Skip to content

Commit 9758175

Browse files
lllyllly
committed
Fix sgx_report_attestation_status() and sgx_check_update_status()
Remove the dependency on platform service from epid quote service in aesm_service. Signed-off-by: Li, Xun <[email protected]>
1 parent b8c14d1 commit 9758175

File tree

6 files changed

+753
-2
lines changed

6 files changed

+753
-2
lines changed

‎psw/ae/aesm_service/source/bundles/epid_quote_service_bundle/epid_quote_service_bundle.cpp‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,7 @@
2929
#include "service_enclave_mrsigner.hh"
3030
#include "sgx_ql_quote.h"
3131
#include "se_sig_rl.h"
32+
#include "platform_info_logic.h"
3233

3334
using namespace cppmicroservices;
3435
std::shared_ptr<INetworkService> g_network_service;
@@ -521,6 +522,34 @@ class EpidQuoteServiceImp : public IEpidQuoteService, public IQuoteProviderServi
521522
*att_key_id_num = 2;
522523
return AESM_SUCCESS;
523524
}
525+
526+
aesm_error_t report_attestation_status(
527+
uint8_t* platform_info, uint32_t platform_info_size,
528+
uint32_t attestation_status,
529+
uint8_t* update_info, uint32_t update_info_size)
530+
{
531+
AESM_DBG_INFO("LocalPseopServiceImp::report_attestation_status");
532+
if (false == initialized)
533+
return AESM_SERVICE_UNAVAILABLE;
534+
AESMLogicLock lock(_qe_pve_mutex);
535+
return PlatformInfoLogic::report_attestation_status(platform_info,platform_info_size,
536+
attestation_status,
537+
update_info, update_info_size);
538+
}
539+
540+
aesm_error_t check_update_status(
541+
uint8_t* platform_info, uint32_t platform_info_size,
542+
uint8_t* update_info, uint32_t update_info_size,
543+
uint32_t config, uint32_t* status)
544+
{
545+
AESM_DBG_INFO("LocalPseopServiceImp::check_update_status");
546+
if (false == initialized)
547+
return AESM_SERVICE_UNAVAILABLE;
548+
AESMLogicLock lock(_qe_pve_mutex);
549+
return PlatformInfoLogic::check_update_status(platform_info,platform_info_size,
550+
update_info, update_info_size,
551+
config, status);
552+
}
524553
};
525554

526555
class Activator : public BundleActivator

‎psw/ae/aesm_service/source/bundles/epid_quote_service_bundle/platform_info_facility.cpp‎

Lines changed: 164 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,164 @@
1+
/*
2+
* Copyright (C) 2011-2019 Intel Corporation. All rights reserved.
3+
*
4+
* Redistribution and use in source and binary forms, with or without
5+
* modification, are permitted provided that the following conditions
6+
* are met:
7+
*
8+
* * Redistributions of source code must retain the above copyright
9+
* notice, this list of conditions and the following disclaimer.
10+
* * Redistributions in binary form must reproduce the above copyright
11+
* notice, this list of conditions and the following disclaimer in
12+
* the documentation and/or other materials provided with the
13+
* distribution.
14+
* * Neither the name of Intel Corporation nor the names of its
15+
* contributors may be used to endorse or promote products derived
16+
* from this software without specific prior written permission.
17+
*
18+
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
19+
* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
20+
* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
21+
* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
22+
* OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
23+
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
24+
* LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
25+
* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
26+
* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
27+
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
28+
* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
29+
*
30+
*/
31+
32+
#include "platform_info_logic.h"
33+
#include "byte_order.h"
34+
#include <assert.h>
35+
#include "sgx_profile.h"
36+
37+
38+
#include "cppmicroservices/BundleContext.h"
39+
#include <cppmicroservices/GetBundleContext.h>
40+
using namespace cppmicroservices;
41+
42+
ae_error_t PlatformInfoLogic::get_sgx_epid_group_flags(const platform_info_blob_wrapper_t* p_platform_info_blob, uint8_t* pflags)
43+
{
44+
ae_error_t retval = AE_SUCCESS;
45+
if (NULL != pflags && NULL != p_platform_info_blob && p_platform_info_blob->valid_info_blob) {
46+
*pflags = p_platform_info_blob->platform_info_blob.sgx_epid_group_flags;
47+
}
48+
else {
49+
retval = AE_INVALID_PARAMETER;
50+
}
51+
return retval;
52+
}
53+
54+
ae_error_t PlatformInfoLogic::get_sgx_tcb_evaluation_flags(const platform_info_blob_wrapper_t* p_platform_info_blob, uint16_t* pflags)
55+
{
56+
ae_error_t retval = AE_SUCCESS;
57+
if (NULL != pflags && NULL != p_platform_info_blob && p_platform_info_blob->valid_info_blob) {
58+
const uint16_t* p = reinterpret_cast<const uint16_t*>(p_platform_info_blob->platform_info_blob.sgx_tcb_evaluation_flags);
59+
*pflags = lv_ntohs(*p);
60+
}
61+
else {
62+
retval = AE_INVALID_PARAMETER;
63+
}
64+
return retval;
65+
}
66+
67+
bool PlatformInfoLogic::sgx_gid_out_of_date(const platform_info_blob_wrapper_t* p_platform_info_blob)
68+
{
69+
uint8_t flags = 0;
70+
bool retVal = false;
71+
ae_error_t getflagsError = get_sgx_epid_group_flags(p_platform_info_blob, &flags);
72+
if (AE_SUCCESS == getflagsError) {
73+
retVal = (0 != (QE_EPID_GROUP_OUT_OF_DATE & flags));
74+
}
75+
SGX_DBGPRINT_ONE_STRING_TWO_INTS_CREATE_SESSION(__FUNCTION__" returning ", retVal, retVal);
76+
77+
return retVal;
78+
}
79+
80+
bool PlatformInfoLogic::performance_rekey_available(const platform_info_blob_wrapper_t* p_platform_info_blob)
81+
{
82+
//
83+
// return whether platform info blob says PR is available
84+
// the group associated with PR that's returned corresponds to the group
85+
// that we'll be in **after** executing PR
86+
//
87+
bool retVal = false;
88+
uint8_t flags;
89+
ae_error_t getflagsError = get_sgx_epid_group_flags(p_platform_info_blob, &flags);
90+
if (AE_SUCCESS == getflagsError) {
91+
retVal = static_cast<bool>(flags & PERF_REKEY_FOR_QE_EPID_GROUP_AVAILABLE);
92+
}
93+
SGX_DBGPRINT_ONE_STRING_TWO_INTS_CREATE_SESSION(__FUNCTION__" returning ", retVal, retVal);
94+
return retVal;
95+
}
96+
bool PlatformInfoLogic::qe_svn_out_of_date(const platform_info_blob_wrapper_t* p_platform_info_blob)
97+
{
98+
uint16_t flags = 0;
99+
bool retVal = true;
100+
ae_error_t getflagsError = get_sgx_tcb_evaluation_flags(p_platform_info_blob, &flags);
101+
if (AE_SUCCESS == getflagsError) {
102+
retVal = (0 != (QUOTE_ISVSVN_QE_OUT_OF_DATE & flags));
103+
}
104+
SGX_DBGPRINT_ONE_STRING_TWO_INTS_CREATE_SESSION(__FUNCTION__" returning ", retVal, retVal);
105+
return retVal;
106+
}
107+
108+
bool PlatformInfoLogic::pce_svn_out_of_date(const platform_info_blob_wrapper_t* p_platform_info_blob)
109+
{
110+
uint16_t flags = 0;
111+
bool retVal = true;
112+
ae_error_t getflagsError = get_sgx_tcb_evaluation_flags(p_platform_info_blob, &flags);
113+
if (AE_SUCCESS == getflagsError) {
114+
retVal = (0 != (QUOTE_ISVSVN_PCE_OUT_OF_DATE & flags));
115+
}
116+
SGX_DBGPRINT_ONE_STRING_TWO_INTS_CREATE_SESSION(__FUNCTION__" returning ", retVal, retVal);
117+
return retVal;
118+
}
119+
120+
bool PlatformInfoLogic::cpu_svn_out_of_date(const platform_info_blob_wrapper_t* p_platform_info_blob)
121+
{
122+
uint16_t flags = 0;
123+
bool retVal = false;
124+
ae_error_t getflagsError = get_sgx_tcb_evaluation_flags(p_platform_info_blob, &flags);
125+
if (AE_SUCCESS == getflagsError) {
126+
retVal = (0 != (QUOTE_CPUSVN_OUT_OF_DATE & flags));
127+
}
128+
SGX_DBGPRINT_ONE_STRING_TWO_INTS_CREATE_SESSION(__FUNCTION__" returning ", retVal, retVal);
129+
130+
return retVal;
131+
}
132+
133+
bool PlatformInfoLogic::platform_configuration_needed(const platform_info_blob_wrapper_t* p_platform_info_blob)
134+
{
135+
uint16_t flags = 0;
136+
bool retVal = false;
137+
ae_error_t getflagsError = get_sgx_tcb_evaluation_flags(p_platform_info_blob, &flags);
138+
if (AE_SUCCESS == getflagsError) {
139+
retVal = (0 != (PLATFORM_CONFIGURATION_NEEDED & flags));
140+
}
141+
SGX_DBGPRINT_ONE_STRING_TWO_INTS_CREATE_SESSION(__FUNCTION__" returning ", retVal, retVal);
142+
143+
return retVal;
144+
}
145+
146+
ae_error_t PlatformInfoLogic::need_epid_provisioning(const platform_info_blob_wrapper_t* p_platform_info_blob)
147+
{
148+
ae_error_t status = AESM_NEP_DONT_NEED_EPID_PROVISIONING;
149+
if (sgx_gid_out_of_date(p_platform_info_blob) &&
150+
!qe_svn_out_of_date(p_platform_info_blob) &&
151+
!cpu_svn_out_of_date(p_platform_info_blob) &&
152+
!pce_svn_out_of_date(p_platform_info_blob) &&
153+
!platform_configuration_needed(p_platform_info_blob))
154+
{
155+
status = AESM_NEP_DONT_NEED_UPDATE_PVEQE; // don't need update, but need epid provisioning
156+
}
157+
else if (!sgx_gid_out_of_date(p_platform_info_blob) && performance_rekey_available(p_platform_info_blob))
158+
{
159+
status = AESM_NEP_PERFORMANCE_REKEY;
160+
}
161+
SGX_DBGPRINT_ONE_STRING_TWO_INTS_CREATE_SESSION(__FUNCTION__" returning ", status, status);
162+
return status;
163+
}
164+

0 commit comments

Comments
 (0)