lkml.org 
[lkml]   [2021]   [Dec]   [1]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 12/25] selftests/sgx: Add test for TCS page permission changes
    Date
    Kernel should not allow permission changes on TCS pages. Add test to
    confirm this behavior.

    Signed-off-by: Reinette Chatre <reinette.chatre@intel.com>
    ---
    tools/testing/selftests/sgx/main.c | 70 ++++++++++++++++++++++++++++++
    1 file changed, 70 insertions(+)

    diff --git a/tools/testing/selftests/sgx/main.c b/tools/testing/selftests/sgx/main.c
    index dbd071ba03fe..c7c50d05e246 100644
    --- a/tools/testing/selftests/sgx/main.c
    +++ b/tools/testing/selftests/sgx/main.c
    @@ -120,6 +120,24 @@ static Elf64_Sym *vdso_symtab_get(struct vdso_symtab *symtab, const char *name)
    return NULL;
    }

    +/*
    + * Return the offset in the enclave where the TCS segment can be found.
    + * The first RW segment loaded is the TCS.
    + */
    +static off_t encl_get_tcs_offset(struct encl *encl)
    +{
    + int i;
    +
    + for (i = 0; i < encl->nr_segments; i++) {
    + struct encl_segment *seg = &encl->segment_tbl[i];
    +
    + if (i == 0 && seg->prot == (PROT_READ | PROT_WRITE))
    + return seg->offset;
    + }
    +
    + return -1;
    +}
    +
    /*
    * Return the offset in the enclave where the data segment can be found.
    * The first RW segment loaded is the TCS, skip that to get info on the
    @@ -567,6 +585,58 @@ TEST_F(enclave, pte_permissions)
    EXPECT_EQ(self->run.exception_addr, 0);
    }

    +/*
    + * Modifying permissions of TCS page should not be possible.
    + */
    +TEST_F(enclave, tcs_permissions)
    +{
    + struct sgx_page_modp ioc;
    + int ret, errno_save;
    +
    + ASSERT_TRUE(setup_test_encl(ENCL_HEAP_SIZE_DEFAULT, &self->encl, _metadata));
    +
    + memset(&self->run, 0, sizeof(self->run));
    + self->run.tcs = self->encl.encl_base;
    +
    + memset(&ioc, 0, sizeof(ioc));
    +
    + /*
    + * Ensure kernel supports needed ioctl and system supports needed
    + * commands.
    + */
    +
    + ret = ioctl(self->encl.fd, SGX_IOC_PAGE_MODP, &ioc);
    +
    + if (ret == -1) {
    + if (errno == ENOTTY)
    + SKIP(return, "Kernel does not support test SGX_IOC_PAGE_MODP ioctl");
    + else if (errno == ENODEV)
    + SKIP(return, "System does not support SGX2");
    + }
    +
    + /*
    + * Invalid parameters were provided during sanity check,
    + * expect command to fail.
    + */
    + EXPECT_EQ(ret, -1);
    +
    + /*
    + * Attempt to make TCS page read-only. This is not allowed and
    + * should be prevented by OS.
    + */
    + ioc.offset = encl_get_tcs_offset(&self->encl);
    + ioc.length = PAGE_SIZE;
    + ioc.prot = PROT_READ;
    +
    + ret = ioctl(self->encl.fd, SGX_IOC_PAGE_MODP, &ioc);
    + errno_save = ret == -1 ? errno : 0;
    +
    + EXPECT_EQ(ret, -1);
    + EXPECT_EQ(errno_save, EINVAL);
    + EXPECT_EQ(ioc.result, 0);
    + EXPECT_EQ(ioc.count, 0);
    +}
    +
    /*
    * Enclave page permission test.
    *
    --
    2.25.1
    \
     
     \ /
      Last update: 2021-12-01 20:24    [W:2.437 / U:0.012 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site