Commit a9880d23 authored by Reinette Chatre's avatar Reinette Chatre Committed by Zhiquan Li
Browse files

selftests/sgx: Add test for TCS page permission changes 

mainline inclusion
from mainline-6.0-rc1
commit 7088c81f
category: feature
bugzilla: https://gitee.com/openeuler/intel-kernel/issues/I5USAM


CVE: NA

Intel-SIG: commit 7088c81f selftests/sgx: Add test for TCS page
permission changes.
Backport for SGX EDMM support.

--------------------------------

Kernel should not allow permission changes on TCS pages. Add test to
confirm this behavior.

Signed-off-by: default avatarReinette Chatre <reinette.chatre@intel.com>
Signed-off-by: default avatarDave Hansen <dave.hansen@linux.intel.com>
Acked-by: default avatarJarkko Sakkinen <jarkko@kernel.org>
Link: https://lkml.kernel.org/r/0121ad1b21befb94519072e2c18b89aa5dca00d4.1652137848.git.reinette.chatre@intel.com


Signed-off-by: default avatarZhiquan Li <zhiquan1.li@intel.com>
parent 825061f2

tools/testing/selftests/sgx/main.c

+71 −0
Original line number Diff line number Diff line
@@ -121,6 +121,24 @@ static Elf64_Sym *vdso_symtab_get(struct vdso_symtab *symtab, const char *name) 
	return NULL;

}



/*

 * Return the offset in the enclave where the TCS segment can be found.

 * The first RW segment loaded is the TCS.

 */

static off_t encl_get_tcs_offset(struct encl *encl)

{

	int i;



	for (i = 0; i < encl->nr_segments; i++) {

		struct encl_segment *seg = &encl->segment_tbl[i];



		if (i == 0 && seg->prot == (PROT_READ | PROT_WRITE))

			return seg->offset;

	}



	return -1;

}



/*

 * Return the offset in the enclave where the data segment can be found.

 * The first RW segment loaded is the TCS, skip that to get info on the
@@ -566,6 +584,59 @@ TEST_F(enclave, pte_permissions) 
	EXPECT_EQ(self->run.exception_addr, 0);

}



/*

 * Modifying permissions of TCS page should not be possible.

 */

TEST_F(enclave, tcs_permissions)

{

	struct sgx_enclave_restrict_permissions ioc;

	int ret, errno_save;



	ASSERT_TRUE(setup_test_encl(ENCL_HEAP_SIZE_DEFAULT, &self->encl, _metadata));



	memset(&self->run, 0, sizeof(self->run));

	self->run.tcs = self->encl.encl_base;



	memset(&ioc, 0, sizeof(ioc));



	/*

	 * Ensure kernel supports needed ioctl() and system supports needed

	 * commands.

	 */



	ret = ioctl(self->encl.fd, SGX_IOC_ENCLAVE_RESTRICT_PERMISSIONS, &ioc);

	errno_save = ret == -1 ? errno : 0;



	/*

	 * Invalid parameters were provided during sanity check,

	 * expect command to fail.

	 */

	ASSERT_EQ(ret, -1);



	/* ret == -1 */

	if (errno_save == ENOTTY)

		SKIP(return,

		     "Kernel does not support SGX_IOC_ENCLAVE_RESTRICT_PERMISSIONS ioctl()");

	else if (errno_save == ENODEV)

		SKIP(return, "System does not support SGX2");



	/*

	 * Attempt to make TCS page read-only. This is not allowed and

	 * should be prevented by the kernel.

	 */

	ioc.offset = encl_get_tcs_offset(&self->encl);

	ioc.length = PAGE_SIZE;

	ioc.permissions = SGX_SECINFO_R;



	ret = ioctl(self->encl.fd, SGX_IOC_ENCLAVE_RESTRICT_PERMISSIONS, &ioc);

	errno_save = ret == -1 ? errno : 0;



	EXPECT_EQ(ret, -1);

	EXPECT_EQ(errno_save, EINVAL);

	EXPECT_EQ(ioc.result, 0);

	EXPECT_EQ(ioc.count, 0);

}



/*

 * Enclave page permission test.

 *