - fail
  269. #include "trts_internal.h"
  270. extern "C" sgx_status_t trts_handle_exception(void *tcs)
  271. {
  272. thread_data_t *thread_data = get_thread_data();
  273. ssa_gpr_t *ssa_gpr = NULL;
  274. sgx_exception_info_t *info = NULL;
  275. uintptr_t sp, *new_sp = NULL;
  276. size_t size = 0;
  277. if (tcs == NULL) goto default_handler;
  278. if(get_enclave_state() != ENCLAVE_INIT_DONE)
  279. {
  280. goto default_handler;
  281. }
  282. // check if the exception is raised from 2nd phrase
  283. if(thread_data->exception_flag == -1) {
  284. goto default_handler;
  285. }
  286. if ((TD2TCS(thread_data) != tcs)
  287. || (((thread_data->first_ssa_gpr)&(~0xfff)) - SE_PAGE_SIZE) != (uintptr_t)tcs) {
  288. goto default_handler;
  289. }
  290. // no need to check the result of ssa_gpr because thread_data is always trusted
  291. ssa_gpr = reinterpret_cast<ssa_gpr_t *>(thread_data->first_ssa_gpr);
  292. sp = ssa_gpr->REG(sp);
  293. if(!is_stack_addr((void*)sp, 0)) // check stack overrun only, alignment will be checked after exception handled
  294. {
  295. g_enclave_state = ENCLAVE_CRASHED;
  296. return SGX_ERROR_STACK_OVERRUN;
  297. }
  298. size = 0;
  299. #ifdef SE_GNU64
  300. size += 128; // x86_64 requires a 128-bytes red zone, which begins directly
  301. // after the return addr and includes func's arguments
  302. #endif
  303. // decrease the stack to give space for info
  304. size += sizeof(sgx_exception_info_t);
  305. sp -= size;
  306. sp = sp & ~0xF;
  307. // check the decreased sp to make sure it is in the trusted stack range
  308. if(!is_stack_addr((void *)sp, size))
  309. {
  310. g_enclave_state = ENCLAVE_CRASHED;
  311. return SGX_ERROR_STACK_OVERRUN;
  312. }
  313. if(ssa_gpr->exit_info.valid != 1)
  314. { // exception handlers are not allowed to call in a non-exception state
  315. goto default_handler;
  316. }
  317. info = (sgx_exception_info_t *)sp;
  318. // No need to check the stack as it have already been checked by assembly code
  319. // initialize the info with SSA[0]
  320. info->exception_vector = (sgx_exception_vector_t)ssa_gpr->exit_info.vector;
  321. info->exception_type = (sgx_exception_type_t)ssa_gpr->exit_info.exit_type;
  322. info->cpu_context.REG(ax) = ssa_gpr->REG(ax);
  323. info->cpu_context.REG(cx) = ssa_gpr->REG(cx);
  324. info->cpu_context.REG(dx) = ssa_gpr->REG(dx);
  325. info->cpu_context.REG(bx) = ssa_gpr->REG(bx);
  326. info->cpu_context.REG(sp) = ssa_gpr->REG(sp);
  327. info->cpu_context.REG(bp) = ssa_gpr->REG(bp);
  328. info->cpu_context.REG(si) = ssa_gpr->REG(si);
  329. info->cpu_context.REG(di) = ssa_gpr->REG(di);
  330. info->cpu_context.REG(flags) = ssa_gpr->REG(flags);
  331. info->cpu_context.REG(ip) = ssa_gpr->REG(ip);
  332. #ifdef SE_64
  333. info->cpu_context.r8 = ssa_gpr->r8;
  334. info->cpu_context.r9 = ssa_gpr->r9;
  335. info->cpu_context.r10 = ssa_gpr->r10;
  336. info->cpu_context.r11 = ssa_gpr->r11;
  337. info->cpu_context.r12 = ssa_gpr->r12;
  338. info->cpu_context.r13 = ssa_gpr->r13;
  339. info->cpu_context.r14 = ssa_gpr->r14;
  340. info->cpu_context.r15 = ssa_gpr->r15;
  341. #endif
  342. // decrease the stack to save the SSA[0]->ip
  343. size = sizeof(uintptr_t);
  344. new_sp = (uintptr_t *)(sp - size);
  345. if(!is_stack_addr(new_sp, size))
  346. {
  347. g_enclave_state = ENCLAVE_CRASHED;
  348. return SGX_ERROR_STACK_OVERRUN;
  349. }
  350. ssa_gpr->REG(ip) = (size_t)internal_handle_exception; // prepare the ip for 2nd phrase handling
  351. ssa_gpr->REG(sp) = (size_t)new_sp; // new stack for internal_handle_exception
  352. ssa_gpr->REG(ax) = (size_t)info; // 1st parameter (info) for LINUX32
  353. ssa_gpr->REG(di) = (size_t)info; // 1st parameter (info) for LINUX64, LINUX32 also uses it while restoring the context
  354. *new_sp = info->cpu_context.REG(ip); // for debugger to get call trace
  355. //mark valid to 0 to prevent eenter again
  356. ssa_gpr->exit_info.valid = 0;
  357. return SGX_SUCCESS;
  358. default_handler:
  359. g_enclave_state = ENCLAVE_CRASHED;
  360. return SGX_ERROR_ENCLAVE_CRASHED;
  361. }