- Make assert() a no-op in non-debug builds.
- Use static_assert for compile-time asserts.
- Fix assert() implementation (previous version didn't work for
expressions with types larger than long, it also always printed
`(value:0)`).
- Clean up calls to asserts.
In test_user_memory(), a memory range is tested via probing of each page
in the range. If the memory page was not allocated, it leads to a
segfault which is captured by the LibOS memfault_upcall() and reported
in the variable tcb.test_range.has_fault. However, the compiler may
optimize away accesses to this variable in test_user_memory(), believing
it is never updated anywhere else. This commit introduces a memory
barrier to prevent this compiler optimization (same for test_user_string()).
Inside `struct shim_handle` `opened` reference counter is used incorrectly.
Additionally at this moment it guards the same resource (handle) as `ref_counter`,
making it obsolete. This patch removes `opened` counter and moves `close_handle`
logic into `put_handle`.
Internal LibOS and PAL interfaces use microseconds (us) for timeout
values. However, Linux epoll_wait/epoll_pwait syscalls use milliseconds
(ms) for timeout. Previously, there was a bug in timeout resolution
because epoll_wait() emulation did not convert from ms to us. This
commit fixes this bug and also adds suffixes "_ms" and "_us" to make the
time units used explicit.
enable_preempt(), disable_preempt(), and other functions operated on
shim_context.preempt using non-atomic operations. This commit replaces
the old broken implementation with atomic operations.
- Deprecate sys_stack_size and max_brk_size. Get the values directly from __rlim.cur.
- Add internal routines for setting and getting __rlim.cur.
- Implement prlimit64() and simplify getrlimit() and setrlimit().
Previously, a checkpoint on child's do_migration() was allocated at a
random address and could overlap with parent's VMAs, leading to
intermittent bugs on some apps (including Apache under SGX PAL). This
commit turns on CPSTORE_DERANDOMIZATION so that the child always maps
the checkpoint at the same address as the parent. Note that this is
a temporary solution because of memory fragmentation and security
issues. It also disallows the parent process to have less memory than
the child (relevant in SGX environment, e.g., to GCC regression test).
chroot_readdir() tried to allocate a buffer big enough to hold all
entries, by calling DkStreamRead until it succeeded (increasing buffer
size otherwise). However, DkStreamRead could return partial results,
which was never handled (partial result means here it could return
just some objects, not a part of individual object). This commit fixes
this issue and refactors this function.
Previous implementation of vfork() was both buggy (worked only in simple
cases) and not compatible with the new IPC implementation. We take a
shortcut for now and emulate vfork() via fork(); this is allowed by
POSIX. This commit also adds LibOS regression test for vfork().
Previously, Graphene incorrectly treated execve() under SGX PAL:
Graphene would emulate execve() as fork + execve, and the new forked
process didn't try to "assume" the identity of its parent (which
violated execve specification "all process attributes are preserved").
This commit reworks the implementations of clone/fork and execve. In
particular, the IPC subsystem clearly distinguishes between the two
cases: clone/fork works as before whereas execve forks new "real"
process (which starts executing the requested program) and silently
exits the now-useless "temporary" process. New "real" process assumes
the identity of "temporary" process by inheriting its VMID (ID of
process for IPC purposes) and IPC-info objects with their PAL handles.
This commit also cleans up initialization of four IPC-info objects: self
(creates process-unique server pipe for IPC), parent (holds pipe for IPC
with parent process), and two namespace leaders (hold pipes for IPC with
leader processes). To correctly identify new-process server pipe, the
implementation of create_pipe() now allows to create VMID-based pipe URI.
Previously, the IPC subsystem incorrectly sent IPC_PID_KILL message
(generated as part of kill() syscall) as a duplex message, i.e., the
sender thread (the one issuing kill()) was paused until the receiving
child process handled IPC_PID_KILL callback and sent the acknowledgement
reply message back to sender.
This incorrect logic created a data race between the IPC_PID_KILL ack
message and the exiting child process. In particular, the child could
exit and all its resources (including IPC port to communicate with
parent) could be reclaimed by host OS. This could lead to IPC_PID_KILL
ack message being lost (because of the closed IPC port), and the paused
parent thread would wake up with -ECONNRESET instead of the ack message.
This would lead the kill() implementation to believe that child process
never existed in the first place and to return -ESRCH.
The fix to this data race is to send IPC_PID_KILL without waiting for
acknowledgement. Specification of kill() syscall does not require it to
be synchronous (indeed it is not on Linux), so this fix is correct. This
fix also enabled to merge broadcast_signal() into ipc_pid_kill_send().
- Changed type of shim_ipc_msg.size from int to size_t.
- Renamed shim_ipc_msg_obj to shim_ipc_msg_duplex for readability.
- Simplified function signatures and changed to better names.
- Removed unused IPC_FINDURI & IPC_TELLURI and corresponding functions.
- Replaced macros IPC_MSG_SIZE & IPC_MSGOBJ_SIZE with inline functions.
- Removed dangerous create_xxx_on_stack() functions and changed all
invocations to have explicit __alloca's. Those functions relied on
being inlined in the callers otherwise their created objects would
become corrupted. Explicit __alloca's avoid this brittle
implementation and make object ownership clear.
- Removed unnecessary wrapper function do_ipc_duplex(), replacing it
with send_ipc_message_duplex().
- Removed unnecessary macros (IPC_PORT_IFPOLL, DEBUG_REF, etc).
- Simplified function signatures and changed to better names.
- Removed unused functions (del_ipc_port, del_ipc_port_by_id).
- Malloc instead of huge stack allocations.
- Removed complex logic of exit_with_ipc_helper(), now IPC thread exits
similarly to Async helper thread.
- Removed ipc_port_pool hash list (used as perf optimization but
providing no tangible benefit at the cost of high complexity).
- Simplified IPC helper thread states to only ALIVE & NOTALIVE.
- Removed unused broadcast_port.
- Reworked IPC helper thread's while-loop similarly to Async helper
thread; removed perf optimization of keeping the same list of ports to
listen on DkObjectsWaitAny(), instead simply repopulate this list
every time (may become too slow if lots of IPC on hundreds of ports).
This commit adds vDSO support: creates vDSO memory region which contains
necessary symbols __vdso_{gettimeofday, clock_getime, time, getcpu} with
wrappers to call function pointers with actual LibOS implementation.
On startup, function pointers are setup to point to actual functions.
With this commit, the Glibc modification to not use vDSO can be removed.
Previously, Graphene had a bug when dentry's rel_path was not initialized
to actual relative path if parent + filename length was longer than
256B. The problem was that rel_path was a shim_qstr which could contain
maximum 256 chars. This commit increases the limit to 4096B and adds
checks to fail explicitly if rel_path is still too large. Also, it adds
LibOS regression test.
Note that relative paths greater than 256 chars in length are not
uncommon. Most OSes impose the limit of 4096 chars or no limit at all.
Previously, shim_ipc_helper() implementation was fragile because
it changed the stack in the middle of execution via switch_stack().
This commit introduces the stack trampoline to switch stack.
Previously, shim_do_execve_rtld() implementation was fragile because
it changed the stack in the middle of execution via switch_stack().
It also used global vars (subject to race condition) to populate the
stack. This commit introduces the stack trampoline to switch stack and
eliminate global vars by passing a struct as function argument.
* move syscall_nr from shim_context to shim_regs::orig_rax
* move ret_ip from shim_tls to shim_context as clean up
* move sp from shim_context to shim_regs
* context->regs == NULL doesn't make sense for restore_context() because
it doesn't work correctly. It tries to execute 0 address and probably
results in SEGV or something bad.
plus some code clean up and simplification.
Signed-off-by: Isaku Yamahata <isaku.yamahata@gmail.com>
A comprehensive rewrite of the Async helper thread functionality. This
thread is responsible for installment and delivery of two kinds of async
events: async IO (SIGIO) and alarms/timers (alarm/setitimer).
This commit adds emulation of setgroups() and getgroups() syscalls.
These syscalls are dummies, they do not consult host OS. Instead, they
initialize a per-process array of suppl group IDs to a single entry of
getgid() and allow to set any group IDs.
Some parts of LibOS used the combination of atomic_inc/add() + atomic_read()
which is not atomic. This commit introduces atomic_inc/add_return() to
make those parts atomic.
Previously the check on correct memory region under Linux-SGX
(called is_in_one_vma()) only checked that the whole memory region fits
into one VMA. In some cases (e.g. DATA and BSS sections), memory regions
can span several adjacent VMAs. This commit refines the check and
renames it to is_in_adjacent_vmas(). It also adds a LibOS test.
Michał Kowalczyk