123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387 |
-
- #include "enclave.h"
- #include "enclave_creator_hw.h"
- #include "edmm_utility.h"
- #include "se_trace.h"
- #include "se_page_attr.h"
- #include "isgx_user.h"
- #include "sig_handler.h"
- #include "se_error_internal.h"
- #include "se_memcpy.h"
- #include "se_atomic.h"
- #include "se_detect.h"
- #include "cpuid.h"
- #include "rts.h"
- #include <assert.h>
- #include <sys/ioctl.h>
- #include <errno.h>
- #include <sys/mman.h>
- #include <stdlib.h>
- #define POINTER_TO_U64(A) ((__u64)((uintptr_t)(A)))
-
- static EnclaveCreatorHW g_enclave_creator_hw;
- EnclaveCreator* g_enclave_creator = &g_enclave_creator_hw;
- static uint64_t g_eid = 0x1;
- EnclaveCreatorHW::EnclaveCreatorHW():
- m_hdevice(-1),
- m_sig_registered(false),
- m_in_kernel_driver(false)
- {
- se_mutex_init(&m_sig_mutex);
- }
- EnclaveCreatorHW::~EnclaveCreatorHW()
- {
- close_se_device();
- }
- int EnclaveCreatorHW::error_driver2urts(int driver_error)
- {
- int ret = SGX_ERROR_UNEXPECTED;
- switch(driver_error)
- {
- case SGX_INVALID_ATTRIBUTE:
- ret = SGX_ERROR_INVALID_ATTRIBUTE;
- break;
- case SGX_INVALID_MEASUREMENT:
- ret = SE_ERROR_INVALID_MEASUREMENT;
- break;
- case SGX_INVALID_SIG_STRUCT:
- case SGX_INVALID_SIGNATURE:
- ret = SGX_ERROR_INVALID_SIGNATURE;
- break;
- case SGX_INVALID_LICENSE:
- ret = SE_ERROR_INVALID_LAUNCH_TOKEN;
- break;
- case SGX_INVALID_CPUSVN:
- ret = SGX_ERROR_INVALID_CPUSVN;
- break;
- case SGX_INVALID_ISVSVN:
- ret = SGX_ERROR_INVALID_ISVSVN;
- break;
- case SGX_UNMASKED_EVENT:
- ret = SGX_ERROR_DEVICE_BUSY;
- break;
- case (int)SGX_POWER_LOST_ENCLAVE:
- ret = SGX_ERROR_ENCLAVE_LOST;
- break;
- case (int)SGX_LE_ROLLBACK:
- ret = SE_ERROR_INVALID_ISVSVNLE;
- break;
- default:
- SE_TRACE(SE_TRACE_WARNING, "unexpected error %#x from driver, should be uRTS/driver bug\n", driver_error);
- ret = SGX_ERROR_UNEXPECTED;
- break;
- }
-
- return ret;
- }
-
- int EnclaveCreatorHW::create_enclave(secs_t *secs, sgx_enclave_id_t *enclave_id, void **start_addr, bool ae)
- {
- assert(secs != NULL && enclave_id != NULL && start_addr != NULL);
- UNUSED(ae);
- if (false == open_se_device())
- return SGX_ERROR_NO_DEVICE;
- SE_TRACE(SE_TRACE_DEBUG, "\n secs.attibutes.flags = %llx, secs.attributes.xfrm = %llx \n"
- , secs->attributes.flags, secs->attributes.xfrm);
-
-
- void* enclave_base = mmap(NULL, (size_t)secs->size, PROT_NONE, MAP_SHARED, m_hdevice, 0);
- if(enclave_base == MAP_FAILED)
- {
- SE_TRACE(SE_TRACE_WARNING, "\ncreate enclave: mmap failed, errno = %d\n", errno);
- return SGX_ERROR_OUT_OF_MEMORY;
- }
- secs->base = enclave_base;
-
- struct sgx_enclave_create param = {0};
- param.src = POINTER_TO_U64(secs);
- int ret = ioctl(m_hdevice, SGX_IOC_ENCLAVE_CREATE, ¶m);
- if(ret)
- {
- if(ret == -1 && errno == EINTR)
- {
- return SGX_INTERNAL_ERROR_ENCLAVE_CREATE_INTERRUPTED;
- }
- SE_TRACE(SE_TRACE_WARNING, "\nSGX_IOC_ENCLAVE_CREATE failed: errno = %d\n", errno);
- return error_driver2urts(ret);
- }
- *enclave_id = se_atomic_inc64(&g_eid);
- *start_addr = secs->base;
- return SGX_SUCCESS;
- }
-
- int EnclaveCreatorHW::add_enclave_page(sgx_enclave_id_t enclave_id, void *src, uint64_t rva, const sec_info_t &sinfo, uint32_t attr)
- {
- assert((rva & ((1<<SE_PAGE_SHIFT)-1)) == 0);
- void* source = src;
- uint8_t color_page[SE_PAGE_SIZE] = { 0 };
- if(NULL == source)
- {
- memset(color_page, 0, SE_PAGE_SIZE);
- source = reinterpret_cast<void*>(&color_page);
- }
- int ret = 0;
- struct sgx_enclave_add_page addp = { 0, 0, 0, 0 };
- addp.addr = enclave_id + rva;
- addp.src = POINTER_TO_U64(source);
- addp.secinfo = POINTER_TO_U64(const_cast<sec_info_t*>(&sinfo));
- if(((1<<DoEEXTEND) & attr))
- addp.mrmask |= 0xFFFF;
- ret = ioctl(m_hdevice, SGX_IOC_ENCLAVE_ADD_PAGE, &addp);
- if(ret) {
- SE_TRACE(SE_TRACE_WARNING, "\nAdd Page - %p to %p... FAIL\n", source, rva);
- return error_driver2urts(ret);
- }
- return SGX_SUCCESS;
- }
-
- int EnclaveCreatorHW::try_init_enclave(sgx_enclave_id_t enclave_id, enclave_css_t *enclave_css, token_t *launch)
- {
- int ret = 0;
- if (m_in_kernel_driver == false)
- {
- struct sgx_enclave_init initp = { 0, 0, 0 };
- initp.addr = enclave_id;
- initp.sigstruct = POINTER_TO_U64(enclave_css);
-
- assert(launch != NULL);
- initp.einittoken = POINTER_TO_U64(launch);
- ret = ioctl(m_hdevice, SGX_IOC_ENCLAVE_INIT, &initp);
- }
- else
- {
- struct sgx_enclave_init_in_kernel initp = { 0, 0 };
- initp.addr = enclave_id;
- initp.sigstruct = POINTER_TO_U64(enclave_css);
- ret = ioctl(m_hdevice, SGX_IOC_ENCLAVE_INIT_IN_KERNEL, &initp);
- }
- if (ret) {
- SE_TRACE(SE_TRACE_WARNING, "\nSGX_IOC_ENCLAVE_INIT failed error = %d\n", ret);
- return error_driver2urts(ret);
- }
-
- se_mutex_lock(&m_sig_mutex);
- if(false == m_sig_registered)
- {
- reg_sig_handler();
- m_sig_registered = true;
- }
- se_mutex_unlock(&m_sig_mutex);
- return SGX_SUCCESS;
- }
-
- int EnclaveCreatorHW::destroy_enclave(sgx_enclave_id_t enclave_id, uint64_t enclave_size)
- {
- int ret = SGX_SUCCESS;
- ret = munmap((void*)enclave_id, (size_t)enclave_size);
- if (0 != ret) {
- SE_TRACE(SE_TRACE_WARNING, "destroy SGX enclave failed, error = %d\n", errno);
- ret = SGX_ERROR_UNEXPECTED;
- }
- return ret;
- }
-
- bool EnclaveCreatorHW::get_plat_cap(sgx_misc_attribute_t *misc_attr)
- {
-
- return get_plat_cap_by_cpuid(misc_attr);
- }
- bool EnclaveCreatorHW::open_se_device()
- {
- LockGuard lock(&m_dev_mutex);
- if(-1 != m_hdevice)
- return true;
- return ::open_se_device(&m_hdevice, &m_in_kernel_driver);
- }
-
- void EnclaveCreatorHW::close_se_device()
- {
- LockGuard lock(&m_dev_mutex);
- ::close_se_device(&m_hdevice);
- m_hdevice = -1;
- }
- int EnclaveCreatorHW::emodpr(uint64_t addr, uint64_t size, uint64_t flag)
- {
- sgx_modification_param params;
- memset(¶ms, 0 ,sizeof(sgx_modification_param));
- params.range.start_addr = (unsigned long)addr;
- params.range.nr_pages = (unsigned int)(size/SE_PAGE_SIZE);
- params.flags = (unsigned long)flag;
- int ret = ioctl(m_hdevice, SGX_IOC_ENCLAVE_EMODPR, ¶ms);
- if (ret)
- {
- SE_TRACE(SE_TRACE_ERROR, "SGX_IOC_ENCLAVE_EMODPR failed %d\n", errno);
- return error_driver2urts(ret);
- }
- return SGX_SUCCESS;
- }
-
- int EnclaveCreatorHW::mktcs(uint64_t tcs_addr)
- {
- sgx_range params;
- memset(¶ms, 0 ,sizeof(sgx_range));
- params.start_addr = (unsigned long)tcs_addr;
- params.nr_pages = 1;
- int ret = ioctl(m_hdevice, SGX_IOC_ENCLAVE_MKTCS, ¶ms);
- if (ret)
- {
- SE_TRACE(SE_TRACE_ERROR, "MODIFY_TYPE failed %d\n", errno);
- return error_driver2urts(ret);
- }
- return SGX_SUCCESS;
- }
-
- int EnclaveCreatorHW::trim_range(uint64_t fromaddr, uint64_t toaddr)
- {
- sgx_range params;
- memset(¶ms, 0 ,sizeof(sgx_range));
- params.start_addr = (unsigned long)fromaddr;
- params.nr_pages = (unsigned int)((toaddr - fromaddr)/SE_PAGE_SIZE);
- int ret= ioctl(m_hdevice, SGX_IOC_ENCLAVE_TRIM, ¶ms);
- if (ret)
- {
- SE_TRACE(SE_TRACE_ERROR, "SGX_IOC_ENCLAVE_TRIM failed %d\n", errno);
- return error_driver2urts(ret);
- }
- return SGX_SUCCESS;
- }
-
- int EnclaveCreatorHW::trim_accept(uint64_t addr)
- {
- sgx_range params;
- memset(¶ms, 0 ,sizeof(sgx_range));
- params.start_addr = (unsigned long)addr;
- params.nr_pages = 1;
- int ret = ioctl(m_hdevice, SGX_IOC_ENCLAVE_NOTIFY_ACCEPT, ¶ms);
- if (ret)
- {
- SE_TRACE(SE_TRACE_ERROR, "TRIM_RANGE_COMMIT failed %d\n", errno);
- return error_driver2urts(ret);
- }
- return SGX_SUCCESS;
- }
-
- int EnclaveCreatorHW::remove_range(uint64_t fromaddr, uint64_t numpages)
- {
- int ret = -1;
- uint64_t i;
- unsigned long start;
- for (i = 0; i < numpages; i++)
- {
- start = (unsigned long)fromaddr + (unsigned long)(i << SE_PAGE_SHIFT);
- ret = ioctl(m_hdevice, SGX_IOC_ENCLAVE_PAGE_REMOVE, &start);
- if (ret)
- {
- SE_TRACE(SE_TRACE_ERROR, "PAGE_REMOVE failed %d\n", errno);
- return error_driver2urts(ret);
- }
- }
- return SGX_SUCCESS;
- }
-
- bool EnclaveCreatorHW::is_EDMM_supported(sgx_enclave_id_t enclave_id)
- {
- bool supported = false, driver_supported = false, cpu_edmm = false;
- CEnclave *enclave = CEnclavePool::instance()->get_enclave(enclave_id);
- if (enclave == NULL)
- return false;
- cpu_edmm = is_cpu_support_edmm();
- driver_supported = is_driver_compatible();
-
- supported = use_se_hw() && cpu_edmm && driver_supported && (enclave->get_enclave_version() >= SDK_VERSION_2_0);
- return supported;
- }
- bool EnclaveCreatorHW::is_driver_compatible()
- {
- open_se_device();
- return is_driver_support_edmm(m_hdevice);
- }
- bool EnclaveCreatorHW::is_in_kernel_driver()
- {
- open_se_device();
- return m_in_kernel_driver;
- }
|