Clear Linux ships with Glibc built with `-Wp,-DFORTIFY_SOURCE=2`.
This overwrites Graphene's `-UFORTIFY_SOURCE` because of the quirk
in how GCC applies arguments (first without Wp, then with Wp).
This commit updates Makefiles to use `-Wp,-UFORTIFY_SOURCE`.
Instead of implementing downloading of external resources in every
Makefile again, use one script. This script adds the following
features:
- Always check the download against a known SHA-256 hash.
- Support caching of downloaded resources (set DL_CACHE=/some/dir).
- Allow offline builds if all files are cached. If DL_OFFLINE=true the
build will never attempt to download anything.
The academic-quality build script was supplanted by industry-grade
Makefile rule.
Also, glibc 2.19 is not supported, because it is not present in any
supported distro.
For detection of SGX/non-SGX (for example in regression tests) always
use the SGX environment variable. To generate launch/EINIT tokens use
the new 'sgx-tokens' Make target.
Previously, PARALLELMFLAGS variable caused warnings during Glibc build:
"-jN forced in submake: disabling jobserver mode". Since make supports
the jobserver such that passing -jN to parent make automatically allows
its child make to parallelize its jobs, we do not have to pass -j flags
to the child make.
Previously, Graphene supported Glibc version 2.19 only. This commit
adds support for Glibc v2.23 (default in Ubuntu 16.04) and Glibc
v2.27 (default in Ubuntu 18.04). The exact version can be chosen by
specifying GLIBC_VERSION during Graphene build. The default version
to be built is v2.27.
Note that for the best GDB experience it is advised to build Graphene
with the same Glibc version as installed on the host OS.
vDSO is supported by Graphene now, so this commit removes the
modification of Glibc which disabled vDSO in Graphene. Currently,
compile-time option GLIBC_DISABLE_VDSO is introduced to be able
to revert to the old behaviour (disabled by default).
Previously, in-LibOS Glibc was patched to prefer fork()
over clone(!CLONE_VM) to spawn a new process. Now that
clone(!CLONE_VM) works correctly, this patch is not needed.
Thus, this Glibc patch is made optional.
Currently cp to Runtime dir is used. Sometimes it is confusing when
binaries are re-built under Pal or LibOS. Symlink is better, so use
it instead.
- It's easy to understand where a file under Runtime dir comes from
- It's easy to understand in which directory to run `make`
- If cp is used, it's quite easy to test old binary under Runtime.
This patch create ln_sf rule and use it instead of cp and applies to
other recipe with cp.
In this context, creating symlink of glibc libraries is mess. This
patch also cleans it up to use Makefile instead of embedding the logic
into python script.
Signed-off-by: Isaku Yamahata <isaku.yamahata@gmail.com>
When glibc patches are updated, glibc won't be re-build.
This patch adds patches and Makefile as dependencies of glibc so that
when patches or Makefile are updated, glibc will be re-build.
.packed directories are originally created for testing on non-Linux platforms. The usage is mostly obsolete right now, and the binaries are completely out-dated. A better strategy would be to create a hook in the github to release binary packages.
Run CI in a Docker image
* Wait a second for lighttp and apache to fully initialize the socket
* Try to add a timeout for lmbench, which is prone to hanging (vfork)
* Set a timeout on gcc; one of the PRs is causing gcc hello to hang. Also, to avoid interference, run apache test on 8001 by default.
* Update lmbench to ignore bin dir
* Do the faster tests first; fail earlier
* Get the IP addr properly for web server tests
* Some notes on flaky LTP tests to debug later. Move a few that tend to heisenbugs off of the required list for now
* Try to detect vma list corruption during the debug dump, lest it be infinite.
* Temporarily disable the lmbench vfork test (Issue #142).
* Catch some failures faster.
* Catch failures in apachebench
* Take apache out of the Linux host/Debug build CI for now, as it hangs consistently. Filed issue #144 to track.
Release of Graphene SGX:
Supporting native Linux application in Intel SGX enclaves.
Most applications are supported. Some features may still be buggy.
Improving portability of Graphene:
Eliminating GCC-ism of the host-generic code.
Easier to port to non-Posix platform (e.g., Windows without Cygwin).
- Bugfixes in PAL and SHIM
- Improvement of migration scheme in SHIM, which largely speed up
forking
- Upgrade glibc to 2.19
- FreeBSD port
- Support OpenJDK, python and R
Plenty of bugfixes for Linux kernel later than 3.5 and Ubuntu later than 10.10.
More organized code to improve portability.
Regression tests for Pal to test completeness of implementation.
Dmitrii Kuvaiskii