After this change, LibOS will no longer perform dynamic linking.
The ELF loading code executes load commands and passes control to
interpreter (ld.so), which handles necessary relocations and
loading additional libraries. In this way, the code resembles what
Linux kernel does when executing a new program.
Before, dynamic linking was necessary for making LibOS entry point
(syscalldb function) available for applications. However, that meant
duplicating the work already done by ld.so, and introduced a lot of
unnecessary complexity. After changing LibOS entry API to use the
GS register, it's possible to omit dynamic linking entirely.
The main function (__load_elf_object()) still needs cleanup and
possibly rewriting from scratch. However, this change prepares
ground for that rewrite.
Summary of changes:
- Remove dynamic relocation step (DO_DYNAMIC_RELOCATE()).
- Don't call __load_elf_object() again for ELFs reported
via register_library(). We only need to notify GDB about these.
- Remove fields related to dynamic linking from link_map (dynamic
section address, hashes, etc.), and setup for these fields.
- need_interp(): To check if we need an interpreter, check only if
the binary requests one (PT_INTERP), instead of traversing the
dynamic section (before, we ignored dynamic dependencies on LibOS
itself, but now there shouldn't be any).
- RELOCATE(): always adjust addresses, instead of checking if
they're already inside the mapped range. I think the previous
behaviour was a workaround to make repeated relocations work.
- Get rid of load modes that are no longer used (OBJECT_REMAP,
OBJECT_USER).
- Remove the workaround for repeated relocation in glibc patches
(R_X86_64_NONE).
Signed-off-by: Paweł Marczewski <pawel@invisiblethingslab.com>
Current implementation incorrectly uses `_SC_ULONG_MAX` to check the max
ulong (instead of ULONG_MAX). This patch addresses the issue.
Note: `_SC_ULONG_MAX` is intended to be used with sysconf() to inquire
about the maximum value which can be stored in a variable of type
`unsigned long` and is defined to 117.
Signed-off-by: Vijay Dhanraj <vijay.dhanraj@intel.com>
Current implementation of sysfs will fail for paths such as
/sys/devices/system/{cpu,node}/online which doesn't have a numeric
value. This patch fixes this issue. This patch also adds 2 test cases as
part of the sysfs regression test.
Signed-off-by: Vijay Dhanraj <vijay.dhanraj@intel.com>
Change log (most important only):
- unify CPU context structures - now we have only one version -
`PAL_CONTEXT` - which is shared between LibOS and PALs and it should
depend only on the host architecture (not OS),
- syscalls emulation changed:
- dedicated LibOS stack is now used for syscalls emulation,
- removed one indirection level in syscalls table - now it stores
`shim_do_*` functions directly,
- signal handling - completely rewritten:
- all signal queues use proper locking schemes now,
- signals are handled *only* when returning to the user app from LibOS
or PAL,
- nested signals are now possible,
- the app is allowed to jump out of signal handler with the same
sematics as on normal Linux,
- signal altstack is now fully supported,
- syscall restarting is now supported,
- doing a backtrace from the signal handler works properly,
- disallow injecting host-level signals, with one exception, see
`sys.enable_sigterm_injection` manifest option for more details.
These CPUID leaves are used by virtualization software (Hyper-V, KVM,
etc.) and are zeroed out on bare metal. Some runtimes (e.g. JVM) query
them to detect underlying virtualization software. This commit makes
these leaves return zeroes ("no virtualization").
This commit also fixes `pseudo_name_ops::list_name()` function pointer
type: `size_t len` argument instead of `int len`. It also adds a
regression test to exercise the newly supported /sys pseudo filesystem.
Previously, LibOS always checked whether user-supplied buffers for
syscalls are invalid and generated EFAULT error codes if so. Since the
invalid-buffer check needed to touch memory/traverse VMAs, it could
affect performance of certain workloads. This commit adds a manifest
option that controls this behavior: most real-world applications never
supply invalid buffers in syscalls, so such checks can be disabled.
Instead of 'loader.debug_type', introduce 'loader.log_level'
and 'loader.log_file', along with a set of definitions for
logging at a chosen level.
For now, the call sites keep using the legacy macros (SGX_DBG and
debug()), because converting them all will conflict with other
big changes in the code base. The existing LibOS calls are
assumed to be at 'info' level.
Applications under native/ and benchmark/ cannot be built after commit
"Introduce one, central manifest, zero-config children and constant
MRENCLAVE" (because of the missing `libos.entrypoint` and possibly
other issues). They are not tested and not used by anyone these days.
The `exec_fork` test that failed previously now works on master; other
tests are more or less duplicates of our regression/ tests.
Applications under native/ cannot be run after commit "Introduce one,
central manifest, zero-config children and constant MRENCLAVE". Instead
of fixing native/, this commit simply moves helloworld and all its
mentions under regression/.
This is the next part of the great loader rework, with a lot of breaking changes:
- Complete removal of the "trusted children" thing - now children
processes can be spawned arbitrarily and from arbitrary mountpoint
types, without any additional configuration needed.
- There's a new, required option in the manifest: `libos.entrypoint` - it
specifies the URI to the entry binary in the first process. There's no
need anymore to name the manifest and the first binary identically.
- On SGX, the main binary is not measured in MRENCLAVE anymore - only
PAL, LibOS and the manifest are measured. This is enough to bind
MRENCLAVE to a specific entrypoint user executable if wanted - it
just has to be mounted as a trusted file.
- All Graphene SGX enclaves have now exactly the same MRENCLAVE. This is
a hash of a "Graphene stub", which can "fork" into one of two states
in runtime: initial process or child. The initial process creates a
new "Graphene namespace" with a clean state, it can also be attested
remotely (contrary to child processes). The initial process can spawn
children processes by spawning a Graphene stub and directing it to
start in the child mode. It then attests it locally, and if
successful, establishes an encrypted pipe, "connects" to its own
namespace and treats as trusted (including sending protected files
key).
- Now, there's only one, central manifest describing the initial state
of a Graphene instance which can be spawned from it (previously, each
process required a separate manifest which could have different
configuration - which wasn't actually supported and didn't make sense
design-wise). One downside of central manifests is that all processes
require the same enclave configuration (e.g. size), but that was
already the case so far because of broken checkpointing code. Also,
this is only a temporary problem, which will cease to exist after the
introduction of EDMM.
- `sgx.static_address` was renamed to `sgx.nonpie_binary` and now has to
be inserted manually by users (`sgx_sign` tools doesn't know about the
binaries run inside, which can be even provided or generated in
runtime by the user's workload).
- Caveat: the memory gap for non-PIE executables was removed because it
requires adding a new option to the manifest to be cleanly
implemented. This is left for some future loader rework PR.
This commit additionally fixes bugs in shim_do_sendmmsg and
shim_do_recvmmsg - `vlen` argument is the number of items in the array,
not size (in bytes) of it, as previous code assumed.
This commit adds a new PF utility `pf_tamper` that tampers with
valid protected files and uses this utility to test that the PF
logic in Linux-SGX detects such malicious modifications.
This commit also moves out the PF-format macros and structs from
`protected_files_internal.h` to `protected_files_format.h` for
better readability.
Co-authored-by: Dmitrii Kuvaiskii <dmitrii.kuvaiskii@intel.com>
Previously, Graphene supported only /dev/tty (stdin/stdout terminal)
device. This commit introduces support for other, arbitrary host
devices. The devices must be explicitly allowed in the manifest via
a mount point like this:
fs.mount.devkmsg.type = chroot
fs.mount.devkmsg.path = /dev/kmsg
fs.mount.devkmsg.uri = dev:/dev/kmsg
Currently only open/read/write/close/fstat are supported. lseek is
supported only with offset 0 (and it is not device-specific). Support
for IOCTLs will be introduced in future commits. A simple test is
added to LibOS regression tests.
The exit code of the test was a random number between 0 and 4,
which gave no guarantee that the right code from exit() will
actually reach the user.
Instead of testing a race between threads, make it possible to
call exit() in a chosen thread, and verify that it always works.
In addition, propagate the exit code from a forked process. That
use case was broken recently and has been fixed in the commit
titled 'Rework threads implementation'.
Most important differences from the old version:
- strip global process information from the thread struct into a
dedicated one,
- a parent is informed about the child death when the whole process
(the last thread) dies (not on each thread exit),
- all threads have the same parent (spawning thread is NOT the parent of
the spawned thread),
- a thread is able to wait on children created by another thread,
- a process is able to wait for exited children after execve,
- rewritten `waitid` implementation (no more gotos, supports __WCLONE
and friends flags),
- added option for syscall restarting, for now used only in `waitid`.
Additionally various bugfixes, cleanups and missing locks added.
Logging to file was broken, because the PAL file write operation
required the user to provide an absolute offset, and LibOS always
provided an offset of 0. This worked when logging to stdout, but
in case of a regular file, it kept overwriting the beginning of
file.
To fix that, we introduce a a special DkDebugLog call. This is a
better solution than tracking the file offset manually, because
the offset would need to be synchronized across different threads
and processes, and debug logs should be as simple as possible. At
the same time, we don't want PAL to provide a generic "append to
a file" mechanism, because it makes I/O less deterministic.
Pylint output was filtered so that many files with existing pylint
violations were allowed to stay broken.
I made sure all files pass pylint, but whitelisted some rules that
we commonly disable:
* missing docstrings: most of the code is tests/internal anyway
* invalid-name: too many violations, and we commonly use one- or
two-character names (like "a, b" or "t1, t2") which is
disallowed by this rule; we could tweak it and then fix
remaining violations such as camel-case or lowercase constants
* fixme: we leave TODOs as a matter of practice, same as in C
* high-level style rules like too-few-* and too-many-*,
no-self-use
Hopefully that will make using pylint less annoying, while also
catching serious issues (such as unused variables or imports).
The manifest syntax stays exactly the same, including 0 and 1
integers to denote boolean values (this is done for ease of porting
and can be fixed in future commits). The only visible change is
surrounding strings in the manifest with quotes (requirement of
TOML). All manifests and Makefiles of our tests and example apps are
ported to the new TOML syntax. Documentation is updated.
The operation loops indefinitely on error. Instead, it should find
the first free FD, and then try allocating it.
In addition, the right error after exceeding the limit is EMFILE
(however, dup2() is still supposed to return EBADF if asking for
an out-of-range value, as checked by the dup201 LTP test).
Currently in Graphene, the type field in dirent struct is only updated
for parent directory and is set to DT_UNKNOWN type for its children.
But APIs like `sysconf(_SC_NPROCESSORS_CONF)` rely on type field to
identify the number of processors on the host by reading the number of
cpuX directories and ensuring their type is set to DT_DIR. This commit
addresses the issue by updating the dirent type appropriately even for
child directories or files.
As per linux man-pages, dirfd can be ignored if an absolute path is
provided when invoking *at() calls. But in Graphene many of the *at()
calls require a valid dirfd even when an absolute path is provided. If
not, the call fails. This commit fixes the issue by ignoring dirfd if
absolute filepath is provided.
Previously, Graphene assumed that if it was built with the DCAP
SGX driver or in-kernel SGX driver, then it should use DCAP/ECDSA
based attestation. In fact, the SGX driver has nothing to do with
the attestation scheme. This commit allows to use EPID based
attestation even when Graphene is built with the DCAP SGX driver.
- Remove old LTP bug workaround from Jenkins files
- Add pkg-config as an explicit dependency (it wasn't installed on
Ubuntu 16 and LTP won't build without it)
- Add short comments to tests that I've had time to investigate
- Collapse some test groups where we simply do not support the
feature being tested (e.g. a syscall) using a wildcard. Until we
implement it, we will not care about any new tests, and having
all the tests separately is just noise.
- Unskip some tests that seem to pass now
Keep only sections that differ from ltp.cfg, so that the file is
easier to maintain. Done automatically using
contrib/conf_subtract.py.
(As far as I can tell, there are no tests disabled in Linux and
enabled in Linux-SGX, only the other way around).
This is to make ltp-sgx.cfg an override for ltp.cfg, instead of
duplicating the content.
I'm also adding config/conf_subtract.py, a quick-and-dirty script
for reducing the ltp-sgx.cfg file (result committed separately).
Paweł Marczewski