Update to in-enclave load and move communication structs defines into…

… shared headers (#415) This PR consolidates duplicated definitions of various structs, enums, and defines which are used for inter-project communication. This includes mainly the SDK <-> driver <-> SM <-> runtime <-> eapp interfaces. --------- Co-authored-by: Gregor Haas <[email protected]>
keystone-enclave · Jan 20, 2024 · 874b3d8 · 874b3d8
1 parent 0b0d01a
commit 874b3d8
Show file tree

Hide file tree

Showing 54 changed files with 331 additions and 467 deletions.
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
@@ -195,33 +195,7 @@ jobs:
         run: |
           sudo apt-get -y update && sudo apt-get -y install ccache
 
-      # First, fetch the caches themselves. We need both the base cache that
-      # was used as well as the overlay caches. Note that the base caches may
-      # fail, which is okay.
-      - name: Restore buildroot packages
-        uses: actions/cache/restore@v3
-        with:
-          path: dl.tar
-          key: ${{ needs.build.outputs.buildroot-dl-matched-key }}
-
-      - name: Restore ccache
-        uses: actions/cache/restore@v3
-        with:
-          path: ccache.tar.xz
-          key: ${{ needs.build.outputs.ccache-matched-key }}
-
-      - name: Prepare output directories
-        run: |
-          rm -rf buildroot/dl buildroot-ccache
-          mkdir -p buildroot/dl/ buildroot-ccache/
-          if [[ -f dl.tar ]]; then
-            tar -xf dl.tar -C buildroot
-          fi
-
-          if [[ -f ccache.tar.xz ]]; then
-            tar -xf ccache.tar.xz
-          fi
-
+      # Fetch new cache changes from this workflow run, if any
       - name: Fetch updated buildroot packages
         uses: actions/download-artifact@v4
         with:
@@ -232,7 +206,6 @@ jobs:
         with:
           pattern: keystone-*-ccache
 
-      # Then, combine the caches
       - name: Check which caches to update
         id: check-caches
         run: |
@@ -256,6 +229,32 @@ jobs:
             touch .update-ccache
           fi
 
+      - name: Restore buildroot packages
+        uses: actions/cache/restore@v3
+        if: ${{ steps.check-caches.outputs.BUILDROOT_DL_UPDATE == 'true' }}
+        with:
+          path: dl.tar
+          key: ${{ needs.build.outputs.buildroot-dl-matched-key }}
+
+      - name: Restore ccache
+        uses: actions/cache/restore@v3
+        if: ${{ steps.check-caches.outputs.BUILDROOT_CCACHE_UPDATE == 'true' }}
+        with:
+          path: ccache.tar.xz
+          key: ${{ needs.build.outputs.ccache-matched-key }}
+
+      - name: Prepare output directories
+        run: |
+          rm -rf buildroot/dl buildroot-ccache
+          mkdir -p buildroot/dl/ buildroot-ccache/
+          if [[ -f dl.tar ]]; then
+            tar -xf dl.tar -C buildroot
+          fi
+
+          if [[ -f ccache.tar.xz ]]; then
+            tar -xf ccache.tar.xz
+          fi
+
       - name: Merge caches
         run: |
           if [[ -f .update-buildroot-dl ]]; then
@@ -327,7 +326,7 @@ jobs:
     - name: Checkout Keystone
       uses: actions/checkout@v3
       with:
-        submodules: 'recursive'
+        submodules: 'true'
 
     - name: Run ctest
       run: |

diff --git a/.github/workflows/test-system.yml b/.github/workflows/test-system.yml
@@ -38,7 +38,7 @@ jobs:
         screen -L -dmS qemu bash -c "make run 2>&1 | tee run.log"
 
         # TODO: check for connectivity instead of sleeping
-        sleep 20
+        sleep 60
 
         export CALL_LOGFILE=cmd.log
         echo "" > $CALL_LOGFILE

diff --git a/examples/attestation/host/attestor-runner.cpp b/examples/attestation/host/attestor-runner.cpp
@@ -22,7 +22,7 @@ main(int argc, char** argv) {
   if (argc < 4 || argc > 9) {
     printf(
         "Usage: %s <eapp> <runtime> <loader> [--utm-size SIZE(K)] "
-        "[--freemem-size SIZE(K)] [--utm-ptr 0xPTR] [--sm-bin SM_BIN_PATH]\n",
+        "[--freemem-size SIZE(K)] [--sm-bin SM_BIN_PATH]\n",
         argv[0]);
     return 0;
   }
@@ -32,13 +32,11 @@ main(int argc, char** argv) {
 
   size_t untrusted_size = 2 * 1024 * 1024;
   size_t freemem_size   = 48 * 1024 * 1024;
-  uintptr_t utm_ptr     = (uintptr_t)DEFAULT_UNTRUSTED_PTR;
   bool retval_exist     = false;
   unsigned long retval  = 0;
 
   static struct option long_options[] = {
       {"utm-size", required_argument, 0, 'u'},
-      {"utm-ptr", required_argument, 0, 'p'},
       {"freemem-size", required_argument, 0, 'f'},
       {"sm-bin", required_argument, 0, 's'},
       {0, 0, 0, 0}};
@@ -51,7 +49,7 @@ main(int argc, char** argv) {
   int c;
   int opt_index = 4;
   while (1) {
-    c = getopt_long(argc, argv, "u:p:f:s:", long_options, &opt_index);
+    c = getopt_long(argc, argv, "u:f:s:", long_options, &opt_index);
 
     if (c == -1) break;
 
@@ -61,9 +59,6 @@ main(int argc, char** argv) {
       case 'u':
         untrusted_size = atoi(optarg) * 1024;
         break;
-      case 'p':
-        utm_ptr = strtoll(optarg, NULL, 16);
-        break;
       case 'f':
         freemem_size = atoi(optarg) * 1024;
         break;
@@ -81,7 +76,7 @@ main(int argc, char** argv) {
   Keystone::Params params;
 
   params.setFreeMemSize(freemem_size);
-  params.setUntrustedMem(utm_ptr, untrusted_size);
+  params.setUntrustedSize(untrusted_size);
 
   Verifier verifier{params, eapp_file, rt_file, ld_file, sm_bin_file};
   verifier.run();

diff --git a/examples/hello-native/host/host_native.cpp b/examples/hello-native/host/host_native.cpp
@@ -28,7 +28,7 @@ main(int argc, char** argv) {
   Keystone::Params params;
 
   params.setFreeMemSize(1024 * 1024);
-  params.setUntrustedMem(DEFAULT_UNTRUSTED_PTR, 1024 * 1024);
+  params.setUntrustedSize(1024 * 1024);
 
   enclave.init(argv[1], argv[2], argv[3], params);
 

diff --git a/examples/hello/host/host.cpp b/examples/hello/host/host.cpp
@@ -13,7 +13,7 @@ main(int argc, char** argv) {
   Params params;
 
   params.setFreeMemSize(256 * 1024);
-  params.setUntrustedMem(DEFAULT_UNTRUSTED_PTR, 256 * 1024);
+  params.setUntrustedSize(256 * 1024);
 
   enclave.init(argv[1], argv[2], argv[3], params);
 

diff --git a/examples/tests/test-runner.cpp b/examples/tests/test-runner.cpp
@@ -68,15 +68,13 @@ main(int argc, char** argv) {
 
   size_t untrusted_size = 2 * 1024 * 1024;
   size_t freemem_size   = 48 * 1024 * 1024;
-  uintptr_t utm_ptr     = (uintptr_t)DEFAULT_UNTRUSTED_PTR;
   bool retval_exist = false;
   unsigned long retval = 0;
 
   static struct option long_options[] = {
       {"time", no_argument, &self_timing, 1},
       {"load-only", no_argument, &load_only, 1},
       {"utm-size", required_argument, 0, 'u'},
-      {"utm-ptr", required_argument, 0, 'p'},
       {"freemem-size", required_argument, 0, 'f'},
       {"retval", required_argument, 0, 'r'},
       {0, 0, 0, 0}};
@@ -88,7 +86,7 @@ main(int argc, char** argv) {
   int c;
   int opt_index = 3;
   while (1) {
-    c = getopt_long(argc, argv, "u:p:f:", long_options, &opt_index);
+    c = getopt_long(argc, argv, "u:f:", long_options, &opt_index);
 
     if (c == -1) break;
 
@@ -98,9 +96,6 @@ main(int argc, char** argv) {
       case 'u':
         untrusted_size = atoi(optarg) * 1024;
         break;
-      case 'p':
-        utm_ptr = strtoll(optarg, NULL, 16);
-        break;
       case 'f':
         freemem_size = atoi(optarg) * 1024;
         break;
@@ -116,7 +111,7 @@ main(int argc, char** argv) {
   unsigned long cycles1, cycles2, cycles3, cycles4;
 
   params.setFreeMemSize(freemem_size);
-  params.setUntrustedMem(utm_ptr, untrusted_size);
+  params.setUntrustedSize(untrusted_size);
 
   if (self_timing) {
     asm volatile("rdcycle %0" : "=r"(cycles1));

diff --git a/linux-keystone-driver/Makefile b/linux-keystone-driver/Makefile
@@ -8,6 +8,12 @@ ifneq ($(KERNELRELEASE),)
 		keystone-enclave.o \
 	  keystone-sbi.o
 	obj-m += keystone-driver.o
+
+ifeq ($(KEYSTONE_SDK_DIR),)
+    $(error KEYSTONE_SDK_DIR not defined)
+endif
+
+	ccflags-y := -I$(KEYSTONE_SDK_DIR)/include/shared
 else
 
 PWD := $(shell pwd)

diff --git a/linux-keystone-driver/keystone-ioctl.c b/linux-keystone-driver/keystone-ioctl.c
@@ -24,7 +24,7 @@ int keystone_create_enclave(struct file *filep, unsigned long arg)
   }
 
   /* Pass base page table */
-  enclp->pt_ptr = enclave->epm->pa;
+  enclp->epm_paddr = enclave->epm->pa;
   enclp->epm_size = enclave->epm->size;
 
   /* allocate UID */
@@ -71,8 +71,7 @@ int keystone_finalize_enclave(unsigned long arg)
   create_args.runtime_paddr = enclp->runtime_paddr;
   create_args.user_paddr = enclp->user_paddr;
   create_args.free_paddr = enclp->free_paddr;
-
-  create_args.params = enclp->params;
+  create_args.free_requested = enclp->free_requested;
 
   ret = sbi_sm_create_enclave(&create_args);
 
@@ -127,7 +126,7 @@ int utm_init_ioctl(struct file *filp, unsigned long arg)
   struct utm *utm;
   struct enclave *enclave;
   struct keystone_ioctl_create_enclave *enclp = (struct keystone_ioctl_create_enclave *) arg;
-  long long unsigned untrusted_size = enclp->params.untrusted_size;
+  long long unsigned untrusted_size = enclp->utm_size;
 
   enclave = get_enclave_by_id(enclp->eid);
 
@@ -147,7 +146,7 @@ int utm_init_ioctl(struct file *filp, unsigned long arg)
   /* prepare for mmap */
   enclave->utm = utm;
 
-  enclp->utm_free_ptr = __pa(utm->ptr);
+  enclp->utm_paddr = __pa(utm->ptr);
 
   return ret;
 }

diff --git a/linux-keystone-driver/keystone-sbi.c b/linux-keystone-driver/keystone-sbi.c
@@ -1,25 +1,25 @@
 #include "keystone-sbi.h"
 
 struct sbiret sbi_sm_create_enclave(struct keystone_sbi_create_t* args) {
-  return sbi_ecall(KEYSTONE_SBI_EXT_ID,
+  return sbi_ecall(SBI_EXT_EXPERIMENTAL_KEYSTONE_ENCLAVE,
       SBI_SM_CREATE_ENCLAVE,
       (unsigned long) args, 0, 0, 0, 0, 0);
 }
 
 struct sbiret sbi_sm_run_enclave(unsigned long eid) {
-  return sbi_ecall(KEYSTONE_SBI_EXT_ID,
+  return sbi_ecall(SBI_EXT_EXPERIMENTAL_KEYSTONE_ENCLAVE,
       SBI_SM_RUN_ENCLAVE,
       eid, 0, 0, 0, 0, 0);
 }
 
 struct sbiret sbi_sm_destroy_enclave(unsigned long eid) {
-  return sbi_ecall(KEYSTONE_SBI_EXT_ID,
+  return sbi_ecall(SBI_EXT_EXPERIMENTAL_KEYSTONE_ENCLAVE,
       SBI_SM_DESTROY_ENCLAVE,
       eid, 0, 0, 0, 0, 0);
 }
 
 struct sbiret sbi_sm_resume_enclave(unsigned long eid) {
-  return sbi_ecall(KEYSTONE_SBI_EXT_ID,
+  return sbi_ecall(SBI_EXT_EXPERIMENTAL_KEYSTONE_ENCLAVE,
       SBI_SM_RESUME_ENCLAVE,
       eid, 0, 0, 0, 0, 0);
 }
diff --git a/linux-keystone-driver/keystone-sbi.h b/linux-keystone-driver/keystone-sbi.h
@@ -6,35 +6,9 @@
 #define _KEYSTONE_SBI_
 
 #include "keystone_user.h"
-#include <asm/sbi.h>
-
-#define KEYSTONE_SBI_EXT_ID     0x08424b45
-#define SBI_SM_CREATE_ENCLAVE   2001
-#define SBI_SM_DESTROY_ENCLAVE  2002
-#define SBI_SM_RUN_ENCLAVE      2003
-#define SBI_SM_RESUME_ENCLAVE   2005
-
-
-struct keystone_sbi_pregion_t
-{
-  uintptr_t paddr;
-  size_t size;
-};
+#include "sm_call.h"
 
-struct keystone_sbi_create_t
-{
-  // Memory regions for the enclave
-  struct keystone_sbi_pregion_t epm_region;
-  struct keystone_sbi_pregion_t utm_region;
-
-  // physical addresses
-  uintptr_t runtime_paddr;
-  uintptr_t user_paddr;
-  uintptr_t free_paddr;
-
-  // Parameters
-  struct runtime_params_t params;
-};
+#include <asm/sbi.h>
 
 struct sbiret sbi_sm_create_enclave(struct keystone_sbi_create_t* args);
 struct sbiret sbi_sm_destroy_enclave(unsigned long eid);

diff --git a/overlays/keystone/boot/keystone-sm/Config.in b/overlays/keystone/boot/keystone-sm/Config.in
@@ -1,6 +1,7 @@
 config BR2_TARGET_KEYSTONE_SM
         bool "Keystone security monitor"
-	select BR2_TARGET_OPENSBI
+        select BR2_TARGET_OPENSBI
+        depends on BR2_PACKAGE_HOST_KEYSTONE_SDK
         help
           Keystone security monitor augmentations
           to OpenSBI
diff --git a/overlays/keystone/boot/keystone-sm/keystone-sm.mk b/overlays/keystone/boot/keystone-sm/keystone-sm.mk
@@ -10,9 +10,12 @@ else
 include $(KEYSTONE)/mkutils/pkg-keystone.mk
 endif
 
-# Make OpenSBI depend on this build
-OPENSBI_DEPENDENCIES += keystone-sm
-$(OPENSBI_TARGET_CONFIGURE): keystone-sm-install
+# Make OpenSBI depend on this build, which depends on the SDK since it contains
+# the shared headers which specify the communication protocol between the host
+# <> kernel <> sm <> runtime <> eapp
+
+OPENSBI_DEPENDENCIES += keystone-sm host-keystone-sdk
+$(OPENSBI_TARGET_CONFIGURE): keystone-sm-install host-keystone-sdk-install
 
 # Point OpenSBI at the correct location of the SM sources
 OPENSBI_MAKE_ENV += PLATFORM_DIR=$(KEYSTONE_SM_BUILDDIR)/plat/

diff --git a/overlays/keystone/package/keystone-driver/Config.in b/overlays/keystone/package/keystone-driver/Config.in
@@ -1,4 +1,5 @@
 config BR2_PACKAGE_KEYSTONE_DRIVER
         bool "Keystone driver"
+        depends on BR2_PACKAGE_HOST_KEYSTONE_SDK
         help
           Linux driver for the Keystone TEE system
diff --git a/overlays/keystone/package/keystone-driver/keystone-driver.mk b/overlays/keystone/package/keystone-driver/keystone-driver.mk
@@ -10,6 +10,8 @@ else
 include $(KEYSTONE)/mkutils/pkg-keystone.mk
 endif
 
+KEYSTONE_DRIVER_DEPENDENCIES += host-keystone-sdk
+
 $(eval $(keystone-package))
 $(eval $(kernel-module))
 $(eval $(generic-package))
diff --git a/overlays/keystone/package/keystone-runtime/Config.in b/overlays/keystone/package/keystone-runtime/Config.in
@@ -1,4 +1,5 @@
 config BR2_PACKAGE_KEYSTONE_RUNTIME
         bool "Keystone Eyrie runtime"
+        depends on BR2_PACKAGE_HOST_KEYSTONE_SDK
         help
           Eyrie runtime
diff --git a/overlays/keystone/package/keystone-sdk/keystone-sdk.mk b/overlays/keystone/package/keystone-sdk/keystone-sdk.mk
@@ -10,13 +10,17 @@ else
 include $(KEYSTONE)/mkutils/pkg-keystone.mk
 endif
 
-HOST_KEYSTONE_SDK_CONF_OPTS += -DKEYSTONE_SDK_DIR=$(HOST_DIR)/usr/share/keystone/sdk \
-                                 -DKEYSTONE_BITS=${KEYSTONE_BITS}
+# Export the variable below for any other keystone packages to use
+export KEYSTONE_SDK_DIR=$(HOST_DIR)/usr/share/keystone/sdk
 
+HOST_KEYSTONE_SDK_CONF_OPTS += -DKEYSTONE_SDK_DIR=$(KEYSTONE_SDK_DIR) \
+                                 -DKEYSTONE_BITS=${KEYSTONE_BITS}
 HOST_KEYSTONE_SDK_DEPENDENCIES += toolchain
 
-# Clean the examples too if we clean this package
-host-keystone-sdk-dirclean: keystone-examples-dirclean
+# Clean dependant packages if we clean this one
+host-keystone-sdk-dirclean: keystone-examples-dirclean \
+                                keystone-sm-dirclean \
+                                keystone-driver-dirclean
 
 $(eval $(host-keystone-package))
 $(eval $(host-cmake-package))