Syscall recvmsg() accepts an array of buffers (iovecs). This buffers are
filled in array order. POSIX does not allow to fill e.g. iov[0] only
partially before proceeding to iov[1]. This commit makes recvmsg()
emulation compliant with this requirement.
Also, this commit fixes a small performance issue when recvmsg() would
overwrite the same received-address info over and over.
This commit improves the emulation of polling mechanisms (select,
pselect, poll, ppoll, epoll_wait) and cleans up the corresponding
code:
- New DkObjectsWaitEvents() PAL interface, replaces the inefficient
DkObjectsWaitAny() interface. This interface closely resembles
Linux/POSIX poll() in semantics.
- Improved shim_do_epoll_wait() implementation, now using the new
DkObjectsWaitEvents() interface.
- Improved shim_do_poll() implementation, now using the new
DkObjectsWaitEvents() interface.
- Small cleanups of polling code.
Accurate cleanup of shim_do_epoll_create1(), shim_do_epoll_ctl(),
shim_do_epoll_wait(), and other epoll helper functions. This cleanup
also adds error handling (missing previously).
The commit makes (most of) the corresponding LTP tests pass now.
Note that epoll semantics are still incorrect and inefficient: current
epoll_wait() emulation returns only one event to the user.
Accurate cleanup of shim_do_poll(), shim_do_ppoll(), shim_do_select(),
and shim_do_pselect6(). This cleanup also adds error handling (missing
previously).
The commit adds four LibOS regression tests on poll, ppoll, select,
and pselect mechanisms. Also, the corresponding LTP tests pass now.
Eventfd emulation currently relies on the host, thus eventfd syscalls
are disallowed by default due to security concerns. To use them, they
must be explicitly allowed through "sys.allow_insecure_eventfd" in
the manifest.
Graphene IPC (GIPC) was introduced to perform faster bulk IPC by sharing pages as copy-on-write
across processes. This feature became stale, and it was shown that recent Linux kernels (4.2+)
have zero-copy transfers over UNIX sockets and exhibit similar performance. GIPC is not built and
not tested in Jenkins. Also, GIPC does not work under SGX. This commit completely removes GIPC.
This commit completely rewrites futex implementation to (hopefully)
remove all races (both on memory access level and between waits and
wakes), make it compatible with actual Linux implementation and make
it more maintainable and readable.
Previously, if user performed getdents() on a directory containing
inaccessible files (because user doesn't have permission), whole
getdents failed with -EACCES. This is incorrect behavior: files must
still be listed. This commit fixes the root cause of this bug by
marking inaccessible files as DENTRY_NEGATIVE.
Previously, exit_group test was disabled on Linux-SGX PAL. It was
disabled because the PAL incorrectly exited threads. The latest
commits fix this, and the test can be re-enabled.
Previously, there was a data race on thread::is_alive between one thread
checking whether it is the last thread alive via check_last_thread() and
another thread exiting via thread_exit(). The former checks if is_alive
is true, the latter sets it to false. However, the exiting thread will
truly exit only after it called DkThreadExit(), thus the race on is_alive
led to scenarios where two threads believe to be the last threads alive
and compete on terminating Async Helper/IPC threads and exiting the whole
process. This commit introduces cleanup_thread() called by Async Helper
to set is_alive to false and delete the thread, freeing its resources.
The data race is thus removed, and shim_thread object leak is prevented.
Previously, there was a bug in copy of the shim_thread::signal_handles[].action
due to sizeof on the wrong type (shim_signal_handle instead of __kernel_sigaction).
This led to incomplete action object in signal_handles[].
When child thread exits, it wakes up its parent if CLONE_CHILD_CLEARTID was set
during clone() call. Previously, this was done by the child thread itself as
part of its own clean-up in release_clear_child_id(). But this child thread is
still alive at this point and uses some resources, most notably the stack (that
might have been provided by the parent) and the SGX TCS slot. Upon waking up,
the parent might decide to free that stack (as Pthreads do) or re-use the TCS
slot, causing data races.
This commit introduces a correct emulation of CLONE_CHILD_CLEARTID:
- A new argument `PAL_PTR clear_child_tid` is added to DkThreadExit();
it points to internal Graphene memory that is erased on child exit to notify
Async Helper thread.
- At PAL layer, when thread finally exits, it sets PAL-level *clear_child_tid = 0
(corresponds to &clear_child_tid_val_pal at LibOS level); this signals to LibOS
layer that the thread stopped using resources.
- At LibOS layer, Async Helper thread is set up to wait for the signal from
PAL; it is now the responsibility of Async Helper thread to call
release_clear_child_id() to wake up the parent thread.
- Async Helper thread waits for clear_child_tid_val_pal == 0 and then sets
the actual clear_child_tid to 0 and wakes up the waiting parent.
Note that for Linux-SGX PAL, clear_child_tid is set to 0 not immediately
but as part of handle_thread_reset, otherwise the TCS slot could be still
occupied when LibOS wakes up the parent.
As a side effect, the LibOS code for threads/process exit is cleaned up.
This commit also fixes all regression tests to use the new signature of
DkThreadExit() and increases the number of SGX threads slightly (to
accommodate the newly used Async Helper thread).
The LTP test signal06 is a regression test for some obscure bug in older
Linux kernels. It uses SIGHUP and SIGSEGV signals to test mprotect() of
altstack. Since SIGHUP is completely ignored by Graphene, and altstack is
not correctly emulated, and mprotect() doesn't work, this test never made
sense for Graphene. This commit disables it.
These tests perform common FS operations in various ways:
- open/close
- read/write
- create/delete
- read/change size
- seek/tell
- memory-mapped read/write
- copy directory in different ways
Tests use both direct syscalls and stdio wrappers (FILE).
To run, call `make test` in `LibOS/shim/test/fs`.
In Async Helper thread, async_list is protected by async_list_lock.
Previously, this thread unlocked async_list_lock on each detected
triggered entry to perform a callback during traversal of async_list
(unlocking is needed because it is unknown how much time the callback
takes to execute). However, once we unlock, the list may become
unstable (install_async_event may delete/append an entry). Then, next
FOR_EACH_LIST_SAFE list entry may be freed while trigering callback,
and the next iteration may try to dereference this invalid pointer.
This commit alleviates this scenario by creating a temporal list of
triggered entries and performing all callbacks after list traversal.
This patch removes __attribute__((packed)) to eliminate warnings gcc-9
generates. Example:
> warning: taking address of packed member of struct poll_handle may result in an unaligned pointer value [-Waddress-of-packed-member]
Packed attribute is used for structures using which Graphene processes
communicate with each other. We don't implement privilege separation, so
it's ok to leak data in struct paddings.
If the padding is really a concern, we could:
- Define two structures, a packed one for serialization and a non-packed
one for code, and then explicitly (de)serialize.
- Define the structure fields with an explicit size (e.g. uint64_t
instead of long), carefully add explicit padding and then zero it out
before sending.
The academic-quality build script was supplanted by industry-grade
Makefile rule.
Also, glibc 2.19 is not supported, because it is not present in any
supported distro.
The execve() syscall starts a new executable in the *same* process. Previously,
Graphene followed this convention *only* for non-SGX PALs. If PAL was Linux-SGX,
Graphene silently terminated the process and created a new one.
This deviation from standard execve() behavior resulted in the host shell
becoming detached from the Graphene-SGX process. In turn, this led to our
Bash example (on Ubuntu 18.04, bash version 4.4.19) "terminating" early
from the point of view of Jenkins, and SGX-18.04 pipeline failed.
This commit allows Graphene-SGX to execve() in the same process, but only if it
is the same executable (as in the Bash example). It is still impossible to
execve() in the same process for a different executable since this requires a
new SGX enclave measurement and thus demands a new process.
jack.wxz