Also, adapt #includes where needed. Avoid the name elf.h to avoid
clashes. We do not touch the Linux-SGX/elf-x86_64.h file since it is
slightly different.
Introduce PAL_ERROR_CONNFAILED_PIPE and treat EPIPE separately
from ECONNRESET.
The effects of this patch on LTP are:
from:
writev01.c:139: FAIL: write to closed pipe, expected: -1 (EPIPE), got: -1 (ECONNRESET)
to:
writev01.c:139: PASS: write to closed pipe, expected: -1 (EPIPE), got: -1 (EPIPE)
AND:
from:
write05.c:82: FAIL: write() failed unexpectedly, expected EPIPE: ECONNRESET
to:
write05.c:87: FAIL: sigpipe_cnt = 0
writev01 now works correctly, so this commit enables it.
Move the x86-64-specific sigcontext header files to arch/x86_64/Linux.
The SGX and non-SGX files are identical.
We are also moving sigset.h since on ppc64 the following defines are
different:
x86_64: #define _SIGSET_NWORDS (64 / (8 * sizeof(unsigned long int)))
ppc64: #define _SIGSET_NWORDS (1024 / (8 * sizeof (unsigned long int)))
Also, adapt the Makefiles to add the arch specific directory to the CFLAGS.
The Linux-SGX sysdep-x86_64.h was identical and could therefore be removed.
Sometimes we need to prevent the compiler from reading or writing to
a memory location twice to prevent certain TOCTOU bugs. This can now
be achieved by using the introduced macros and this commit does so in
enclave_ocalls.c for Linux-SGX.
This commit completely reworks VMA subsystem along with its usages.
New version should be: cleaner (easier to maintain), faster and allow
for bookkeeping requests from Pal.
It also fixes some bugs and inconsistencies found in the process and
changes brk and mmap/munmap implementations (at least partially).
Currently various flags in file and memory syscalls work mostly by an
accident, because values of some of them align with corresponding Linux
syscall flags. Some APIs weren't that lucky though - e.g.
DkStreamOpen(..., /*options=*/PAL_OPTION_CLOEXEC) deletes file contents
(sic!) intead of opening it with O_CLOEXEC. This is because
PAL_OPTION_CLOEXEC == O_TRUNC.
This commit fixes all this mess and also adds asserts to check validity
of flags passed to Dk* handlers.
mbedTLS configuration used in Graphene is not thread-safe (because
this would require the use of a threading library like pthread which
is not possible in the LibOS/Pal layers). However, some mbedTLS
functions use shared state, in particular TLS context initialization
functions. This led to data races during encrypted-pipe creation,
since it requires two threads performing a TLS handshake. This commit
refactors TLS init into SSLInit (not thread-safe) and SSLHandshake
(thread-safe) and adds spinlocks around SSLInit to protect the racy
mbedTLS logic.
New DkAttestationReport() API retrieves the attestation report (local)
from the local attestation mechanism. Currently, it is implemented
only for Linux-SGX PAL and stubbed for all other PALs. The Linux-SGX
implementation retrieves the SGX report via EREPORT instruction.
The caller of this new API may learn sizes of report_data, target_info,
and report structs. The caller may also obtain current target info.
Finally, the caller may obtain the report for use in local attestation.
A simple test case is added to PAL tests.
Previously, Linux-SGX PAL did not encrypt pipe/socketpair
communication (only process checkpoint send/receive was encrypted).
This commit encrypts all pipe/socketpair IPC between threads of
the same enclave and between enclave processes. In particular, all
offsprings of the "first" enclave inherit the same master key and
derive IPC session keys from this master key based on pipe name.
When two pipe/socketpair endpoints are first created, they establish
a TLS-PSK session via intra-enclave handshake (requires a spawn of
an intermediate enclave thread). During clone/fork/exec, endpoints'
TLS contexts are serialized and sent to the child that deserializes
them (using mbedtls_ssl_context_{save,load} functions).
Note that multicast pipes (with more than two communicating entities)
are not supported since TLS protocol doesn't support it.
This commit modifies the PAL `SendHandle` test to correctly test
pipe communication, as well as adds the LibOS `pipe` test.
Previously, Graphene used the notation "pipe:<uint32_t>" to emulate
pipes, socketpairs, and UNIX domain sockets. In particular, pipes
and socketpairs received random integer IDs, and sockets received
deterministic integer IDs. However, 32-bit randomly generated IDs
may collide quite often. Since pipe IDs/names should *not* repeat
(otherwise e.g. derived crypto keys will be reused), this commit
changes pipe IDs (pipeid) from uint32_t to char[96], and pipe IDs
(names) become 256-bit random sequences.
New DkAttestationQuote() API retrieves the attestation quote from the
underlying host-OS attestation mechanism. Currently, it is implemented
only for Linux-SGX PAL and stubbed for all other PALs. The Linux-SGX
implementation retrieves the SGX quote via sgx_get_quote() which
communicates with the Quoting Enclave via AESM service. The caller of
this new API may forward the obtained quote to the remote user for
remote attestation.
Previously, Graphene with SGX performed self-remote attestation
by retrieving the SGX quote from the Quoting Enclave, sending it
to the Intel Attestation Service via Curl (in an HTTPS request),
and parsing the received from IAS remote-attestation certificate.
This self-attestation functionality is meaningless and is removed.
Moreover, since EPID-based remote attestation requires client key
(Ocp-Apim-Subscription-Key), and this key must be kept secret,
specifying it in the Graphene manifest (as was done previously) is
insecure. Therefore, the whole remote attestation functionality is
moved out of Graphene and to another trusted party (or to the app
on top of Graphene). Only the SGX quote retrieval from the Quoting
Enclave is kept in Graphene.
Previously, Graphene in execve() emulation silently terminated the
intermediate process after sending all necessary metadata. For example,
`bash -c ls` would spawn (host clone+execve) a new Graphene process with
`ls` and exit the "intermediate" process (`bash`) immediately, without
waiting for `ls` to finish. This deviation from standard execve()
behavior resulted in the host shell becoming detached from the Graphene
process.
This commit simply forces this intermediate process to wait() until
the child terminates. This way the host shell stays attached, and
all timings and pipes behave correctly.
Previously, Linux-SGX logic of allocating/freeing enclave pages was
complicated and hard to read. This commit refactors this code for
readability, without changes in functionality.
This patch auto-generates asm offsets for Pal/Linux-SGX and uses them.
Also to share the generation logic among Pal and LibOS, header file for
it is created under Pal.
Signed-off-by: Isaku Yamahata <isaku.yamahata@gmail.com>
Stefan Berger