tmakin/tegra-linux-noble
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

selftests/sgx: Add test for TCS page permission changes

Browse Source 
Kernel should not allow permission changes on TCS pages. Add test to
confirm this behavior.

Signed-off-by: Reinette Chatre <reinette.chatre@intel.com>
Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
Acked-by: Jarkko Sakkinen <jarkko@kernel.org>
Link: https://lkml.kernel.org/r/0121ad1b21befb94519072e2c18b89aa5dca00d4.1652137848.git.reinette.chatre@intel.com
This commit is contained in:
Reinette Chatre
2022-05-10 11:08:59 -07:00
committed by Dave Hansen
parent 20404a8085
commit 7088c81f94
1 changed files with 71 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tools/testing/selftests/sgx/main.c
+71
View File
@@ -121,6 +121,24 @@ static Elf64_Sym *vdso_symtab_get(struct vdso_symtab *symtab, const char *name)
return NULL;
}
/*
* Return the offset in the enclave where the TCS segment can be found.
* The first RW segment loaded is the TCS.
*/
static off_t encl_get_tcs_offset(struct encl *encl)
{
int i;
for (i = 0; i < encl->nr_segments; i++) {
struct encl_segment *seg = &encl->segment_tbl[i];
if (i == 0 && seg->prot == (PROT_READ | PROT_WRITE))
return seg->offset;
}
return -1;
}
/*
* Return the offset in the enclave where the data segment can be found.
* The first RW segment loaded is the TCS, skip that to get info on the
@@ -567,6 +585,59 @@ TEST_F(enclave, pte_permissions)
EXPECT_EQ(self->run.exception_addr, 0);
}
/*
* Modifying permissions of TCS page should not be possible.
*/
TEST_F(enclave, tcs_permissions)
{
struct sgx_enclave_restrict_permissions ioc;
int ret, errno_save;
ASSERT_TRUE(setup_test_encl(ENCL_HEAP_SIZE_DEFAULT, &self->encl, _metadata));
memset(&self->run, 0, sizeof(self->run));
self->run.tcs = self->encl.encl_base;
memset(&ioc, 0, sizeof(ioc));
/*
* Ensure kernel supports needed ioctl() and system supports needed
* commands.
*/
ret = ioctl(self->encl.fd, SGX_IOC_ENCLAVE_RESTRICT_PERMISSIONS, &ioc);
errno_save = ret == -1 ? errno : 0;
/*
* Invalid parameters were provided during sanity check,
* expect command to fail.
*/
ASSERT_EQ(ret, -1);
/* ret == -1 */
if (errno_save == ENOTTY)
SKIP(return,
"Kernel does not support SGX_IOC_ENCLAVE_RESTRICT_PERMISSIONS ioctl()");
else if (errno_save == ENODEV)
SKIP(return, "System does not support SGX2");
/*
* Attempt to make TCS page read-only. This is not allowed and
* should be prevented by the kernel.
*/
ioc.offset = encl_get_tcs_offset(&self->encl);
ioc.length = PAGE_SIZE;
ioc.permissions = SGX_SECINFO_R;
ret = ioctl(self->encl.fd, SGX_IOC_ENCLAVE_RESTRICT_PERMISSIONS, &ioc);
errno_save = ret == -1 ? errno : 0;
EXPECT_EQ(ret, -1);
EXPECT_EQ(errno_save, EINVAL);
EXPECT_EQ(ioc.result, 0);
EXPECT_EQ(ioc.count, 0);
}
/*
* Enclave page permission test.
*