urts_com.h 13 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378
  1. /*
  2. * Copyright (C) 2011-2017 Intel Corporation. All rights reserved.
  3. *
  4. * Redistribution and use in source and binary forms, with or without
  5. * modification, are permitted provided that the following conditions
  6. * are met:
  7. *
  8. * * Redistributions of source code must retain the above copyright
  9. * notice, this list of conditions and the following disclaimer.
  10. * * Redistributions in binary form must reproduce the above copyright
  11. * notice, this list of conditions and the following disclaimer in
  12. * the documentation and/or other materials provided with the
  13. * distribution.
  14. * * Neither the name of Intel Corporation nor the names of its
  15. * contributors may be used to endorse or promote products derived
  16. * from this software without specific prior written permission.
  17. *
  18. * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  19. * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  20. * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
  21. * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
  22. * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  23. * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
  24. * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
  25. * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
  26. * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  27. * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  28. * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  29. *
  30. */
  31. #ifndef _URTS_COM_H_
  32. #define _URTS_COM_H_
  33. #include "arch.h"
  34. #include "sgx_error.h"
  35. #include "se_error_internal.h"
  36. #include "se_trace.h"
  37. #include "file.h"
  38. #include "sgx_eid.h"
  39. #include "se_map.h"
  40. #include "launch_checker.h"
  41. #include "debugger_support.h"
  42. #include "loader.h"
  43. #include "binparser.h"
  44. #include "cpuid.h"
  45. #include "se_macro.h"
  46. #include "prd_css_util.h"
  47. #include "se_detect.h"
  48. #ifndef PARSER
  49. #include "elfparser.h"
  50. #define PARSER ElfParser
  51. #endif
  52. #include "ittnotify.h"
  53. #include "ittnotify_config.h"
  54. #include "ittnotify_types.h"
  55. extern "C" int __itt_init_ittlib(const char*, __itt_group_id);
  56. extern "C" __itt_global* __itt_get_ittapi_global();
  57. #define HSW_C0 0x306c3
  58. #define GPR_A0 0x406e0
  59. #define GPR_B0 0x406e1
  60. #define GPR_P0 0x506e0
  61. #ifndef SE_SIM
  62. static int validate_platform()
  63. {
  64. int cpu_info[4] = {0, 0, 0, 0};
  65. __cpuid(cpu_info, 1);
  66. // The compatibility between SDK and PSW is checked by the metadata version.
  67. // Below check the compatibility between the platform and uRTS only.
  68. // It is HSW users' responsibility to make the uRTS version to consistent with the HSW patch.
  69. if(cpu_info[0] == HSW_C0)
  70. {
  71. return SGX_SUCCESS;
  72. }
  73. // GPR region
  74. else if(cpu_info[0] == GPR_A0 || cpu_info[0] == GPR_B0 || cpu_info[0] == GPR_P0)
  75. {
  76. SE_TRACE(SE_TRACE_ERROR, "ERROR: The enclave cannot be launched on current platform.\n");
  77. return SGX_ERROR_INVALID_VERSION;
  78. }
  79. return SGX_SUCCESS;
  80. }
  81. #endif
  82. static sgx_status_t get_metadata(BinParser *parser, const int debug, metadata_t **metadata, sgx_misc_attribute_t *sgx_misc_attr)
  83. {
  84. assert(parser != NULL && metadata != NULL && sgx_misc_attr != NULL);
  85. uint64_t meta_rva = parser->get_metadata_offset();
  86. const uint8_t *base_addr = parser->get_start_addr();
  87. uint64_t meta_block_size = parser->get_metadata_block_size();
  88. uint64_t version = META_DATA_MAKE_VERSION(MAJOR_VERSION,MINOR_VERSION );
  89. //scan multiple metadata list in sgx_metadata section
  90. do{
  91. *metadata = GET_PTR(metadata_t, base_addr, meta_rva);
  92. if((*metadata)->magic_num != METADATA_MAGIC)
  93. return SGX_ERROR_INVALID_METADATA;
  94. //check metadata version
  95. if(version == (*metadata)->version)
  96. break;
  97. if(0 == (*metadata)->size)
  98. {
  99. SE_TRACE(SE_TRACE_ERROR, "ERROR: metadata's size can't be zero.\n");
  100. return SGX_ERROR_INVALID_METADATA;
  101. }
  102. meta_rva += (*metadata)->size; /*goto next metadata offset*/
  103. if(meta_rva - (parser->get_metadata_offset()) >= meta_block_size)
  104. {
  105. SE_TRACE(SE_TRACE_ERROR, "ERROR: Exceed metadata block bound.\n");
  106. return SGX_ERROR_INVALID_METADATA;
  107. }
  108. }while(1);
  109. return (sgx_status_t)get_enclave_creator()->get_misc_attr(sgx_misc_attr, *metadata, NULL, debug);
  110. }
  111. static int __create_enclave(BinParser &parser, uint8_t* base_addr, const metadata_t *metadata, se_file_t& file, const bool debug, SGXLaunchToken *lc, le_prd_css_file_t *prd_css_file, sgx_enclave_id_t *enclave_id, sgx_misc_attribute_t *misc_attr)
  112. {
  113. // The "parser" will be registered into "loader" and "loader" will be registered into "enclave".
  114. // After enclave is created, "parser" and "loader" are not needed any more.
  115. debug_enclave_info_t *debug_info = NULL;
  116. int ret = SGX_SUCCESS;
  117. CLoader loader(base_addr, parser);
  118. ret = loader.load_enclave_ex(lc, debug, metadata, prd_css_file, misc_attr);
  119. if (ret != SGX_SUCCESS)
  120. {
  121. return ret;
  122. }
  123. CEnclave* enclave = new CEnclave(loader);
  124. // initialize the enclave object
  125. ret = enclave->initialize(file,
  126. loader.get_enclave_id(),
  127. const_cast<void*>(loader.get_start_addr()),
  128. metadata->enclave_size,
  129. metadata->tcs_policy);
  130. if (ret != SGX_SUCCESS)
  131. {
  132. loader.destroy_enclave();
  133. delete enclave; // The `enclave' object owns the `loader' object.
  134. return ret;
  135. }
  136. std::vector<tcs_t *> tcs_list = loader.get_tcs_list();
  137. for (unsigned idx = 0; idx < tcs_list.size(); ++idx)
  138. {
  139. enclave->add_thread(tcs_list[idx]);
  140. SE_TRACE(SE_TRACE_DEBUG, "add tcs %p\n", tcs_list[idx]);
  141. }
  142. // It is accurate to get debug flag from secs
  143. enclave->set_dbg_flag(!!(loader.get_secs().attributes.flags & SGX_FLAGS_DEBUG));
  144. debug_info = const_cast<debug_enclave_info_t *>(enclave->get_debug_info());
  145. enclave->set_extra_debug_info(const_cast<secs_t &>(loader.get_secs()));
  146. //add enclave to enclave pool before init_enclave because in simualtion
  147. //mode init_enclave will rely on CEnclavePool to get Enclave instance.
  148. if (FALSE == CEnclavePool::instance()->add_enclave(enclave))
  149. {
  150. ret = SGX_ERROR_UNEXPECTED;
  151. goto fail;
  152. }
  153. if(debug)
  154. debug_info->enclave_type |= ET_DEBUG;
  155. if (!(get_enclave_creator()->use_se_hw()))
  156. debug_info->enclave_type |= ET_SIM;
  157. bool isVTuneProfiling;
  158. if(debug || !(get_enclave_creator()->use_se_hw()))
  159. {
  160. SE_TRACE(SE_TRACE_DEBUG, "Debug enclave. Checking if VTune is profiling\n");
  161. __itt_init_ittlib(NULL, __itt_group_none);
  162. if(__itt_get_ittapi_global()->api_initialized && __itt_get_ittapi_global()->lib)
  163. isVTuneProfiling = true;
  164. else
  165. isVTuneProfiling = false;
  166. if(isVTuneProfiling)
  167. {
  168. SE_TRACE(SE_TRACE_DEBUG, "VTune is profiling\n");
  169. bool thread_updated;
  170. thread_updated = enclave->update_debug_flag(1);
  171. if(thread_updated == false)
  172. {
  173. SE_TRACE(SE_TRACE_DEBUG, "Failed to update debug OPTIN bit\n");
  174. }
  175. else
  176. {
  177. SE_TRACE(SE_TRACE_DEBUG, "Updated debug OPTIN bit\n");
  178. }
  179. uint64_t enclave_start_addr;
  180. uint64_t enclave_end_addr;
  181. const char* enclave_path;
  182. enclave_start_addr = (uint64_t) loader.get_start_addr();
  183. enclave_end_addr = enclave_start_addr + (uint64_t) metadata->enclave_size;
  184. SE_TRACE(SE_TRACE_DEBUG, "Invoking VTune's module mapping API __itt_module_load \n");
  185. SE_TRACE(SE_TRACE_DEBUG, "Enclave_start_addr==0x%llx\n", enclave_start_addr);
  186. SE_TRACE(SE_TRACE_DEBUG, "Enclave_end_addr==0x%llx\n", enclave_end_addr);
  187. enclave_path = (const char*)file.name;
  188. SE_TRACE(SE_TRACE_DEBUG, "Enclave_path==%s\n", enclave_path);
  189. __itt_module_load((void*)enclave_start_addr, (void*) enclave_end_addr, enclave_path);
  190. }
  191. else
  192. {
  193. SE_TRACE(SE_TRACE_DEBUG, "VTune is not profiling. Debug OPTIN bit not set and API to do module mapping not invoked\n");
  194. }
  195. }
  196. //send debug event to debugger when enclave is debug mode or release mode
  197. //set struct version
  198. debug_info->struct_version = enclave->get_debug_info()->struct_version;
  199. //generate load debug event after EINIT
  200. generate_enclave_debug_event(URTS_EXCEPTION_POSTINITENCLAVE, debug_info);
  201. //call trts to do some intialization
  202. if(SGX_SUCCESS != (ret = get_enclave_creator()->initialize(loader.get_enclave_id())))
  203. {
  204. sgx_status_t status = SGX_SUCCESS;
  205. CEnclavePool::instance()->remove_enclave(loader.get_enclave_id(), status);
  206. goto fail;
  207. }
  208. if(SGX_SUCCESS != (ret = loader.set_memory_protection()))
  209. {
  210. sgx_status_t status = SGX_SUCCESS;
  211. CEnclavePool::instance()->remove_enclave(loader.get_enclave_id(), status);
  212. goto fail;
  213. }
  214. *enclave_id = loader.get_enclave_id();
  215. return SGX_SUCCESS;
  216. fail:
  217. loader.destroy_enclave();
  218. delete enclave;
  219. return ret;
  220. }
  221. sgx_status_t _create_enclave(const bool debug, se_file_handle_t pfile, se_file_t& file, le_prd_css_file_t *prd_css_file, sgx_launch_token_t *launch, int *launch_updated, sgx_enclave_id_t *enclave_id, sgx_misc_attribute_t *misc_attr)
  222. {
  223. unsigned int ret = SGX_SUCCESS;
  224. sgx_status_t lt_result = SGX_SUCCESS;
  225. uint32_t file_size = 0;
  226. map_handle_t* mh = NULL;
  227. sgx_misc_attribute_t sgx_misc_attr;
  228. metadata_t *metadata = NULL;
  229. SGXLaunchToken *lc = NULL;
  230. memset(&sgx_misc_attr, 0, sizeof(sgx_misc_attribute_t));
  231. if(NULL == launch || NULL == launch_updated || NULL == enclave_id)
  232. return SGX_ERROR_INVALID_PARAMETER;
  233. #ifndef SE_SIM
  234. ret = validate_platform();
  235. if(ret != SGX_SUCCESS)
  236. return (sgx_status_t)ret;
  237. #endif
  238. mh = map_file(pfile, &file_size);
  239. if (!mh)
  240. return SGX_ERROR_OUT_OF_MEMORY;
  241. PARSER parser(const_cast<uint8_t *>(mh->base_addr), (uint64_t)(file_size));
  242. if(SGX_SUCCESS != (ret = parser.run_parser()))
  243. {
  244. goto clean_return;
  245. }
  246. //Make sure HW uRTS won't load simulation enclave and vice verse.
  247. if(get_enclave_creator()->use_se_hw() != (!parser.get_symbol_rva("g_global_data_sim")))
  248. {
  249. SE_TRACE_WARNING("HW and Simulation mode incompatibility detected. The enclave is linked with the incorrect tRTS library.\n");
  250. ret = SGX_ERROR_MODE_INCOMPATIBLE;
  251. goto clean_return;
  252. }
  253. if(SGX_SUCCESS != (ret = get_metadata(&parser, debug, &metadata, &sgx_misc_attr)))
  254. {
  255. goto clean_return;
  256. }
  257. *launch_updated = FALSE;
  258. lc = new SGXLaunchToken(&metadata->enclave_css, &sgx_misc_attr.secs_attr, launch);
  259. lt_result = lc->update_launch_token(false);
  260. if(SGX_SUCCESS != lt_result)
  261. {
  262. ret = lt_result;
  263. goto clean_return;
  264. }
  265. #ifndef SE_SIM
  266. // Only LE allows the prd_css_file
  267. if(is_le(lc, &metadata->enclave_css) == false && prd_css_file != NULL)
  268. {
  269. ret = SGX_ERROR_INVALID_PARAMETER;
  270. goto clean_return;
  271. }
  272. #endif
  273. //Need to set the whole misc_attr instead of just secs_attr.
  274. do {
  275. ret = __create_enclave(parser, mh->base_addr, metadata, file, debug, lc, prd_css_file, enclave_id,
  276. misc_attr);
  277. //SGX_ERROR_ENCLAVE_LOST caused by initializing enclave while power transition occurs
  278. } while(SGX_ERROR_ENCLAVE_LOST == ret);
  279. if(SE_ERROR_INVALID_LAUNCH_TOKEN == ret || SGX_ERROR_INVALID_CPUSVN == ret)
  280. ret = SGX_ERROR_UNEXPECTED;
  281. // The launch token is updated, so the SE_INVALID_MEASUREMENT is only caused by signature.
  282. if(SE_ERROR_INVALID_MEASUREMENT == ret)
  283. ret = SGX_ERROR_INVALID_SIGNATURE;
  284. // The launch token is updated, so the SE_ERROR_INVALID_ISVSVNLE means user needs to update the LE image
  285. if (SE_ERROR_INVALID_ISVSVNLE == ret)
  286. ret = SGX_ERROR_UPDATE_NEEDED;
  287. if(SGX_SUCCESS != ret)
  288. goto clean_return;
  289. else if(lc->is_launch_updated())
  290. {
  291. *launch_updated = TRUE;
  292. ret = lc->get_launch_token(launch);
  293. }
  294. clean_return:
  295. if(mh != NULL)
  296. unmap_file(mh);
  297. if(lc != NULL)
  298. delete lc;
  299. return (sgx_status_t)ret;
  300. }
  301. extern "C" sgx_status_t sgx_destroy_enclave(const sgx_enclave_id_t enclave_id)
  302. {
  303. sgx_status_t status = SGX_SUCCESS;
  304. CEnclave* enclave = CEnclavePool::instance()->remove_enclave(enclave_id, status);
  305. if (enclave)
  306. {
  307. delete enclave;
  308. }
  309. return status;
  310. }
  311. #endif