{"id":13428983,"url":"https://github.com/enarx/enarx","last_synced_at":"2025-04-25T14:49:23.370Z","repository":{"id":37587731,"uuid":"206337472","full_name":"enarx/enarx","owner":"enarx","description":"Enarx: Confidential Computing with WebAssembly","archived":false,"fork":false,"pushed_at":"2025-03-31T10:21:29.000Z","size":6129,"stargazers_count":1348,"open_issues_count":271,"forks_count":150,"subscribers_count":31,"default_branch":"main","last_synced_at":"2025-04-24T08:55:12.364Z","etag":null,"topics":["confidential-computing","webassembly"],"latest_commit_sha":null,"homepage":"https://enarx.dev/","language":"Rust","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/enarx.png","metadata":{"files":{"readme":"README-DEBUG.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":".github/CODEOWNERS","security":"SECURITY.md","support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2019-09-04T14:22:26.000Z","updated_at":"2025-04-19T09:57:25.000Z","dependencies_parsed_at":"2023-12-15T03:26:29.736Z","dependency_job_id":"e388b0af-3b38-47e1-b7f8-f3bf47f5c2e1","html_url":"https://github.com/enarx/enarx","commit_stats":{"total_commits":2500,"total_committers":51,"mean_commits":49.01960784313726,"dds":0.712,"last_synced_commit":"90517e70a065dbbf9332cbe6bb9c4d2531a12c5e"},"previous_names":[],"tags_count":18,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/enarx%2Fenarx","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/enarx%2Fenarx/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/enarx%2Fenarx/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/enarx%2Fenarx/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/enarx","download_url":"https://codeload.github.com/enarx/enarx/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":250838485,"owners_count":21495757,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["confidential-computing","webassembly"],"created_at":"2024-07-31T02:00:16.606Z","updated_at":"2025-04-25T14:49:23.334Z","avatar_url":"https://github.com/enarx.png","language":"Rust","funding_links":[],"categories":["Others","Runtime Framework","Rust","CC Software Stack (Active and Open source)","Code Repositories"],"sub_categories":["Industrial Leading Projects","Others"],"readme":"# Debugging\n\n## Stack Trace\n\n### KVM / SEV\n\nIf you encounter unexpected shutdowns or panics like:\n\n```\npanicked at 'explicit panic', src/syscall.rs:167:9\nTRACE:\n  0x000000000000f876\n  0x0000000000039d10\n  0x0000000000007189\n  0x0000000000008d3e\n  0x0000000000008b58\nP 0x0000000000001279\nP 0x000000000000102c\n```\n\nor\n\n```\nError: Shutdown Ok(\n    kvm_regs {\n        rax: 0x29f47,\n        rbx: 0x2a014,\n        rcx: 0x15475,\n        rdx: 0x246e8,\n        rsi: 0x269b0,\n        rdi: 0x1e2db,\n        rsp: 0xffffff8000433900,\n        rbp: 0xffffff8000433a70,\n        r8: 0x129cb,\n        r9: 0x29ed7,\n        r10: 0x2a074,\n        r11: 0x154f5,\n        r12: 0x259b0,\n        r13: 0x268f0,\n        r14: 0x109ac,\n        r15: 0x30889,\n        rip: 0xffffff8000230662,\n        rflags: 0x10046,\n    },\n)\n```\n\nyou might get a meaningful stack backtrace with the `helper/parse-trace.sh` script:\n\n```console\n$ ./helper/parse-trace.sh \u003cshim\u003e [\u003cexec\u003e]\n```\n\n`parse-trace.sh` needs `addr2line` from `binutils`, so make sure that is installed.\n\nIn order to select one of the built shim-kvm artifacts, run this:\n\n```console\n$ find target \\\n  \\( -perm -u=x -o -perm -g=x -o -perm -o=x \\) \\\n  -wholename \"*debug*bin/enarx_shim_kvm*\"\n```\n\nThen, you can pick a shim to e.g. an (unexported) shell variable, and\nprogress further with your debugging session.\n\nNow, let's go through a couple of examples, with `SHIM` containing\nthe path to the target shim binary.\n\nParsing traceback from a file:\n```console\n$ ./helper/parse-trace.sh $SHIM \u003c traceback.txt\n```\n\nReading traceback from pipe:\n```console\n$ cargo run -- exec \u003cexec\u003e |\u0026 ./helper/parse-trace.sh $SHIM\n```\n\n## GDB\n\nTo enable gdb support, compile enarx with the `gdb` feature:\n\n```console\n$ cargo clean\n$ cargo build --features gdb\n```\n\n### KVM / SEV-SNP\n\nFind the \"shim\" of the TEE. Normally this is `shim-kvm`:\n```console\n$ find target -wholename '*linux-musl/*/shim-kvm'\ntarget/debug/build/enarx-f0e8a07172ba3be9/out/internal/shim-kvm/x86_64-unknown-linux-musl/debug/shim-kvm\n```\n\nFind the \"exec\" of the TEE. Normally this is `wasmldr`:\n```console\n$ find target -wholename '*linux-musl/*/wasmldr'\ntarget/debug/build/enarx-f0e8a07172ba3be9/out/internal/wasmldr/x86_64-unknown-linux-musl/debug/wasmldr\n```\n\nStart the TEE:\n```console\n$ ./target/debug/enarx run ~/git/zerooneone/target/wasm32-wasi/debug/zerooneone.wasm\n[…]\nStarting GDB session...\nsymbol-file -o 0xffffff8000000000 \u003cshim\u003e\nadd-symbol-file -o 0x7f6ffbef8000 \u003cexec\u003e\n[…]\nWaiting for a GDB connection on \"localhost:23456\"...\n```\n\nYou can set the listen address with `--gdblisten \u003caddress\u003e`.\n\nNow connect with `gdb` from another terminal and load the symbols from the debug executables as mentioned by the output\nwith the offsets mentioned. Note: the offsets can vary for every run due to address space layout randomization (ASLR).\n```console\n$ gdb\n[…]\n(gdb) symbol-file -o 0xffffff8000000000 target/debug/build/enarx-f0e8a07172ba3be9/out/internal/shim-kvm/x86_64-unknown-linux-musl/debug/shim-kvm\nReading symbols from target/debug/build/enarx-f0e8a07172ba3be9/out/internal/shim-kvm/x86_64-unknown-linux-musl/debug/shim-kvm...\n\n(gdb) add-symbol-file -o 0x7f6ffbef8000 target/debug/build/enarx-f0e8a07172ba3be9/out/internal/wasmldr/x86_64-unknown-linux-musl/debug/wasmldr\nadd symbol table from file \"target/debug/build/enarx-f0e8a07172ba3be9/out/internal/wasmldr/x86_64-unknown-linux-musl/debug/wasmldr\" with all sections offset by 0xfbef8000\n(y or n) y\n[…]\n\n(gdb) target remote localhost:23456\nRemote debugging using localhost:23456\n[…]\n0x00007f434ee83cc9 in _start ()\n```\n\nThe current execution is stopped in the \"exec\" executable at the ELF entry point `_start`. You can now start debugging the \"exec\".\n\n```console\n(gdb) br wasmldr::main\nBreakpoint 1 at 0x7f434efddbeb: file src/main.rs, line 72.\n(gdb) cont\nContinuing.\n\nBreakpoint 1, wasmldr::main () at src/main.rs:72\n72\t    env_logger::Builder::from_default_env().init();\n(gdb) list\n67\tfn main() {\n68\t    // KEEP-CONFIG HACK: we've inherited stdio and the shim sets\n69\t    // \"RUST_LOG=debug\", so this should make logging go to stderr.\n70\t    // FUTURE: we should have a keep-provided debug channel where we can\n71\t    // (safely, securely) send logs. Might need our own logger for that..\n72\t    env_logger::Builder::from_default_env().init();\n73\t\n74\t    info!(\"version {} starting up\", env!(\"CARGO_PKG_VERSION\"));\n75\t\n76\t    warn!(\"🌭DEV-ONLY BUILD, NOT FOR PRODUCTION USE🌭\");\n(gdb) print $pc\n$1 = (*mut fn ()) 0x7f434efddbeb \u003cwasmldr::main+11\u003e\n(gdb) stepi\n0x00007f434efddbf2\t72\t    env_logger::Builder::from_default_env().init();\n(gdb) print $pc\n$2 = (*mut fn ()) 0x7f434efddbf2 \u003cwasmldr::main+18\u003e\n(gdb) stepi\n0x00007f434efddbf9\t72\t    env_logger::Builder::from_default_env().init();\n(gdb) print $pc\n$3 = (*mut fn ()) 0x7f434efddbf9 \u003cwasmldr::main+25\u003e\n```\n\n### SGX\n\nBefore starting the debugging session, make sure you are in the project root\ndirectory, and make a debug build with the `gdb` feature flag:\n\n```\ncargo build --features gdb\n```\n\nFirst, an appropriate shim binary for the debugging session must be found. An\nexisting shim can be selected by issuing:\n\n```console\n$ find target \\\n  \\( -perm -u=x -o -perm -g=x -o -perm -o=x \\) \\\n  -wholename \"*debug*bin/enarx_shim_sgx*\"\n```\n\n`wasmtime` is contained to the shim but it is embedded as an anonymous blob.\nTherefore, the matching ELF-file of `wasmtime`  must be also found.  An existing\n`wasmtime` binary can be selected by issuing:\n\n```console\n$ find target \\\n  \\( -perm -u=x -o -perm -g=x -o -perm -o=x \\) \\\n  -wholename \"*debug*bin/enarx_exec_wasmtime*\"\n```\n\nNow, let's go through an example, starting at the point when the target binaries\nhave been already selected.  The next step would be to find out the virtual\naddresses for the symbol resolution, so that GDB will know how to base the\nrelocation correctly.\n\nShim's virtual address is visible in `/proc/\u003cpid\u003e/maps`.  Just look up for the\nentry with `/dev/sgx_enclave` mapped.  Theoretically it is possible that this is\nnot the same as shim's base address, as the host could have simply unmapped some\npages from the head.\n\nLikewise, as dictated by `crates/shim-sgx/layout.ld`,  `wasmtime` is probably\nplaced at the offset `0x40000000`.  For example, if shim's address is\n`0x7fcf00000000`, then `wasmtime` is likely located at `0x7fcf00400000`.\n\nTo overcome this issue, `enarx`, when built with the `gdb` feature, will print\nout the correct addresses to the console before it starts to wait for GDB:\n\n```console\n$ ./target/debug/enarx run \u003cwasm-file\u003e\n[…]\nStarting GDB session...\nsymbol-file -o 0x7fcf00000000 \u003cshim\u003e\nadd-symbol-file -o 0x7fcf00400000 \u003cexec\u003e\nWaiting for a GDB connection on \"localhost:23456\"...\n```\n\n`enarx` command-line supports `--gdblisten \u003caddress\u003e`, when compiled with `gdb`\nfeature, if a different listen address is preferred over 23456.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fenarx%2Fenarx","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fenarx%2Fenarx","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fenarx%2Fenarx/lists"}