Platform for Kernel by CvvT · Pull Request #10 · microsoft/litebox

Weiteng Chen (CvvT) · 2025-02-12T19:59:55Z

Per our discussion, LinuxKernel is the provider/platform which depends on HostInterface (host specific interface) and Task (for per task storage).

Weiteng Chen (CvvT) · 2025-02-12T22:58:26Z

As we discussed #9, removed blocking punchthrough futex (which will be reimplemented in Litebox)

Weidong Cui (wdcui)

I focused on the high-level interfaces and structures in this round of review.

Weidong Cui (wdcui) · 2025-02-13T04:00:54Z

+	uint64_t ret;
+} __attribute__((__packed__));
+
+#define SNP_SANDBOX_IOCTL_DEBUG 0x6300 // _IO('c', 0)


TODO: maybe split this header file to two parts and only copy the part related to litebox here? For instance, litebox platform doesn't need to know the driver's IOCTL code.

Jay Bosamiya (Microsoft) (jaybosamiya-ms)

Added a bunch of comments.

Jay Bosamiya (Microsoft) (jaybosamiya-ms)

Modulo the two remaining comments that I have (one regarding a comment that needs to be updated, and the other regarding cpu-mhz), I think this is reasonable enough to merge; we can postpone other improvements (e.g., linux-common etc) to future PRs.

Weiteng Chen (CvvT) · 2025-02-14T23:43:57Z

Removed Task trait from this PR. My initial thought was that we need it to help convert a kernel pointer to a pointer accessible to the host. However, I can also change the sandbox driver to do it.

Weiteng Chen (CvvT) · 2025-02-15T02:51:41Z

Rebase on the main branch and add implementation for RawPointerProvider (See https://github.com/MSRSSP/litebox/blob/8ad1533d8031851fa42f5438701c0c458dea3d6c/litebox_platform_linux_kernel/src/ptr.rs). To avoid complicate this PR, left todos in the function body.

Another change I did due to RawPointerProvider is the following:

 fn rt_sigprocmask(
how: i32,
- set: Option<*const crate::host::linux::sigset_t>,- oldset: Option<*mut crate::host::linux::sigset_t>,+ set: UserConstPtr<sigset_t>,+ oldset: UserMutPtr<sigset_t>,
sigsetsize: usize,
) -> Result<usize, error::Errno> {

Also, instead of passing user space pointer to host, I believe it is preferable to do some extra copy and pass kernel memory instead. See more comments here: https://github.com/MSRSSP/litebox/blob/8ad1533d8031851fa42f5438701c0c458dea3d6c/litebox_platform_linux_kernel/src/host/snp/snp_impl.rs#L185-L195

Implement a platform running in kernel mode that supports different hosts * implement kernel platform LinuxKernel * define platform-host interface HostInterface * implement HostInterface for snp

Weiteng Chen (CvvT) · 2025-02-12T19:59:55Z

Per our discussion, LinuxKernel is the provider/platform which depends on HostInterface (host specific interface) and Task (for per task storage).

Weiteng Chen (CvvT) · 2025-02-12T22:58:26Z

As we discussed #9, removed blocking punchthrough futex (which will be reimplemented in Litebox)

Weidong Cui (wdcui)

I focused on the high-level interfaces and structures in this round of review.

Weidong Cui (wdcui) · 2025-02-13T04:00:54Z

+	uint64_t ret;
+} __attribute__((__packed__));
+
+#define SNP_SANDBOX_IOCTL_DEBUG 0x6300 // _IO('c', 0)


TODO: maybe split this header file to two parts and only copy the part related to litebox here? For instance, litebox platform doesn't need to know the driver's IOCTL code.

Jay Bosamiya (Microsoft) (jaybosamiya-ms)

Added a bunch of comments.

Jay Bosamiya (Microsoft) (jaybosamiya-ms)

Modulo the two remaining comments that I have (one regarding a comment that needs to be updated, and the other regarding cpu-mhz), I think this is reasonable enough to merge; we can postpone other improvements (e.g., linux-common etc) to future PRs.

Weiteng Chen (CvvT) · 2025-02-14T23:43:57Z

Removed Task trait from this PR. My initial thought was that we need it to help convert a kernel pointer to a pointer accessible to the host. However, I can also change the sandbox driver to do it.

Weiteng Chen (CvvT) · 2025-02-15T02:51:41Z

Rebase on the main branch and add implementation for RawPointerProvider (See https://github.com/MSRSSP/litebox/blob/8ad1533d8031851fa42f5438701c0c458dea3d6c/litebox_platform_linux_kernel/src/ptr.rs). To avoid complicate this PR, left todos in the function body.

Another change I did due to RawPointerProvider is the following:

 fn rt_sigprocmask(
how: i32,
- set: Option<*const crate::host::linux::sigset_t>,- oldset: Option<*mut crate::host::linux::sigset_t>,+ set: UserConstPtr<sigset_t>,+ oldset: UserMutPtr<sigset_t>,
sigsetsize: usize,
) -> Result<usize, error::Errno> {

Also, instead of passing user space pointer to host, I believe it is preferable to do some extra copy and pass kernel memory instead. See more comments here: https://github.com/MSRSSP/litebox/blob/8ad1533d8031851fa42f5438701c0c458dea3d6c/litebox_platform_linux_kernel/src/host/snp/snp_impl.rs#L185-L195

Implement a platform running in kernel mode that supports different hosts * implement kernel platform LinuxKernel * define platform-host interface HostInterface * implement HostInterface for snp

Weiteng Chen (CvvT) · 2025-02-12T19:59:55Z

Per our discussion, LinuxKernel is the provider/platform which depends on HostInterface (host specific interface) and Task (for per task storage).

Weiteng Chen (CvvT) · 2025-02-12T22:58:26Z

As we discussed #9, removed blocking punchthrough futex (which will be reimplemented in Litebox)

Weidong Cui (wdcui)

I focused on the high-level interfaces and structures in this round of review.

Weidong Cui (wdcui) · 2025-02-13T04:00:54Z

+	uint64_t ret;
+} __attribute__((__packed__));
+
+#define SNP_SANDBOX_IOCTL_DEBUG 0x6300 // _IO('c', 0)


TODO: maybe split this header file to two parts and only copy the part related to litebox here? For instance, litebox platform doesn't need to know the driver's IOCTL code.

Jay Bosamiya (Microsoft) (jaybosamiya-ms)

Added a bunch of comments.

Jay Bosamiya (Microsoft) (jaybosamiya-ms)

Modulo the two remaining comments that I have (one regarding a comment that needs to be updated, and the other regarding cpu-mhz), I think this is reasonable enough to merge; we can postpone other improvements (e.g., linux-common etc) to future PRs.

Weiteng Chen (CvvT) · 2025-02-14T23:43:57Z

Removed Task trait from this PR. My initial thought was that we need it to help convert a kernel pointer to a pointer accessible to the host. However, I can also change the sandbox driver to do it.

Weiteng Chen (CvvT) · 2025-02-15T02:51:41Z

Rebase on the main branch and add implementation for RawPointerProvider (See https://github.com/MSRSSP/litebox/blob/8ad1533d8031851fa42f5438701c0c458dea3d6c/litebox_platform_linux_kernel/src/ptr.rs). To avoid complicate this PR, left todos in the function body.

Another change I did due to RawPointerProvider is the following:

 fn rt_sigprocmask(
how: i32,
- set: Option<*const crate::host::linux::sigset_t>,- oldset: Option<*mut crate::host::linux::sigset_t>,+ set: UserConstPtr<sigset_t>,+ oldset: UserMutPtr<sigset_t>,
sigsetsize: usize,
) -> Result<usize, error::Errno> {

Also, instead of passing user space pointer to host, I believe it is preferable to do some extra copy and pass kernel memory instead. See more comments here: https://github.com/MSRSSP/litebox/blob/8ad1533d8031851fa42f5438701c0c458dea3d6c/litebox_platform_linux_kernel/src/host/snp/snp_impl.rs#L185-L195

Implement a platform running in kernel mode that supports different hosts * implement kernel platform LinuxKernel * define platform-host interface HostInterface * implement HostInterface for snp

Weiteng Chen (CvvT) · 2025-02-12T19:59:55Z

Per our discussion, LinuxKernel is the provider/platform which depends on HostInterface (host specific interface) and Task (for per task storage).

Weiteng Chen (CvvT) · 2025-02-12T22:58:26Z

As we discussed #9, removed blocking punchthrough futex (which will be reimplemented in Litebox)

Weidong Cui (wdcui)

I focused on the high-level interfaces and structures in this round of review.

Weidong Cui (wdcui) · 2025-02-13T04:00:54Z

+	uint64_t ret;
+} __attribute__((__packed__));
+
+#define SNP_SANDBOX_IOCTL_DEBUG 0x6300 // _IO('c', 0)


TODO: maybe split this header file to two parts and only copy the part related to litebox here? For instance, litebox platform doesn't need to know the driver's IOCTL code.

Jay Bosamiya (Microsoft) (jaybosamiya-ms)

Added a bunch of comments.

Jay Bosamiya (Microsoft) (jaybosamiya-ms)

Modulo the two remaining comments that I have (one regarding a comment that needs to be updated, and the other regarding cpu-mhz), I think this is reasonable enough to merge; we can postpone other improvements (e.g., linux-common etc) to future PRs.

Weiteng Chen (CvvT) · 2025-02-14T23:43:57Z

Removed Task trait from this PR. My initial thought was that we need it to help convert a kernel pointer to a pointer accessible to the host. However, I can also change the sandbox driver to do it.

Weiteng Chen (CvvT) · 2025-02-15T02:51:41Z

Rebase on the main branch and add implementation for RawPointerProvider (See https://github.com/MSRSSP/litebox/blob/8ad1533d8031851fa42f5438701c0c458dea3d6c/litebox_platform_linux_kernel/src/ptr.rs). To avoid complicate this PR, left todos in the function body.

Another change I did due to RawPointerProvider is the following:

 fn rt_sigprocmask(
how: i32,
- set: Option<*const crate::host::linux::sigset_t>,- oldset: Option<*mut crate::host::linux::sigset_t>,+ set: UserConstPtr<sigset_t>,+ oldset: UserMutPtr<sigset_t>,
sigsetsize: usize,
) -> Result<usize, error::Errno> {

Also, instead of passing user space pointer to host, I believe it is preferable to do some extra copy and pass kernel memory instead. See more comments here: https://github.com/MSRSSP/litebox/blob/8ad1533d8031851fa42f5438701c0c458dea3d6c/litebox_platform_linux_kernel/src/host/snp/snp_impl.rs#L185-L195

Implement a platform running in kernel mode that supports different hosts * implement kernel platform LinuxKernel * define platform-host interface HostInterface * implement HostInterface for snp

Weiteng Chen (CvvT) · 2025-02-12T19:59:55Z

Per our discussion, LinuxKernel is the provider/platform which depends on HostInterface (host specific interface) and Task (for per task storage).

Weiteng Chen (CvvT) · 2025-02-12T22:58:26Z

As we discussed #9, removed blocking punchthrough futex (which will be reimplemented in Litebox)

Weidong Cui (wdcui)

I focused on the high-level interfaces and structures in this round of review.

Weidong Cui (wdcui) · 2025-02-13T04:00:54Z

+	uint64_t ret;
+} __attribute__((__packed__));
+
+#define SNP_SANDBOX_IOCTL_DEBUG 0x6300 // _IO('c', 0)


TODO: maybe split this header file to two parts and only copy the part related to litebox here? For instance, litebox platform doesn't need to know the driver's IOCTL code.

Jay Bosamiya (Microsoft) (jaybosamiya-ms)

Added a bunch of comments.

Jay Bosamiya (Microsoft) (jaybosamiya-ms)

Modulo the two remaining comments that I have (one regarding a comment that needs to be updated, and the other regarding cpu-mhz), I think this is reasonable enough to merge; we can postpone other improvements (e.g., linux-common etc) to future PRs.

Weiteng Chen (CvvT) · 2025-02-14T23:43:57Z

Removed Task trait from this PR. My initial thought was that we need it to help convert a kernel pointer to a pointer accessible to the host. However, I can also change the sandbox driver to do it.

Weiteng Chen (CvvT) · 2025-02-15T02:51:41Z

Rebase on the main branch and add implementation for RawPointerProvider (See https://github.com/MSRSSP/litebox/blob/8ad1533d8031851fa42f5438701c0c458dea3d6c/litebox_platform_linux_kernel/src/ptr.rs). To avoid complicate this PR, left todos in the function body.

Another change I did due to RawPointerProvider is the following:

 fn rt_sigprocmask(
how: i32,
- set: Option<*const crate::host::linux::sigset_t>,- oldset: Option<*mut crate::host::linux::sigset_t>,+ set: UserConstPtr<sigset_t>,+ oldset: UserMutPtr<sigset_t>,
sigsetsize: usize,
) -> Result<usize, error::Errno> {

Also, instead of passing user space pointer to host, I believe it is preferable to do some extra copy and pass kernel memory instead. See more comments here: https://github.com/MSRSSP/litebox/blob/8ad1533d8031851fa42f5438701c0c458dea3d6c/litebox_platform_linux_kernel/src/host/snp/snp_impl.rs#L185-L195

Implement a platform running in kernel mode that supports different hosts * implement kernel platform LinuxKernel * define platform-host interface HostInterface * implement HostInterface for snp

Weiteng Chen (CvvT) · 2025-02-12T19:59:55Z

Per our discussion, LinuxKernel is the provider/platform which depends on HostInterface (host specific interface) and Task (for per task storage).

Weiteng Chen (CvvT) · 2025-02-12T22:58:26Z

As we discussed #9, removed blocking punchthrough futex (which will be reimplemented in Litebox)

Weidong Cui (wdcui)

I focused on the high-level interfaces and structures in this round of review.

Weidong Cui (wdcui) · 2025-02-13T04:00:54Z

+	uint64_t ret;
+} __attribute__((__packed__));
+
+#define SNP_SANDBOX_IOCTL_DEBUG 0x6300 // _IO('c', 0)


TODO: maybe split this header file to two parts and only copy the part related to litebox here? For instance, litebox platform doesn't need to know the driver's IOCTL code.

Jay Bosamiya (Microsoft) (jaybosamiya-ms)

Added a bunch of comments.

Jay Bosamiya (Microsoft) (jaybosamiya-ms)

Modulo the two remaining comments that I have (one regarding a comment that needs to be updated, and the other regarding cpu-mhz), I think this is reasonable enough to merge; we can postpone other improvements (e.g., linux-common etc) to future PRs.

Weiteng Chen (CvvT) · 2025-02-14T23:43:57Z

Removed Task trait from this PR. My initial thought was that we need it to help convert a kernel pointer to a pointer accessible to the host. However, I can also change the sandbox driver to do it.

Weiteng Chen (CvvT) · 2025-02-15T02:51:41Z

Rebase on the main branch and add implementation for RawPointerProvider (See https://github.com/MSRSSP/litebox/blob/8ad1533d8031851fa42f5438701c0c458dea3d6c/litebox_platform_linux_kernel/src/ptr.rs). To avoid complicate this PR, left todos in the function body.

Another change I did due to RawPointerProvider is the following:

 fn rt_sigprocmask(
how: i32,
- set: Option<*const crate::host::linux::sigset_t>,- oldset: Option<*mut crate::host::linux::sigset_t>,+ set: UserConstPtr<sigset_t>,+ oldset: UserMutPtr<sigset_t>,
sigsetsize: usize,
) -> Result<usize, error::Errno> {

Also, instead of passing user space pointer to host, I believe it is preferable to do some extra copy and pass kernel memory instead. See more comments here: https://github.com/MSRSSP/litebox/blob/8ad1533d8031851fa42f5438701c0c458dea3d6c/litebox_platform_linux_kernel/src/host/snp/snp_impl.rs#L185-L195

Implement a platform running in kernel mode that supports different hosts * implement kernel platform LinuxKernel * define platform-host interface HostInterface * implement HostInterface for snp

Weiteng Chen (CvvT) · 2025-02-12T19:59:55Z

Per our discussion, LinuxKernel is the provider/platform which depends on HostInterface (host specific interface) and Task (for per task storage).

Weiteng Chen (CvvT) · 2025-02-12T22:58:26Z

As we discussed #9, removed blocking punchthrough futex (which will be reimplemented in Litebox)

Weidong Cui (wdcui)

I focused on the high-level interfaces and structures in this round of review.

Weidong Cui (wdcui) · 2025-02-13T04:00:54Z

+	uint64_t ret;
+} __attribute__((__packed__));
+
+#define SNP_SANDBOX_IOCTL_DEBUG 0x6300 // _IO('c', 0)


TODO: maybe split this header file to two parts and only copy the part related to litebox here? For instance, litebox platform doesn't need to know the driver's IOCTL code.

Jay Bosamiya (Microsoft) (jaybosamiya-ms)

Added a bunch of comments.

Jay Bosamiya (Microsoft) (jaybosamiya-ms)

Modulo the two remaining comments that I have (one regarding a comment that needs to be updated, and the other regarding cpu-mhz), I think this is reasonable enough to merge; we can postpone other improvements (e.g., linux-common etc) to future PRs.

Weiteng Chen (CvvT) · 2025-02-14T23:43:57Z

Removed Task trait from this PR. My initial thought was that we need it to help convert a kernel pointer to a pointer accessible to the host. However, I can also change the sandbox driver to do it.

Weiteng Chen (CvvT) · 2025-02-15T02:51:41Z

Rebase on the main branch and add implementation for RawPointerProvider (See https://github.com/MSRSSP/litebox/blob/8ad1533d8031851fa42f5438701c0c458dea3d6c/litebox_platform_linux_kernel/src/ptr.rs). To avoid complicate this PR, left todos in the function body.

Another change I did due to RawPointerProvider is the following:

 fn rt_sigprocmask(
how: i32,
- set: Option<*const crate::host::linux::sigset_t>,- oldset: Option<*mut crate::host::linux::sigset_t>,+ set: UserConstPtr<sigset_t>,+ oldset: UserMutPtr<sigset_t>,
sigsetsize: usize,
) -> Result<usize, error::Errno> {

Also, instead of passing user space pointer to host, I believe it is preferable to do some extra copy and pass kernel memory instead. See more comments here: https://github.com/MSRSSP/litebox/blob/8ad1533d8031851fa42f5438701c0c458dea3d6c/litebox_platform_linux_kernel/src/host/snp/snp_impl.rs#L185-L195

Implement a platform running in kernel mode that supports different hosts * implement kernel platform LinuxKernel * define platform-host interface HostInterface * implement HostInterface for snp

Weiteng Chen (CvvT) · 2025-02-12T19:59:55Z

Per our discussion, LinuxKernel is the provider/platform which depends on HostInterface (host specific interface) and Task (for per task storage).

Weiteng Chen (CvvT) · 2025-02-12T22:58:26Z

As we discussed #9, removed blocking punchthrough futex (which will be reimplemented in Litebox)

Weidong Cui (wdcui)

I focused on the high-level interfaces and structures in this round of review.

Weidong Cui (wdcui) · 2025-02-13T04:00:54Z

+	uint64_t ret;
+} __attribute__((__packed__));
+
+#define SNP_SANDBOX_IOCTL_DEBUG 0x6300 // _IO('c', 0)


TODO: maybe split this header file to two parts and only copy the part related to litebox here? For instance, litebox platform doesn't need to know the driver's IOCTL code.

Jay Bosamiya (Microsoft) (jaybosamiya-ms)

Added a bunch of comments.

Jay Bosamiya (Microsoft) (jaybosamiya-ms)

Modulo the two remaining comments that I have (one regarding a comment that needs to be updated, and the other regarding cpu-mhz), I think this is reasonable enough to merge; we can postpone other improvements (e.g., linux-common etc) to future PRs.

Weiteng Chen (CvvT) · 2025-02-14T23:43:57Z

Removed Task trait from this PR. My initial thought was that we need it to help convert a kernel pointer to a pointer accessible to the host. However, I can also change the sandbox driver to do it.

Weiteng Chen (CvvT) · 2025-02-15T02:51:41Z

Rebase on the main branch and add implementation for RawPointerProvider (See https://github.com/MSRSSP/litebox/blob/8ad1533d8031851fa42f5438701c0c458dea3d6c/litebox_platform_linux_kernel/src/ptr.rs). To avoid complicate this PR, left todos in the function body.

Another change I did due to RawPointerProvider is the following:

 fn rt_sigprocmask(
how: i32,
- set: Option<*const crate::host::linux::sigset_t>,- oldset: Option<*mut crate::host::linux::sigset_t>,+ set: UserConstPtr<sigset_t>,+ oldset: UserMutPtr<sigset_t>,
sigsetsize: usize,
) -> Result<usize, error::Errno> {

Also, instead of passing user space pointer to host, I believe it is preferable to do some extra copy and pass kernel memory instead. See more comments here: https://github.com/MSRSSP/litebox/blob/8ad1533d8031851fa42f5438701c0c458dea3d6c/litebox_platform_linux_kernel/src/host/snp/snp_impl.rs#L185-L195

Implement a platform running in kernel mode that supports different hosts * implement kernel platform LinuxKernel * define platform-host interface HostInterface * implement HostInterface for snp

Weiteng Chen (CvvT) requested a review from Weidong Cui (wdcui)February 12, 2025 19:59

This was referenced Feb 12, 2025
Vsbox #8
Closed
Support punchthrough tokens that have lifetime restrictions #9
Closed

Weidong Cui (wdcui) reviewed Feb 13, 2025
View reviewed changes

Jay Bosamiya (Microsoft) (jaybosamiya-ms) reviewed Feb 13, 2025
View reviewed changes

Jay Bosamiya (Microsoft) (jaybosamiya-ms) reviewed Feb 14, 2025
View reviewed changes

Comment threadlitebox_platform_linux_kernel/src/lib.rs Outdated

Jay Bosamiya (Microsoft) (jaybosamiya-ms) approved these changes Feb 14, 2025
View reviewed changes

Jay Bosamiya (Microsoft) (jaybosamiya-ms) reviewed Feb 14, 2025
View reviewed changes

Comment threadlitebox_platform_linux_kernel/Cargo.toml Outdated

Weiteng Chen (CvvT) added 12 commits February 14, 2025 16:03

init
4cf0cbb

fix fmt
cff20a4

remove futex and use rt_sigprocmask as an example
9f1e2b3

fmt
5e22c66

fix
d90ddc3

fix dep
98d70e8

fix
2f6c7a7

remove comment
b75a01d

fix doc
ca2bf30

Remove Task
4d60bff

remove unused dep
a83b5a5

impl RawPointerProvider
8ad1533

Weiteng Chen (CvvT)force-pushed the linux_kernel branch from 58dec05 to 8ad1533Compare February 15, 2025 02:31

remove pub
3f1625d

Weiteng Chen (CvvT) merged commit ff05350 into mainFeb 18, 2025

Weiteng Chen (CvvT) deleted the linux_kernel branch February 18, 2025 21:25

Weidong Cui (wdcui) mentioned this pull request Apr 29, 2026
Runtime ELF patching and rtld_audit removal #810
Merged