Something went wrong. Try again.
(I'm so sorry!) Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
Something went wrong. Try again.
123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371// SPDX-License-Identifier: GPL-2.0/* Copyright(c) 2016-20 Intel Corporation. */
#include <assert.h>#include <elf.h>#include <errno.h>#include <fcntl.h>#include <stdbool.h>#include <stdio.h>#include <stdint.h>#include <stdlib.h>#include <string.h>#include <unistd.h>#include <sys/ioctl.h>#include <sys/mman.h>#include <sys/stat.h>#include <sys/time.h>#include <sys/types.h>#include "defines.h"#include "main.h"
void encl_delete(struct encl *encl){ struct encl_segment *heap_seg;
if (encl->encl_base) munmap((void *)encl->encl_base, encl->encl_size);
if (encl->bin) munmap(encl->bin, encl->bin_size);
if (encl->fd) close(encl->fd);
if (encl->segment_tbl) { heap_seg = &encl->segment_tbl[encl->nr_segments - 1]; munmap(heap_seg->src, heap_seg->size); free(encl->segment_tbl); }
memset(encl, 0, sizeof(*encl));}
static bool encl_map_bin(const char *path, struct encl *encl){ struct stat sb; void *bin; int ret; int fd;
fd = open(path, O_RDONLY); if (fd == -1) { perror("enclave executable open()"); return false; }
ret = stat(path, &sb); if (ret) { perror("enclave executable stat()"); goto err; }
bin = mmap(NULL, sb.st_size, PROT_READ, MAP_PRIVATE, fd, 0); if (bin == MAP_FAILED) { perror("enclave executable mmap()"); goto err; }
encl->bin = bin; encl->bin_size = sb.st_size;
close(fd); return true;
err: close(fd); return false;}
static bool encl_ioc_create(struct encl *encl){ struct sgx_secs *secs = &encl->secs; struct sgx_enclave_create ioc; int rc;
assert(encl->encl_base != 0);
memset(secs, 0, sizeof(*secs)); secs->ssa_frame_size = 1; secs->attributes = SGX_ATTR_MODE64BIT; secs->xfrm = 3; secs->base = encl->encl_base; secs->size = encl->encl_size;
ioc.src = (unsigned long)secs; rc = ioctl(encl->fd, SGX_IOC_ENCLAVE_CREATE, &ioc); if (rc) { perror("SGX_IOC_ENCLAVE_CREATE failed"); munmap((void *)secs->base, encl->encl_size); return false; }
return true;}
static bool encl_ioc_add_pages(struct encl *encl, struct encl_segment *seg){ struct sgx_enclave_add_pages ioc; struct sgx_secinfo secinfo; int rc;
memset(&secinfo, 0, sizeof(secinfo)); secinfo.flags = seg->flags;
ioc.src = (uint64_t)seg->src; ioc.offset = seg->offset; ioc.length = seg->size; ioc.secinfo = (unsigned long)&secinfo; if (seg->measure) ioc.flags = SGX_PAGE_MEASURE; else ioc.flags = 0;
rc = ioctl(encl->fd, SGX_IOC_ENCLAVE_ADD_PAGES, &ioc); if (rc < 0) { perror("SGX_IOC_ENCLAVE_ADD_PAGES failed"); return false; }
return true;}
/* * Parse the enclave code's symbol table to locate and return address of * the provided symbol */uint64_t encl_get_entry(struct encl *encl, const char *symbol){ Elf64_Sym *symtab = NULL; char *sym_names = NULL; Elf64_Shdr *sections; Elf64_Ehdr *ehdr; int num_sym = 0; int i;
ehdr = encl->bin; sections = encl->bin + ehdr->e_shoff;
for (i = 0; i < ehdr->e_shnum; i++) { if (sections[i].sh_type == SHT_SYMTAB) { symtab = (Elf64_Sym *)((char *)encl->bin + sections[i].sh_offset); num_sym = sections[i].sh_size / sections[i].sh_entsize; break; } }
for (i = 0; i < ehdr->e_shnum; i++) { if (sections[i].sh_type == SHT_STRTAB) { sym_names = (char *)encl->bin + sections[i].sh_offset; break; } }
if (!symtab || !sym_names) return 0;
for (i = 0; i < num_sym; i++) { Elf64_Sym *sym = &symtab[i];
if (!strcmp(symbol, sym_names + sym->st_name)) return (uint64_t)sym->st_value; }
return 0;}
bool encl_load(const char *path, struct encl *encl, unsigned long heap_size){ const char device_path[] = "/dev/sgx_enclave"; struct encl_segment *seg; Elf64_Phdr *phdr_tbl; off_t src_offset; Elf64_Ehdr *ehdr; struct stat sb; void *ptr; int i, j; int ret; int fd = -1;
memset(encl, 0, sizeof(*encl));
fd = open(device_path, O_RDWR); if (fd < 0) { perror("Unable to open /dev/sgx_enclave"); goto err; }
ret = stat(device_path, &sb); if (ret) { perror("device file stat()"); goto err; }
ptr = mmap(NULL, PAGE_SIZE, PROT_READ, MAP_SHARED, fd, 0); if (ptr == (void *)-1) { perror("mmap for read"); goto err; } munmap(ptr, PAGE_SIZE);
#define ERR_MSG \"mmap() succeeded for PROT_READ, but failed for PROT_EXEC.\n" \" Check that /dev does not have noexec set:\n" \" \tmount | grep \"/dev .*noexec\"\n" \" If so, remount it executable: mount -o remount,exec /dev\n\n"
ptr = mmap(NULL, PAGE_SIZE, PROT_EXEC, MAP_SHARED, fd, 0); if (ptr == (void *)-1) { fprintf(stderr, ERR_MSG); goto err; } munmap(ptr, PAGE_SIZE);
encl->fd = fd;
if (!encl_map_bin(path, encl)) goto err;
ehdr = encl->bin; phdr_tbl = encl->bin + ehdr->e_phoff;
encl->nr_segments = 1; /* one for the heap */
for (i = 0; i < ehdr->e_phnum; i++) { Elf64_Phdr *phdr = &phdr_tbl[i];
if (phdr->p_type == PT_LOAD) encl->nr_segments++; }
encl->segment_tbl = calloc(encl->nr_segments, sizeof(struct encl_segment)); if (!encl->segment_tbl) goto err;
for (i = 0, j = 0; i < ehdr->e_phnum; i++) { Elf64_Phdr *phdr = &phdr_tbl[i]; unsigned int flags = phdr->p_flags;
if (phdr->p_type != PT_LOAD) continue;
seg = &encl->segment_tbl[j];
if (!!(flags & ~(PF_R | PF_W | PF_X))) { fprintf(stderr, "%d has invalid segment flags 0x%02x.\n", i, phdr->p_flags); goto err; }
if (j == 0 && flags != (PF_R | PF_W)) { fprintf(stderr, "TCS has invalid segment flags 0x%02x.\n", phdr->p_flags); goto err; }
if (j == 0) { src_offset = phdr->p_offset & PAGE_MASK; encl->src = encl->bin + src_offset;
seg->prot = PROT_READ | PROT_WRITE; seg->flags = SGX_PAGE_TYPE_TCS << 8; } else { seg->prot = (phdr->p_flags & PF_R) ? PROT_READ : 0; seg->prot |= (phdr->p_flags & PF_W) ? PROT_WRITE : 0; seg->prot |= (phdr->p_flags & PF_X) ? PROT_EXEC : 0; seg->flags = (SGX_PAGE_TYPE_REG << 8) | seg->prot; }
seg->offset = (phdr->p_offset & PAGE_MASK) - src_offset; seg->size = (phdr->p_filesz + PAGE_SIZE - 1) & PAGE_MASK; seg->src = encl->src + seg->offset; seg->measure = true;
j++; }
assert(j == encl->nr_segments - 1);
seg = &encl->segment_tbl[j]; seg->offset = encl->segment_tbl[j - 1].offset + encl->segment_tbl[j - 1].size; seg->size = heap_size; seg->src = mmap(NULL, heap_size, PROT_READ | PROT_WRITE, MAP_ANONYMOUS | MAP_PRIVATE, -1, 0); seg->prot = PROT_READ | PROT_WRITE; seg->flags = (SGX_PAGE_TYPE_REG << 8) | seg->prot; seg->measure = false;
if (seg->src == MAP_FAILED) goto err;
encl->src_size = encl->segment_tbl[j].offset + encl->segment_tbl[j].size;
for (encl->encl_size = 4096; encl->encl_size < encl->src_size; ) encl->encl_size <<= 1;
return true;
err: if (fd != -1) close(fd); encl_delete(encl); return false;}
static bool encl_map_area(struct encl *encl){ size_t encl_size = encl->encl_size; void *area;
area = mmap(NULL, encl_size * 2, PROT_NONE, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0); if (area == MAP_FAILED) { perror("reservation mmap()"); return false; }
encl->encl_base = ((uint64_t)area + encl_size - 1) & ~(encl_size - 1);
munmap(area, encl->encl_base - (uint64_t)area); munmap((void *)(encl->encl_base + encl_size), (uint64_t)area + encl_size - encl->encl_base);
return true;}
bool encl_build(struct encl *encl){ struct sgx_enclave_init ioc; int ret; int i;
if (!encl_map_area(encl)) return false;
if (!encl_ioc_create(encl)) return false;
/* * Pages must be added before mapping VMAs because their permissions * cap the VMA permissions. */ for (i = 0; i < encl->nr_segments; i++) { struct encl_segment *seg = &encl->segment_tbl[i];
if (!encl_ioc_add_pages(encl, seg)) return false; }
ioc.sigstruct = (uint64_t)&encl->sigstruct; ret = ioctl(encl->fd, SGX_IOC_ENCLAVE_INIT, &ioc); if (ret) { perror("SGX_IOC_ENCLAVE_INIT failed"); return false; }
return true;}