Skip to content

Support for non PIE binaries

Christian Priebe edited this page May 31, 2019 · 1 revision

SGX-LKL supports non-PIE binaries, but in order to do so needs to be able to map to address 0x0 of the virtual address space. Non-PIE Linux binaries by default expect their .text segments to be mapped at address 0x400000. SGX requires the base address to be naturally aligned to the enclave size. Therefore, it is not possible to use 0x400000 as base address in cases where the enclave is larger than 4 MB (0x400000 bytes). Instead, the enclaves needs to be mapped to address 0x0 to adhere to the alignment requirement. By default, Linux does not allow fixed mappings at address 0x0. To permit this, run:

sysctl -w vm.mmap_min_addr="0"

To change the system configuration permanently use:

echo "vm.mmap_min_addr = 0" > /etc/sysctl.d/mmap_min_addr.conf
/etc/init.d/procps restart

By default, SGX-LKL maps the enclave at an arbitrary free space in memory. To run a non-PIE binary and map the enclave at the beginning of the address space, use SGXLKL_NON_PIE=1, e.g.:

cd apps/helloworld
make sgxlkl-disk.img
SGXLKL_NON_PIE=1 sgx-lkl-run sgxlkl-disk.img app/helloworld-nonpie
Clone this wiki locally