enclave_creator_hw.cpp 7.3 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253
  1. /*
  2. * Copyright (C) 2011-2016 Intel Corporation. All rights reserved.
  3. *
  4. * Redistribution and use in source and binary forms, with or without
  5. * modification, are permitted provided that the following conditions
  6. * are met:
  7. *
  8. * * Redistributions of source code must retain the above copyright
  9. * notice, this list of conditions and the following disclaimer.
  10. * * Redistributions in binary form must reproduce the above copyright
  11. * notice, this list of conditions and the following disclaimer in
  12. * the documentation and/or other materials provided with the
  13. * distribution.
  14. * * Neither the name of Intel Corporation nor the names of its
  15. * contributors may be used to endorse or promote products derived
  16. * from this software without specific prior written permission.
  17. *
  18. * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  19. * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  20. * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
  21. * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
  22. * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  23. * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
  24. * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
  25. * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
  26. * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  27. * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  28. * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  29. *
  30. */
  31. #include "enclave_creator_hw.h"
  32. #include "se_trace.h"
  33. #include "se_page_attr.h"
  34. #include "isgx_user.h"
  35. #include "sig_handler.h"
  36. #include "se_error_internal.h"
  37. #include "se_memcpy.h"
  38. #include "se_atomic.h"
  39. #include "se_detect.h"
  40. #include "cpuid.h"
  41. #include <assert.h>
  42. #include <sys/types.h>
  43. #include <sys/stat.h>
  44. #include <fcntl.h>
  45. #include <sys/ioctl.h>
  46. #include <errno.h>
  47. #include <sys/mman.h>
  48. #include <stdlib.h>
  49. EnclaveCreator* g_enclave_creator = new EnclaveCreatorHW();
  50. static uint32_t g_eid_low = 0x1;
  51. static uint32_t g_eid_high = 0x0;
  52. EnclaveCreatorHW::EnclaveCreatorHW():
  53. m_hdevice(-1),
  54. m_sig_registered(false)
  55. {
  56. se_mutex_init(&m_sig_mutex);
  57. }
  58. EnclaveCreatorHW::~EnclaveCreatorHW()
  59. {
  60. close_se_device();
  61. }
  62. int EnclaveCreatorHW::error_driver2urts(int driver_error)
  63. {
  64. int ret = SGX_ERROR_UNEXPECTED;
  65. switch(driver_error)
  66. {
  67. case ISGX_ERROR:
  68. if(ENOMEM == errno)
  69. ret = SGX_ERROR_OUT_OF_MEMORY;
  70. else
  71. ret = SGX_ERROR_NO_DEVICE;
  72. break;
  73. case ISGX_INVALID_ATTRIBUTE:
  74. ret = SGX_ERROR_INVALID_ATTRIBUTE;
  75. break;
  76. case ISGX_INVALID_MEASUREMENT:
  77. ret = SE_ERROR_INVALID_MEASUREMENT;
  78. break;
  79. case ISGX_INVALID_SIG_STRUCT:
  80. case ISGX_INVALID_SIGNATIRE:
  81. ret = SGX_ERROR_INVALID_SIGNATURE;
  82. break;
  83. case ISGX_INVALID_LAUNCH_TOKEN:
  84. ret = SE_ERROR_INVALID_LAUNCH_TOKEN;
  85. break;
  86. case ISGX_INVALID_CPUSVN:
  87. ret = SGX_ERROR_INVALID_CPUSVN;
  88. break;
  89. case ISGX_INVALID_ISVSVN:
  90. ret = SGX_ERROR_INVALID_ISVSVN;
  91. break;
  92. case ISGX_UNMASKED_EVENT:
  93. ret = SGX_ERROR_DEVICE_BUSY;
  94. break;
  95. case (int)ISGX_POWER_LOST_ENCLAVE: // [-Wc++11-narrowing]
  96. ret = SGX_ERROR_ENCLAVE_LOST;
  97. break;
  98. default:
  99. SE_TRACE(SE_TRACE_WARNING, "unexpected error %#x from driver, should be uRTS/driver bug\n", ret);
  100. ret = SGX_ERROR_UNEXPECTED;
  101. break;
  102. }
  103. return ret;
  104. }
  105. int EnclaveCreatorHW::create_enclave(secs_t *secs, sgx_enclave_id_t *enclave_id, void **start_addr, bool ae)
  106. {
  107. assert(secs != NULL && enclave_id != NULL && start_addr != NULL);
  108. UNUSED(ae);
  109. if (false == open_se_device())
  110. return SGX_ERROR_NO_DEVICE;
  111. SE_TRACE(SE_TRACE_DEBUG, "\n secs.attibutes.flags = %llx, secs.attributes.xfrm = %llx \n"
  112. , secs->attributes.flags, secs->attributes.xfrm);
  113. struct isgx_create_param param = { secs, 0 };
  114. int ret = ioctl(m_hdevice, ISGX_IOCTL_ENCLAVE_CREATE, &param);
  115. if(ret) {
  116. SE_TRACE(SE_TRACE_WARNING, "\nISGX_IOCTL_ENCLAVE_CREATE fails: errno = %x\n", errno);
  117. return error_driver2urts(ret);
  118. }
  119. uint32_t tmp = se_atomic_inc(&g_eid_low);
  120. //32bit overflow
  121. if(0 == tmp)
  122. g_eid_high++;
  123. *enclave_id = ((uint64_t)g_eid_high << 32) | g_eid_low;
  124. *start_addr = secs->base = (void *)param.addr;
  125. return SGX_SUCCESS;
  126. }
  127. int EnclaveCreatorHW::add_enclave_page(sgx_enclave_id_t enclave_id, void *src, uint64_t rva, const sec_info_t &sinfo, uint32_t attr)
  128. {
  129. assert((rva & ((1<<SE_PAGE_SHIFT)-1)) == 0);
  130. void* source = src;
  131. uint8_t color_page[SE_PAGE_SIZE] = { 0 };
  132. if(NULL == source)
  133. {
  134. memset(color_page, 0, SE_PAGE_SIZE);
  135. source = reinterpret_cast<void*>(&color_page);
  136. }
  137. int ret = 0;
  138. struct isgx_add_param addp = { 0, 0, 0, 0 };
  139. addp.addr = (unsigned long)enclave_id + (unsigned long)rva;
  140. addp.user_addr = reinterpret_cast<unsigned long>(source);
  141. addp.secinfo = (void *)const_cast<sec_info_t *>(&sinfo);
  142. if(!((1<<DoEEXTEND) & attr))
  143. addp.flags |= ISGX_ADD_SKIP_EEXTEND;
  144. ret = ioctl(m_hdevice, ISGX_IOCTL_ENCLAVE_ADD_PAGE, &addp);
  145. if(ret) {
  146. SE_TRACE(SE_TRACE_WARNING, "\nAdd Page - %p to %p... FAIL\n", source, rva);
  147. return error_driver2urts(ret);
  148. }
  149. return SGX_SUCCESS;
  150. }
  151. int EnclaveCreatorHW::try_init_enclave(sgx_enclave_id_t enclave_id, enclave_css_t *enclave_css, token_t *launch)
  152. {
  153. int ret = 0;
  154. struct isgx_init_param initp = { 0, NULL, NULL };
  155. initp.addr = (unsigned long)enclave_id;
  156. initp.sigstruct = reinterpret_cast<char*>(enclave_css);
  157. //launch should NOT be NULL, because it has been checked in urts_com.h::_create_enclave(...)
  158. assert(launch != NULL);
  159. initp.einittoken = reinterpret_cast<void *>(launch);
  160. ret = ioctl(m_hdevice, ISGX_IOCTL_ENCLAVE_INIT, &initp);
  161. if (ret) {
  162. SE_TRACE(SE_TRACE_WARNING, "\nISGX_IOCTL_ENCLAVE_INIT fails error = %x\n", ret);
  163. return error_driver2urts(ret);
  164. }
  165. //register signal handler
  166. se_mutex_lock(&m_sig_mutex);
  167. if(false == m_sig_registered)
  168. {
  169. reg_sig_handler();
  170. m_sig_registered = true;
  171. }
  172. se_mutex_unlock(&m_sig_mutex);
  173. return SGX_SUCCESS;
  174. }
  175. int EnclaveCreatorHW::destroy_enclave(sgx_enclave_id_t enclave_id)
  176. {
  177. int ret = 0;
  178. isgx_destroy_param param = { (unsigned long)enclave_id };
  179. ret = ioctl(m_hdevice, ISGX_IOCTL_ENCLAVE_DESTROY, &param);
  180. if (-1 == ret) {
  181. SE_TRACE(SE_TRACE_WARNING, "destroy SGX enclave failed, error = %d\n", errno);
  182. ret = SGX_ERROR_UNEXPECTED;
  183. }
  184. else
  185. {
  186. ret = SGX_SUCCESS;
  187. }
  188. return ret;
  189. }
  190. bool EnclaveCreatorHW::get_plat_cap(sgx_misc_attribute_t *misc_attr)
  191. {
  192. return get_plat_cap_by_cpuid(misc_attr);
  193. }
  194. bool EnclaveCreatorHW::open_se_device()
  195. {
  196. LockGuard lock(&m_dev_mutex);
  197. int fd = -1;
  198. if(-1 != m_hdevice)
  199. {
  200. return true;
  201. }
  202. fd = open("/dev/isgx", O_RDWR);
  203. if (-1 == fd) {
  204. SE_TRACE(SE_TRACE_WARNING, "open isgx device failed\n");
  205. return false;
  206. }
  207. m_hdevice = fd;
  208. return true;
  209. }
  210. void EnclaveCreatorHW::close_se_device()
  211. {
  212. LockGuard lock(&m_dev_mutex);
  213. if (m_hdevice != -1)
  214. {
  215. close(m_hdevice);
  216. m_hdevice = -1;
  217. }
  218. }