This patch addresses several bugs with the build system:
- Lack of Windows support
- Clang Tidy was not working properly
- Making modifications to the source code would compile, but would not
re-link resulting in issues
- Removed excess file copying
- Make clean now works
- Removed unused or confusing folders in the build folder as part of the
build process. It is now much easier to traverse the build folder for
dependencies
- The targets didn't work with extensions. This has been fixed.
In addition, the following was also done under this patch
- Intrinsics was moved to the top level and out of the VMM
- Platform files are now in a folder called "platform" instead of
"arch"
- All subprojects have the same include/src/tests files structure
- All intel specific code is properly organized to match intended
namespacing
- Removed dead code
- A small part of the VMCS was converted to use the delegate pattern
- All dependencies are now downloaded at configure time instead of
compile time.
- The cache directory is now cached by Travis CI
- CMake output better matches old build system
- Added make rebuild and separate clean targets to remove various parts
of the build depending on needs.
- Added targets for Clean, Tidy, Rebuild and Format for each subproject
- Re-organized the cmake logic so that macros are not spread out
- New validation removes unneeded complexity
- Removed the need for the compiler wrapper, and in doing so, we now
provide a simpilar set of toolchain files
- Removed the need for Git repos. All external dependencies are
downloaded using a zip or tarball
- Libcxx and Libcxxabi are now in their own files. Much similar logic
- Unit test CMake files have been greatly simplified
- Each subproject is unaware of it's prefix and no long use VMM,
USERSPACE or TEST variables in their cmake files
- Fixed bugs with the flags
- Renamed the varbiables in the default.cmake config to be more
consistent and easier to follow in the rest of the code
Signed-off-by: “rianquinn” <“rianquinn@gmail.com”>
Up until now, the unwinder was not included in the Clagn Tidy
checks because it needed some cleanup. This patch provides that
Signed-off-by: “Rian <“rianquinn@gmail.com”>
This patch provides some small updates to enable catching and
handling when memory runs out (std::bad_alloc). Specifically,
when this happens, we can no longer use std::cout which
does many allocations in the process. Instead we exit
gracefully with an error code.
Signed-off-by: “Rian <“rianquinn@gmail.com”>
This patch provides support for the google sanatizers for
dynamic analysis, as well as cleans up issues with clang tidy.
In addition, there is a new Travis CI target that tests for
clang tidy so that future PRs do not have the same issues.
Signed-off-by: “Rian <“rianquinn@gmail.com”>
This patch cleans up a lot of issues identified using clang
tidy including C++ Core Guideline support. The only thing
that has not been tested with this patch is the unwinder which
will be addressed in later patches
Signed-off-by: “Rian <“rianquinn@gmail.com”>
This patch set add support for static analysis. Specifically,
we have enabled Coverity, fixed the bugs that it found, and
have added the badge. This patch set addresses all of the issues
that were seen by Coverity.
There are other issues that are pending as clang-tidy has
identified a lot of issues the Coverity has not, so a future
PR will address clang-tidy specific issues.
Signed-off-by: “Rian <“rianquinn@gmail.com”>
* vCPU / Unwinder Cleanup
This is a pretty massive patch set that addresses two main issues
- The vCPU was two specific to the host-only use case
- The unwinder has bugs
The vCPU was specific to the host-only case because there was no
way for the make_vcpu function to create a vCPU that was not a
host-only vcpu. This patch corrects that issue. In addition, if
guest vCPUs are to be created, the ability to "resume" a guest
must also be provided, which this patch also has. There is still
some API changes that are needed. For example, we need a way to
send a void * to the make_vcpu function so that there is a way
to tell make_vcpu which type of vcpu to create.
While developing this patch, a couple issues with the unwinder
were discovered, one really big one being that we were using
C style casts in a LOT of the code. This patch hopefully
removes the bulk of them (and hopefully a static analysis tool
can find the rest if any). There was also an issue with the
way we were passing flags to libcxx and libcxxabi that caused
instabilities. Finally, we discovered that libcxx will simply
abort if the unwinder fails on a noexcept (duh), but some
of these failures should gracefully exit, and not hang the
system. As a result, functions need to be labeled noexcept
were it makes sense, and try catch blocks were added to
prevent system hangs.
Signed-off-by: “Rian <“rianquinn@gmail.com”>
* Coveralls / Unit Test Coverage
This patch provides coveralls support which can be used to
identify what % of the code is actually unit tested. This
patch attempts to get to 100% coverage, but leaves out
coverage checks for:
- VMCS
- Unwinder
The unwinder is extremely difficult to unit test completely
as this would require fake FDEs which would not be pretty.
Instead, the unit test attmepts to validate that the unwinder
works from the top level API which is "throw" from different
situations.
The VMCS class needs some additional work to be testable as
it currently calls vmread / vmwrite and read_msr way, way
too much, which not only causes performance issues, but also
causes issues with unit testing as the intrinsics class
needs to be mocked, and tons of calls makes the unit test
too overspecified. Future patches will address this problem.
Signed-off-by: “Rian <“rianquinn@gmail.com”>
We never implemented the opcodes in this patch, and they are
showing up during testing. The main reason we didn't implement
these was because it was assumed that GCC would not implement
stack operations in the EH Frame FDEs because they use a
malloc/free, which doesn't make sense if the throw came
from std::bad_alloc.
To overcome this limitation of malloc/free, we implemented the
stack frame "remember/restore" calls using a temp stack without
malloc/free. The down side to this is if the temp stack is not
large enough, the unwinder will fail, but the possibility of
this is extremely small, and even if it does occur, I added a
macro that can be increased if needed.
One thing that is interesting is it appears GCC is spitting
out bad DRAWF instructions for the case that was seen.
GCC is calling DW_CFA_restore on registers that do not have
initial instructions in the CIE, which results in 0.
The test cases still work because GCC is wrapping the bad
calls to DW_CFA_restore in a DW_CFA_remember_state /
DW_CFA_restore_state so in the end, the DW_CFA_restore are
simply ignored. Either way, this patch completes the missing
DWARF CFA instructons so we now implement them all.
Finally, we addressed an earlier issue with the expression
support that we thought was an issue with GCC but turned
out to be an issue with the unwinder. We were using
"<" instead of "<=" so we missed the last opcode which was
needed.
Signed-off-by: “Rian <“rianquinn@gmail.com”>
* DWARF Expression Suport
GCC 6.1 appears to add DWARF expressions for stack realignment
which is needed to support the addition of SSE instructions.
This patch provides the needed expression support for exceptions.
It should be noted that there appears to be a bug in GCC 6.1
that we have hacked around for now. For more information, please
see:
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=71978
Signed-off-by: “Rian <“rianquinn@gmail.com”>
* add #define for expression stack size
Signed-off-by: “Rian <“rianquinn@gmail.com”>
Updated the compiler flags to enable better arch support for
Intel. Also added FXSAVE and FXRSTOR instructions to ensure
the entire reigster state is being saved. If we ever use
AVX, we will need to use XSAVE instead
Signed-off-by: “Rian <“rianquinn@gmail.com”>
* New Build System
This patch provides a new build system that:
- provides support for docker to decrease the time it takes to
run a build. a local compiler can still be used if desired
- provide better support for other platforms
- provides support for out-of-tree compilation which also
allows for multiple build trees if desired
Signed-off-by: Rian Quinn <quinnr@ainfosec.com>
* Isolation Complete
This patch set adds the remaining code needed to isolate the
hypervisor from the host OS. Specifically, this provides
the hypervisor with it's own set of page tables.
Signed-off-by: “Rian <“rianquinn@gmail.com”>
This patch provides support for the following Linux Distros
- Ubuntu 12.04, 14.04, 15.04, 15.10
- Debian Jessie
- Fedora 23, 22
Signed-off-by: Rian Quinn <quinnr@ainfosec.com>
The following patches provide bareflank with exception support.
This includes:
- A custom unwinder that is capable of unwinding the stack with
thread-saftey, while only requiring libc (which can also be
disabled)
- A set of unit tests to validate that throw exceptions works
- Changes to the VMM to support the custom unwinder, and
install catch all blocks incase an exception is not
caught.
Signed-off-by: Rian Quinn <quinnr@ainfosec.com>
