Skip to content

Commit ec0a8ed

Browse files
volcano0drvolcano0dr
authored
Support KSS on simulation mode (#885)
* Support KSS on simulation mode Signed-off-by: volcano0dr <volcano_dr@163.com>
1 parent 1314349 commit ec0a8ed

File tree

5 files changed

+167
-24
lines changed

5 files changed

+167
-24
lines changed

‎sdk/simulation/tinst/deriv.h

Lines changed: 51 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -47,36 +47,48 @@ typedef uint8_t se_owner_epoch_t[OWNEREPOCH_SIZE];
4747

4848
/* Derive data for seal key */
4949
typedef struct {
50-
uint16_t key_name; /* should always be 'SGX_KEYSELECT_SEAL' */
51-
sgx_attributes_t tmp_attr;
52-
sgx_attributes_t attribute_mask; /* attribute mask from KEYREQUEST */
53-
se_owner_epoch_t csr_owner_epoch;
54-
sgx_cpu_svn_t cpu_svn; /* CPUSVN from KEYREQUEST */
55-
sgx_isv_svn_t isv_svn; /* ISVSVN from KEYREQUEST */
56-
sgx_prod_id_t isv_prod_id; /* ISV PRODID from SECS */
57-
sgx_measurement_t mrenclave;
58-
sgx_measurement_t mrsigner;
59-
sgx_key_id_t key_id; /* KEYID from KEYREQUEST */
50+
uint16_t key_name; /* should always be 'SGX_KEYSELECT_SEAL' */
51+
uint16_t key_policy; /* Key policy from KEYREQUEST */
52+
sgx_attributes_t tmp_attr;
53+
sgx_attributes_t attribute_mask; /* attribute mask from KEYREQUEST */
54+
sgx_misc_select_t tmp_misc;
55+
sgx_misc_select_t misc_mask; /* MiscSelect mask form KEYREQUEST */
56+
se_owner_epoch_t csr_owner_epoch;
57+
sgx_cpu_svn_t cpu_svn; /* CPUSVN from KEYREQUEST */
58+
sgx_isv_svn_t isv_svn; /* ISVSVN from KEYREQUEST */
59+
sgx_prod_id_t isv_prod_id; /* ISV PRODID from SECS */
60+
sgx_config_svn_t config_svn; /* CONFIGSVN from KEYREQUEST */
61+
sgx_config_id_t config_id; /* CONFIGID from SECS */
62+
sgx_isvfamily_id_t isv_family_id; /* ISV FAMILYID from SECS */
63+
sgx_isvext_prod_id_t isv_ext_prod_id; /* ISV EXTPRODID from SECS */
64+
sgx_measurement_t mrenclave;
65+
sgx_measurement_t mrsigner;
66+
sgx_key_id_t key_id; /* KEYID from KEYREQUEST */
6067
} dd_seal_key_t;
6168

6269
/* Derive data for report key */
6370
typedef struct {
6471
uint16_t key_name; /* should always be 'SGX_KEYSELECT_REPORT' */
6572
sgx_attributes_t attributes; /* attributes from SECS */
73+
sgx_misc_select_t misc_select; /* MiscSelect from SECS */
6674
se_owner_epoch_t csr_owner_epoch;
6775
sgx_measurement_t mrenclave;
6876
sgx_cpu_svn_t cpu_svn; /* CPUSVN from CPUSVN register */
77+
sgx_config_svn_t config_svn; /* CONFIGSVN from SECS */
78+
sgx_config_id_t config_id; /* CONFIGID from SECS */
6979
sgx_key_id_t key_id; /* KEYID from KEYREQUEST */
7080
} dd_report_key_t;
7181

7282
/* Derive data for license key */
7383
typedef struct {
7484
uint16_t key_name; /* should always be 'SGX_KEYSELECT_EINITTOKEN' */
75-
sgx_attributes_t attributes; /* attributes from SECS */
85+
sgx_attributes_t tmp_attr;
86+
sgx_misc_select_t tmp_misc;
7687
se_owner_epoch_t csr_owner_epoch;
7788
sgx_cpu_svn_t cpu_svn; /* CPUSVN from KEYREQUEST */
7889
sgx_isv_svn_t isv_svn; /* ISVSVN from KEYREQUEST */
7990
sgx_prod_id_t isv_prod_id; /* ISV PRODID from SECS */
91+
sgx_measurement_t mrsigner;
8092
sgx_key_id_t key_id; /* KEYID from KEYREQUEST */
8193
} dd_license_key_t;
8294

@@ -85,25 +97,46 @@ typedef struct {
8597
uint16_t key_name; /* should always be 'SGX_KEYSELECT_PROVISION' */
8698
sgx_attributes_t tmp_attr;
8799
sgx_attributes_t attribute_mask; /* attribute mask from KEYREQUEST */
100+
sgx_misc_select_t tmp_misc;
101+
sgx_misc_select_t misc_mask; /* MiscSelect mask form KEYREQUEST */
88102
sgx_cpu_svn_t cpu_svn; /* CPUSVN from KEYREQUEST */
89103
sgx_isv_svn_t isv_svn; /* ISVSVN from KEYREQUEST */
90104
sgx_prod_id_t isv_prod_id; /* ISV PRODID from SECS */
91105
sgx_measurement_t mrsigner;
92106
} dd_provision_key_t;
93107

108+
/* Derive data for provision seal key */
109+
typedef struct {
110+
uint16_t key_name; /* should always be 'SGX_KEYSELECT_SEAL' */
111+
uint16_t key_policy; /* Key policy from KEYREQUEST */
112+
sgx_attributes_t tmp_attr;
113+
sgx_attributes_t attribute_mask; /* attribute mask from KEYREQUEST */
114+
sgx_misc_select_t tmp_misc;
115+
sgx_misc_select_t misc_mask; /* MiscSelect mask form KEYREQUEST */
116+
sgx_cpu_svn_t cpu_svn; /* CPUSVN from KEYREQUEST */
117+
sgx_isv_svn_t isv_svn; /* ISVSVN from KEYREQUEST */
118+
sgx_prod_id_t isv_prod_id; /* ISV PRODID from SECS */
119+
sgx_config_svn_t config_svn; /* CONFIGSVN from KEYREQUEST */
120+
sgx_config_id_t config_id; /* CONFIGID from SECS */
121+
sgx_isvfamily_id_t isv_family_id; /* ISV FAMILYID from SECS */
122+
sgx_isvext_prod_id_t isv_ext_prod_id; /* ISV EXTPRODID from SECS */
123+
sgx_measurement_t mrsigner;
124+
} dd_provision_seal_key_t;
125+
94126
/* The derivation data. */
95127
typedef struct {
96128
int size; /* the size of derivation data */
97129

98130
union {
99131
/* key_name is the first field of all the following derivation data */
100-
uint16_t key_name;
101-
uint8_t ddbuf[1];
102-
103-
dd_seal_key_t ddsk;
104-
dd_report_key_t ddrk;
105-
dd_license_key_t ddlk;
106-
dd_provision_key_t ddpk;
132+
uint16_t key_name;
133+
uint8_t ddbuf[1];
134+
135+
dd_seal_key_t ddsk;
136+
dd_report_key_t ddrk;
137+
dd_license_key_t ddlk;
138+
dd_provision_key_t ddpk;
139+
dd_provision_seal_key_t ddpsk;
107140
};
108141
} derivation_data_t;
109142

‎sdk/simulation/tinst/rts_sim.h

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -59,6 +59,12 @@ const sgx_cpu_svn_t DOWNGRADED_CPUSVN = {
5959
}
6060
};
6161

62+
// use secs->reserved4 field to save isv_family_id and isv_ext_prod_id.
63+
typedef struct _isv_ext_id_t
64+
{
65+
sgx_isvfamily_id_t isv_family_id; /* ISV assigned Family ID */
66+
sgx_isvext_prod_id_t isv_ext_prod_id; /* ISV assigned Extended Product ID */
67+
} isv_ext_id_t;
6268

6369
typedef struct _global_data_sim_t
6470
{

‎sdk/simulation/tinst/t_instructions.cpp

Lines changed: 87 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -87,6 +87,13 @@ static const se_owner_epoch_t SIMU_OWNER_EPOCH_MSR = {
8787
} \
8888
} while(0)
8989

90+
#define check_config_svn(kr, secs) do { \
91+
if (kr->config_svn > secs->config_svn) { \
92+
return EGETKEY_INVALID_ISVSVN; \
93+
} \
94+
} while(0)
95+
96+
#define KEY_POLICY_KSS (SGX_KEYPOLICY_CONFIGID | SGX_KEYPOLICY_ISVFAMILYID | SGX_KEYPOLICY_ISVEXTPRODID)
9097

9198
// The hardware EGETKEY instruction will set ZF on failure.
9299
//
@@ -112,7 +119,7 @@ static int _EGETKEY(sgx_key_request_t* kr, sgx_key_128bit_t okey)
112119
GP_ON(!sgx_is_within_enclave(okey, sizeof(sgx_key_128bit_t)));
113120

114121
// check reserved bits are not set
115-
GP_ON((kr->key_policy & ~(SGX_KEYPOLICY_MRENCLAVE | SGX_KEYPOLICY_MRSIGNER)) != 0);
122+
GP_ON((kr->key_policy & ~(SGX_KEYPOLICY_MRENCLAVE | SGX_KEYPOLICY_MRSIGNER | KEY_POLICY_KSS | SGX_KEYPOLICY_NOISVPRODID)) != 0);
116123

117124
// check to see if reserved space in KEYREQUEST are valid
118125
const uint8_t* u8ptr = (uint8_t *)(&(kr->reserved1));
@@ -124,7 +131,13 @@ static int _EGETKEY(sgx_key_request_t* kr, sgx_key_128bit_t okey)
124131
GP_ON(u8ptr[i] != (uint8_t)0);
125132

126133
secs_t* cur_secs = g_global_data_sim.secs_ptr;
134+
isv_ext_id_t* isv_ext_id = reinterpret_cast<isv_ext_id_t *>(cur_secs->reserved4);
135+
136+
GP_ON(!(cur_secs->attributes.flags & SGX_FLAGS_KSS) &&
137+
((kr->key_policy & (KEY_POLICY_KSS | SGX_KEYPOLICY_NOISVPRODID)) ||kr->config_svn > 0));
138+
127139
sgx_attributes_t tmp_attr;
140+
sgx_misc_select_t tmp_misc;
128141
derivation_data_t dd;
129142

130143
memset(&dd, 0, sizeof(dd));
@@ -136,6 +149,8 @@ static int _EGETKEY(sgx_key_request_t* kr, sgx_key_128bit_t okey)
136149
tmp_attr.flags = kr->attribute_mask.flags | SGX_FLAGS_INITTED | SGX_FLAGS_DEBUG;
137150
tmp_attr.flags &= cur_secs->attributes.flags;
138151
tmp_attr.xfrm = kr->attribute_mask.xfrm & cur_secs->attributes.xfrm;
152+
// Compute MISCSELECT fields to be included in the key.
153+
tmp_misc = kr->misc_mask & cur_secs->misc_select;
139154
// HW supports CPUSVN to be set as 0.
140155
// To be consistent with HW behaviour, we replace the cpusvn as DEFAULT_CPUSVN if the input cpusvn is 0.
141156
if(!memcmp(&kr->cpu_svn, &dd.ddpk.cpu_svn, sizeof(sgx_cpu_svn_t)))
@@ -146,10 +161,12 @@ static int _EGETKEY(sgx_key_request_t* kr, sgx_key_128bit_t okey)
146161
switch (kr->key_name) {
147162
case SGX_KEYSELECT_SEAL:
148163
check_isv_svn(kr, cur_secs);
164+
check_config_svn(kr, cur_secs);
149165
check_cpu_svn(kr);
150166

151167
// assemble derivation data
152168
dd.size = sizeof(dd_seal_key_t);
169+
dd.ddsk.key_policy = kr->key_policy;
153170
if (kr->key_policy & SGX_KEYPOLICY_MRENCLAVE) {
154171
memcpy(&dd.ddsk.mrenclave, &cur_secs->mr_enclave, sizeof(sgx_measurement_t));
155172
}
@@ -158,22 +175,42 @@ static int _EGETKEY(sgx_key_request_t* kr, sgx_key_128bit_t okey)
158175
memcpy(&dd.ddsk.mrsigner, &cur_secs->mr_signer, sizeof(sgx_measurement_t));
159176
}
160177

178+
if (kr->key_policy & SGX_KEYPOLICY_ISVFAMILYID) {
179+
memcpy(&dd.ddsk.isv_family_id, &isv_ext_id->isv_family_id, sizeof(sgx_isvfamily_id_t));
180+
}
181+
182+
if (kr->key_policy & SGX_KEYPOLICY_ISVEXTPRODID) {
183+
memcpy(&dd.ddsk.isv_ext_prod_id, &isv_ext_id->isv_ext_prod_id, sizeof(sgx_isvext_prod_id_t));
184+
}
185+
186+
if (kr->key_policy & SGX_KEYPOLICY_CONFIGID) {
187+
dd.ddsk.config_svn = kr->config_svn;
188+
memcpy(&dd.ddsk.config_id, &cur_secs->config_id, sizeof(sgx_config_id_t));
189+
}
190+
161191
memcpy(&dd.ddsk.tmp_attr, &tmp_attr, sizeof(sgx_attributes_t));
162192
memcpy(&dd.ddsk.attribute_mask, &kr->attribute_mask, sizeof(sgx_attributes_t));
193+
dd.ddsk.tmp_misc = tmp_misc;
194+
dd.ddsk.misc_mask = ~kr->misc_mask;
163195
memcpy(dd.ddsk.csr_owner_epoch, SIMU_OWNER_EPOCH_MSR, sizeof(se_owner_epoch_t));
164196
memcpy(&dd.ddsk.cpu_svn,&kr->cpu_svn,sizeof(sgx_cpu_svn_t));
165197
dd.ddsk.isv_svn = kr->isv_svn;
166-
dd.ddsk.isv_prod_id = cur_secs->isv_prod_id;
198+
if (!(kr->key_policy & SGX_KEYPOLICY_NOISVPRODID)) {
199+
dd.ddsk.isv_prod_id = cur_secs->isv_prod_id;
200+
}
167201
memcpy(&dd.ddsk.key_id, &kr->key_id, sizeof(sgx_key_id_t));
168202
break;
169203

170204
case SGX_KEYSELECT_REPORT:
171205
// assemble derivation data
172206
dd.size = sizeof(dd_report_key_t);
173207
memcpy(&dd.ddrk.attributes, &cur_secs->attributes, sizeof(sgx_attributes_t));
208+
dd.ddrk.misc_select = cur_secs->misc_select;
174209
memcpy(dd.ddrk.csr_owner_epoch, SIMU_OWNER_EPOCH_MSR, sizeof(se_owner_epoch_t));
175210
memcpy(&dd.ddrk.cpu_svn,&(g_global_data_sim.cpusvn_sim),sizeof(sgx_cpu_svn_t));
176211
memcpy(&dd.ddrk.mrenclave, &cur_secs->mr_enclave, sizeof(sgx_measurement_t));
212+
dd.ddrk.config_svn = cur_secs->config_svn;
213+
memcpy(&dd.ddrk.config_id, &cur_secs->config_id, sizeof(sgx_config_id_t));
177214
memcpy(&dd.ddrk.key_id, &kr->key_id, sizeof(sgx_key_id_t));
178215
break;
179216

@@ -184,16 +221,17 @@ static int _EGETKEY(sgx_key_request_t* kr, sgx_key_128bit_t okey)
184221

185222
// assemble derivation data
186223
dd.size = sizeof(dd_license_key_t);
187-
memcpy(&dd.ddlk.attributes, &cur_secs->attributes, sizeof(sgx_attributes_t));
224+
memcpy(&dd.ddlk.tmp_attr, &tmp_attr, sizeof(sgx_attributes_t));
225+
dd.ddlk.tmp_misc = tmp_misc;
188226
memcpy(dd.ddlk.csr_owner_epoch, SIMU_OWNER_EPOCH_MSR, sizeof(se_owner_epoch_t));
189227
memcpy(&dd.ddlk.cpu_svn,&kr->cpu_svn,sizeof(sgx_cpu_svn_t));
190228
dd.ddlk.isv_svn = kr->isv_svn;
191229
dd.ddlk.isv_prod_id = cur_secs->isv_prod_id;
230+
memcpy(&dd.ddlk.mrsigner, &cur_secs->mr_signer, sizeof(sgx_measurement_t));
192231
memcpy(&dd.ddlk.key_id, &kr->key_id, sizeof(sgx_key_id_t));
193232
break;
194233

195-
case SGX_KEYSELECT_PROVISION: // Pass through. Only key_name differs.
196-
case SGX_KEYSELECT_PROVISION_SEAL:
234+
case SGX_KEYSELECT_PROVISION:
197235
check_attr_flag(cur_secs, SGX_FLAGS_PROVISION_KEY);
198236
check_isv_svn(kr, cur_secs);
199237
check_cpu_svn(kr);
@@ -202,11 +240,46 @@ static int _EGETKEY(sgx_key_request_t* kr, sgx_key_128bit_t okey)
202240
dd.size = sizeof(dd_provision_key_t);
203241
memcpy(&dd.ddpk.tmp_attr, &tmp_attr, sizeof(sgx_attributes_t));
204242
memcpy(&dd.ddpk.attribute_mask, &kr->attribute_mask, sizeof(sgx_attributes_t));
243+
dd.ddpk.tmp_misc = tmp_misc;
244+
dd.ddpk.misc_mask = ~kr->misc_mask;
205245
memcpy(&dd.ddpk.cpu_svn,&kr->cpu_svn,sizeof(sgx_cpu_svn_t));
206246
dd.ddpk.isv_svn = kr->isv_svn;
207247
dd.ddpk.isv_prod_id = cur_secs->isv_prod_id;
208248
memcpy(&dd.ddpk.mrsigner, &cur_secs->mr_signer, sizeof(sgx_measurement_t));
209249
break;
250+
case SGX_KEYSELECT_PROVISION_SEAL:
251+
check_attr_flag(cur_secs, SGX_FLAGS_PROVISION_KEY);
252+
check_isv_svn(kr, cur_secs);
253+
check_config_svn(kr, cur_secs);
254+
check_cpu_svn(kr);
255+
256+
// assemble derivation data
257+
dd.size = sizeof(dd_provision_seal_key_t);
258+
dd.ddpsk.key_policy = kr->key_policy;
259+
if (kr->key_policy & SGX_KEYPOLICY_ISVFAMILYID) {
260+
memcpy(&dd.ddpsk.isv_family_id, &isv_ext_id->isv_family_id, sizeof(sgx_isvfamily_id_t));
261+
}
262+
263+
if (kr->key_policy & SGX_KEYPOLICY_ISVEXTPRODID) {
264+
memcpy(&dd.ddpsk.isv_ext_prod_id, &isv_ext_id->isv_ext_prod_id, sizeof(sgx_isvext_prod_id_t));
265+
}
266+
267+
if (kr->key_policy & SGX_KEYPOLICY_CONFIGID) {
268+
dd.ddpsk.config_svn = kr->config_svn;
269+
memcpy(&dd.ddpsk.config_id, &cur_secs->config_id, sizeof(sgx_config_id_t));
270+
}
271+
272+
memcpy(&dd.ddpsk.tmp_attr, &tmp_attr, sizeof(sgx_attributes_t));
273+
memcpy(&dd.ddpsk.attribute_mask, &kr->attribute_mask, sizeof(sgx_attributes_t));
274+
dd.ddpsk.tmp_misc = tmp_misc;
275+
dd.ddpsk.misc_mask = ~kr->misc_mask;
276+
memcpy(&dd.ddpsk.cpu_svn,&kr->cpu_svn,sizeof(sgx_cpu_svn_t));
277+
dd.ddpsk.isv_svn = kr->isv_svn;
278+
if (!(kr->key_policy & SGX_KEYPOLICY_NOISVPRODID)) {
279+
dd.ddpsk.isv_prod_id = cur_secs->isv_prod_id;
280+
}
281+
memcpy(&dd.ddpsk.mrsigner, &cur_secs->mr_signer, sizeof(sgx_measurement_t));
282+
break;
210283

211284
default:
212285
return EGETKEY_INVALID_KEYNAME;
@@ -241,13 +314,19 @@ static void _EREPORT(const sgx_target_info_t* ti, const sgx_report_data_t* rd, s
241314
GP_ON(!sgx_is_within_enclave(report, sizeof(sgx_report_t)));
242315

243316
secs_t* cur_secs = g_global_data_sim.secs_ptr;
317+
isv_ext_id_t* isv_ext_id = reinterpret_cast<isv_ext_id_t *>(cur_secs->reserved4);
244318
SE_DECLSPEC_ALIGN(REPORT_ALIGN_SIZE) sgx_report_t tmp_report;
245319

246320
// assemble REPORT Data
247321
memset(&tmp_report, 0, sizeof(tmp_report));
248322
memcpy(&tmp_report.body.cpu_svn,&(g_global_data_sim.cpusvn_sim),sizeof(sgx_cpu_svn_t));
323+
tmp_report.body.misc_select = cur_secs->misc_select;
249324
tmp_report.body.isv_prod_id = cur_secs->isv_prod_id;
250325
tmp_report.body.isv_svn = cur_secs->isv_svn;
326+
tmp_report.body.config_svn = cur_secs->config_svn;
327+
memcpy(&tmp_report.body.isv_family_id, &isv_ext_id->isv_family_id, sizeof(sgx_isvfamily_id_t));
328+
memcpy(&tmp_report.body.isv_ext_prod_id, &isv_ext_id->isv_ext_prod_id, sizeof(sgx_isvext_prod_id_t));
329+
memcpy(&tmp_report.body.config_id, &cur_secs->config_id, sizeof(sgx_config_id_t));
251330
memcpy(&tmp_report.body.attributes, &cur_secs->attributes, sizeof(sgx_attributes_t));
252331
memcpy(&tmp_report.body.report_data, rd, sizeof(sgx_report_data_t));
253332
memcpy(&tmp_report.body.mr_enclave, &cur_secs->mr_enclave, sizeof(sgx_measurement_t));
@@ -265,6 +344,9 @@ static void _EREPORT(const sgx_target_info_t* ti, const sgx_report_data_t* rd, s
265344
memcpy(dd.ddrk.csr_owner_epoch, SIMU_OWNER_EPOCH_MSR, sizeof(se_owner_epoch_t));
266345
memcpy(&dd.ddrk.cpu_svn,&(g_global_data_sim.cpusvn_sim),sizeof(sgx_cpu_svn_t));
267346
memcpy(&dd.ddrk.key_id, &tmp_report.key_id, sizeof(sgx_key_id_t));
347+
memcpy(&dd.ddrk.config_id, &ti->config_id, sizeof(sgx_config_id_t));
348+
dd.ddrk.config_svn = ti->config_svn;
349+
dd.ddrk.misc_select = ti->misc_select;
268350

269351
// calculate the derived key
270352
sgx_key_128bit_t tmp_report_key;

‎sdk/simulation/uinst/Makefile

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,7 @@ CPPFLAGS += -I$(COMMON_DIR)/inc/ \
4343
-I$(COMMON_DIR)/inc/internal \
4444
-I$(SIM_DIR)/assembly/ \
4545
-I$(SIM_DIR)/assembly/linux \
46+
-I$(SIM_DIR)/tinst/ \
4647
-I$(LINUX_PSW_DIR)/urts \
4748
-I$(LINUX_PSW_DIR)/urts/linux
4849

‎sdk/simulation/uinst/u_instructions.cpp

Lines changed: 22 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -52,6 +52,7 @@
5252
#include "sgxsim.h"
5353
#include "enclave_mngr.h"
5454
#include "u_instructions.h"
55+
#include "rts_sim.h"
5556

5657
#include "crypto_wrapper.h"
5758

@@ -277,10 +278,23 @@ uintptr_t _EINIT(secs_t* secs, enclave_css_t *css, token_t *launch)
277278
return SGX_ERROR_INVALID_ATTRIBUTE;
278279
}
279280

281+
isv_ext_id_t* isv_ext_id = reinterpret_cast<isv_ext_id_t *>(this_secs->reserved4);
282+
if (!(this_secs->attributes.flags & SGX_FLAGS_KSS))
283+
{
284+
const uint8_t* u8ptr = (uint8_t *)(&(css->body.isv_family_id));
285+
for (unsigned i = 0; i < sizeof(css->body.isv_family_id); ++i)
286+
if (u8ptr[i] != (uint8_t)0) return SGX_ERROR_INVALID_SIGNATURE;
287+
288+
u8ptr = (uint8_t *)(&(css->body.isvext_prod_id));
289+
for (unsigned i = 0; i < sizeof(css->body.isvext_prod_id); ++i)
290+
if (u8ptr[i] != (uint8_t)0) return SGX_ERROR_INVALID_SIGNATURE;
291+
}
292+
280293
mcp_same_size(&this_secs->mr_enclave, &css->body.enclave_hash, sizeof(sgx_measurement_t));
281294
this_secs->isv_prod_id = css->body.isv_prod_id;
282295
this_secs->isv_svn = css->body.isv_svn;
283-
296+
mcp_same_size(&isv_ext_id->isv_family_id, &css->body.isv_family_id, sizeof(sgx_isvfamily_id_t));
297+
mcp_same_size(&isv_ext_id->isv_ext_prod_id, &css->body.isvext_prod_id, sizeof(sgx_isvext_prod_id_t));
284298
uint8_t signer[SGX_HASH_SIZE] = {0};
285299
unsigned int signer_len = SGX_HASH_SIZE;
286300
sgx_status_t ret = sgx_EVP_Digest(EVP_sha256(), css->key.modulus, SE_KEY_SIZE, signer, &signer_len);
@@ -324,6 +338,13 @@ uintptr_t _ECREATE(page_info_t* pi)
324338
// Enclave size must be at least 2 pages and a power of 2.
325339
GP_ON(!is_power_of_two((size_t)secs->size));
326340
GP_ON(secs->size < (SE_PAGE_SIZE << 1));
341+
if(!(secs->attributes.flags & SGX_FLAGS_KSS))
342+
{
343+
GP_ON(secs->config_svn != 0);
344+
const uint8_t* u8ptr = (uint8_t *)(&(secs->config_id));
345+
for (unsigned i = 0; i < sizeof(secs->config_id); ++i)
346+
GP_ON(u8ptr[i] != (uint8_t)0);
347+
}
327348

328349
CEnclaveSim* ce = new CEnclaveSim(secs);
329350
void* addr;

0 commit comments

Comments
 (0)