tools/testing/selftests/sgx/load.c

   1 // SPDX-License-Identifier: GPL-2.0
   2 /*  Copyright(c) 2016-20 Intel Corporation. */
   3
   4 #include <assert.h>
   5 #include <elf.h>
   6 #include <errno.h>
   7 #include <fcntl.h>
   8 #include <stdbool.h>
   9 #include <stdio.h>
  10 #include <stdint.h>
  11 #include <stdlib.h>
  12 #include <string.h>
  13 #include <unistd.h>
  14 #include <sys/ioctl.h>
  15 #include <sys/mman.h>
  16 #include <sys/stat.h>
  17 #include <sys/time.h>
  18 #include <sys/types.h>
  19 #include "defines.h"
  20 #include "main.h"
  21
  22 void encl_delete(struct encl *encl)
  23 {
  24         struct encl_segment *heap_seg;
  25
  26         if (encl->encl_base)
  27                 munmap((void *)encl->encl_base, encl->encl_size);
  28
  29         if (encl->bin)
  30                 munmap(encl->bin, encl->bin_size);
  31
  32         if (encl->fd)
  33                 close(encl->fd);
  34
  35         if (encl->segment_tbl) {
  36                 heap_seg = &encl->segment_tbl[encl->nr_segments - 1];
  37                 munmap(heap_seg->src, heap_seg->size);
  38                 free(encl->segment_tbl);
  39         }
  40
  41         memset(encl, 0, sizeof(*encl));
  42 }
  43
  44 static bool encl_map_bin(const char *path, struct encl *encl)
  45 {
  46         struct stat sb;
  47         void *bin;
  48         int ret;
  49         int fd;
  50
  51         fd = open(path, O_RDONLY);
  52         if (fd == -1)  {
  53                 perror("enclave executable open()");
  54                 return false;
  55         }
  56
  57         ret = stat(path, &sb);
  58         if (ret) {
  59                 perror("enclave executable stat()");
  60                 goto err;
  61         }
  62
  63         bin = mmap(NULL, sb.st_size, PROT_READ, MAP_PRIVATE, fd, 0);
  64         if (bin == MAP_FAILED) {
  65                 perror("enclave executable mmap()");
  66                 goto err;
  67         }
  68
  69         encl->bin = bin;
  70         encl->bin_size = sb.st_size;
  71
  72         close(fd);
  73         return true;
  74
  75 err:
  76         close(fd);
  77         return false;
  78 }
  79
  80 static bool encl_ioc_create(struct encl *encl)
  81 {
  82         struct sgx_secs *secs = &encl->secs;
  83         struct sgx_enclave_create ioc;
  84         int rc;
  85
  86         assert(encl->encl_base != 0);
  87
  88         memset(secs, 0, sizeof(*secs));
  89         secs->ssa_frame_size = 1;
  90         secs->attributes = SGX_ATTR_MODE64BIT;
  91         secs->xfrm = 3;
  92         secs->base = encl->encl_base;
  93         secs->size = encl->encl_size;
  94
  95         ioc.src = (unsigned long)secs;
  96         rc = ioctl(encl->fd, SGX_IOC_ENCLAVE_CREATE, &ioc);
  97         if (rc) {
  98                 perror("SGX_IOC_ENCLAVE_CREATE failed");
  99                 munmap((void *)secs->base, encl->encl_size);
 100                 return false;
 101         }
 102
 103         return true;
 104 }
 105
 106 static bool encl_ioc_add_pages(struct encl *encl, struct encl_segment *seg)
 107 {
 108         struct sgx_enclave_add_pages ioc;
 109         struct sgx_secinfo secinfo;
 110         int rc;
 111
 112         memset(&secinfo, 0, sizeof(secinfo));
 113         secinfo.flags = seg->flags;
 114
 115         ioc.src = (uint64_t)seg->src;
 116         ioc.offset = seg->offset;
 117         ioc.length = seg->size;
 118         ioc.secinfo = (unsigned long)&secinfo;
 119         if (seg->measure)
 120                 ioc.flags = SGX_PAGE_MEASURE;
 121         else
 122                 ioc.flags = 0;
 123
 124         rc = ioctl(encl->fd, SGX_IOC_ENCLAVE_ADD_PAGES, &ioc);
 125         if (rc < 0) {
 126                 perror("SGX_IOC_ENCLAVE_ADD_PAGES failed");
 127                 return false;
 128         }
 129
 130         return true;
 131 }
 132
 133 /*
 134  * Parse the enclave code's symbol table to locate and return address of
 135  * the provided symbol
 136  */
 137 uint64_t encl_get_entry(struct encl *encl, const char *symbol)
 138 {
 139         Elf64_Sym *symtab = NULL;
 140         char *sym_names = NULL;
 141         Elf64_Shdr *sections;
 142         Elf64_Ehdr *ehdr;
 143         int num_sym = 0;
 144         int i;
 145
 146         ehdr = encl->bin;
 147         sections = encl->bin + ehdr->e_shoff;
 148
 149         for (i = 0; i < ehdr->e_shnum; i++) {
 150                 if (sections[i].sh_type == SHT_SYMTAB) {
 151                         symtab = (Elf64_Sym *)((char *)encl->bin + sections[i].sh_offset);
 152                         num_sym = sections[i].sh_size / sections[i].sh_entsize;
 153                         break;
 154                 }
 155         }
 156
 157         for (i = 0; i < ehdr->e_shnum; i++) {
 158                 if (sections[i].sh_type == SHT_STRTAB) {
 159                         sym_names = (char *)encl->bin + sections[i].sh_offset;
 160                         break;
 161                 }
 162         }
 163
 164         if (!symtab || !sym_names)
 165                 return 0;
 166
 167         for (i = 0; i < num_sym; i++) {
 168                 Elf64_Sym *sym = &symtab[i];
 169
 170                 if (!strcmp(symbol, sym_names + sym->st_name))
 171                         return (uint64_t)sym->st_value;
 172         }
 173
 174         return 0;
 175 }
 176
 177 bool encl_load(const char *path, struct encl *encl, unsigned long heap_size)
 178 {
 179         const char device_path[] = "/dev/sgx_enclave";
 180         struct encl_segment *seg;
 181         Elf64_Phdr *phdr_tbl;
 182         off_t src_offset;
 183         Elf64_Ehdr *ehdr;
 184         struct stat sb;
 185         void *ptr;
 186         int i, j;
 187         int ret;
 188         int fd = -1;
 189
 190         memset(encl, 0, sizeof(*encl));
 191
 192         fd = open(device_path, O_RDWR);
 193         if (fd < 0) {
 194                 perror("Unable to open /dev/sgx_enclave");
 195                 goto err;
 196         }
 197
 198         ret = stat(device_path, &sb);
 199         if (ret) {
 200                 perror("device file stat()");
 201                 goto err;
 202         }
 203
 204         ptr = mmap(NULL, PAGE_SIZE, PROT_READ, MAP_SHARED, fd, 0);
 205         if (ptr == (void *)-1) {
 206                 perror("mmap for read");
 207                 goto err;
 208         }
 209         munmap(ptr, PAGE_SIZE);
 210
 211 #define ERR_MSG \
 212 "mmap() succeeded for PROT_READ, but failed for PROT_EXEC.\n" \
 213 " Check that /dev does not have noexec set:\n" \
 214 " \tmount | grep \"/dev .*noexec\"\n" \
 215 " If so, remount it executable: mount -o remount,exec /dev\n\n"
 216
 217         ptr = mmap(NULL, PAGE_SIZE, PROT_EXEC, MAP_SHARED, fd, 0);
 218         if (ptr == (void *)-1) {
 219                 fprintf(stderr, ERR_MSG);
 220                 goto err;
 221         }
 222         munmap(ptr, PAGE_SIZE);
 223
 224         encl->fd = fd;
 225
 226         if (!encl_map_bin(path, encl))
 227                 goto err;
 228
 229         ehdr = encl->bin;
 230         phdr_tbl = encl->bin + ehdr->e_phoff;
 231
 232         encl->nr_segments = 1; /* one for the heap */
 233
 234         for (i = 0; i < ehdr->e_phnum; i++) {
 235                 Elf64_Phdr *phdr = &phdr_tbl[i];
 236
 237                 if (phdr->p_type == PT_LOAD)
 238                         encl->nr_segments++;
 239         }
 240
 241         encl->segment_tbl = calloc(encl->nr_segments,
 242                                    sizeof(struct encl_segment));
 243         if (!encl->segment_tbl)
 244                 goto err;
 245
 246         for (i = 0, j = 0; i < ehdr->e_phnum; i++) {
 247                 Elf64_Phdr *phdr = &phdr_tbl[i];
 248                 unsigned int flags = phdr->p_flags;
 249
 250                 if (phdr->p_type != PT_LOAD)
 251                         continue;
 252
 253                 seg = &encl->segment_tbl[j];
 254
 255                 if (!!(flags & ~(PF_R | PF_W | PF_X))) {
 256                         fprintf(stderr,
 257                                 "%d has invalid segment flags 0x%02x.\n", i,
 258                                 phdr->p_flags);
 259                         goto err;
 260                 }
 261
 262                 if (j == 0 && flags != (PF_R | PF_W)) {
 263                         fprintf(stderr,
 264                                 "TCS has invalid segment flags 0x%02x.\n",
 265                                 phdr->p_flags);
 266                         goto err;
 267                 }
 268
 269                 if (j == 0) {
 270                         src_offset = phdr->p_offset & PAGE_MASK;
 271                         encl->src = encl->bin + src_offset;
 272
 273                         seg->prot = PROT_READ | PROT_WRITE;
 274                         seg->flags = SGX_PAGE_TYPE_TCS << 8;
 275                 } else  {
 276                         seg->prot = (phdr->p_flags & PF_R) ? PROT_READ : 0;
 277                         seg->prot |= (phdr->p_flags & PF_W) ? PROT_WRITE : 0;
 278                         seg->prot |= (phdr->p_flags & PF_X) ? PROT_EXEC : 0;
 279                         seg->flags = (SGX_PAGE_TYPE_REG << 8) | seg->prot;
 280                 }
 281
 282                 seg->offset = (phdr->p_offset & PAGE_MASK) - src_offset;
 283                 seg->size = (phdr->p_filesz + PAGE_SIZE - 1) & PAGE_MASK;
 284                 seg->src = encl->src + seg->offset;
 285                 seg->measure = true;
 286
 287                 j++;
 288         }
 289
 290         assert(j == encl->nr_segments - 1);
 291
 292         seg = &encl->segment_tbl[j];
 293         seg->offset =  encl->segment_tbl[j - 1].offset + encl->segment_tbl[j - 1].size;
 294         seg->size = heap_size;
 295         seg->src = mmap(NULL, heap_size, PROT_READ | PROT_WRITE,
 296                         MAP_ANONYMOUS | MAP_PRIVATE, -1, 0);
 297         seg->prot = PROT_READ | PROT_WRITE;
 298         seg->flags = (SGX_PAGE_TYPE_REG << 8) | seg->prot;
 299         seg->measure = false;
 300
 301         if (seg->src == MAP_FAILED)
 302                 goto err;
 303
 304         encl->src_size = encl->segment_tbl[j].offset + encl->segment_tbl[j].size;
 305
 306         for (encl->encl_size = 4096; encl->encl_size < encl->src_size; )
 307                 encl->encl_size <<= 1;
 308
 309         return true;
 310
 311 err:
 312         if (fd != -1)
 313                 close(fd);
 314         encl_delete(encl);
 315         return false;
 316 }
 317
 318 static bool encl_map_area(struct encl *encl)
 319 {
 320         size_t encl_size = encl->encl_size;
 321         void *area;
 322
 323         area = mmap(NULL, encl_size * 2, PROT_NONE,
 324                     MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
 325         if (area == MAP_FAILED) {
 326                 perror("reservation mmap()");
 327                 return false;
 328         }
 329
 330         encl->encl_base = ((uint64_t)area + encl_size - 1) & ~(encl_size - 1);
 331
 332         munmap(area, encl->encl_base - (uint64_t)area);
 333         munmap((void *)(encl->encl_base + encl_size),
 334                (uint64_t)area + encl_size - encl->encl_base);
 335
 336         return true;
 337 }
 338
 339 bool encl_build(struct encl *encl)
 340 {
 341         struct sgx_enclave_init ioc;
 342         int ret;
 343         int i;
 344
 345         if (!encl_map_area(encl))
 346                 return false;
 347
 348         if (!encl_ioc_create(encl))
 349                 return false;
 350
 351         /*
 352          * Pages must be added before mapping VMAs because their permissions
 353          * cap the VMA permissions.
 354          */
 355         for (i = 0; i < encl->nr_segments; i++) {
 356                 struct encl_segment *seg = &encl->segment_tbl[i];
 357
 358                 if (!encl_ioc_add_pages(encl, seg))
 359                         return false;
 360         }
 361
 362         ioc.sigstruct = (uint64_t)&encl->sigstruct;
 363         ret = ioctl(encl->fd, SGX_IOC_ENCLAVE_INIT, &ioc);
 364         if (ret) {
 365                 perror("SGX_IOC_ENCLAVE_INIT failed");
 366                 return false;
 367         }
 368
 369         return true;
 370 }