chroot_readdir() tried to allocate a buffer big enough to hold all
entries, by calling DkStreamRead until it succeeded (increasing buffer
size otherwise). However, DkStreamRead could return partial results,
which was never handled (partial result means here it could return
just some objects, not a part of individual object). This commit fixes
this issue and refactors this function.
Disallow user program to mmap outside the allowed user address range.
This is especially important for Linux-SGX PAL, since all user-program
memory must be allocated inside of the enclave range (ELRANGE). For
other PALs like Linux and FreeBSD, we probably should enhance PAL
interface (pal_control.user_address) to specify a more meaningful range
(currently the range is from minimal allowed address to address of the
code segment of the PAL library).
Previously, sigsuspend(), pause(), and nanosleep() syscalls did not
check for pending signals before waiting on signals. This commit adds
this logic, similar to how this is implemented in Linux. This fixes data
races in regression tests relying on these syscalls (killXX in ltp).
Previous implementation of vfork() was both buggy (worked only in simple
cases) and not compatible with the new IPC implementation. We take a
shortcut for now and emulate vfork() via fork(); this is allowed by
POSIX. This commit also adds LibOS regression test for vfork().
Sometimes apps are built with the ELF header containing OS ABI ==
ELFOSABI_LINUX (GCC is one example). Previously, LibOS dynamic loader
only allowed OS ABI == ELFOSABI_SYSV (most apps are built with it) and
failed on ELFOSABI_LINUX. This commit teaches LibOS loader to accept
ELFOSABI_LINUX binaries and removes some redundant checks on ELF header.
New implementation is now in line with dynamic loader of PAL.
Previously, Graphene incorrectly treated execve() under SGX PAL:
Graphene would emulate execve() as fork + execve, and the new forked
process didn't try to "assume" the identity of its parent (which
violated execve specification "all process attributes are preserved").
This commit reworks the implementations of clone/fork and execve. In
particular, the IPC subsystem clearly distinguishes between the two
cases: clone/fork works as before whereas execve forks new "real"
process (which starts executing the requested program) and silently
exits the now-useless "temporary" process. New "real" process assumes
the identity of "temporary" process by inheriting its VMID (ID of
process for IPC purposes) and IPC-info objects with their PAL handles.
This commit also cleans up initialization of four IPC-info objects: self
(creates process-unique server pipe for IPC), parent (holds pipe for IPC
with parent process), and two namespace leaders (hold pipes for IPC with
leader processes). To correctly identify new-process server pipe, the
implementation of create_pipe() now allows to create VMID-based pipe URI.
This commit adds default signal dispositions (as per Linux) to all 32
standard signals. It also adds WCOREDUMP bit to correctly inform wait4()
status word.
This commit updates graphene-tests submodules to enable new killXX LTP
regression tests, as well as fix the waitpid05 LTP test. It is important
to update this submodule reference in this commit because otherwise
waitpid05 tests will fail Graphene's CI.
This commit adds additional logic around DkStreamWrite() and
DkStreamRead() in send_ipc_message() and receive_ipc_message()
respectively: interrupts and partial reads/writes are handled correctly.
Previously, when a thread exited via thread_exit(), it could send two
identical IPC_CLD_EXIT messages under certain conditions. This commit
fixes this bug and forces thread_exit() to send IPC_CLD_EXIT at most once.
Previously, the IPC subsystem incorrectly sent IPC_PID_KILL message
(generated as part of kill() syscall) as a duplex message, i.e., the
sender thread (the one issuing kill()) was paused until the receiving
child process handled IPC_PID_KILL callback and sent the acknowledgement
reply message back to sender.
This incorrect logic created a data race between the IPC_PID_KILL ack
message and the exiting child process. In particular, the child could
exit and all its resources (including IPC port to communicate with
parent) could be reclaimed by host OS. This could lead to IPC_PID_KILL
ack message being lost (because of the closed IPC port), and the paused
parent thread would wake up with -ECONNRESET instead of the ack message.
This would lead the kill() implementation to believe that child process
never existed in the first place and to return -ESRCH.
The fix to this data race is to send IPC_PID_KILL without waiting for
acknowledgement. Specification of kill() syscall does not require it to
be synchronous (indeed it is not on Linux), so this fix is correct. This
fix also enabled to merge broadcast_signal() into ipc_pid_kill_send().
Previously, there was an incorrect corner case during discovering of the
current namespace leader. If the parent process would exit before the
child, the child process would fail on sending FINDNS message to the
parent (because of closed parent socket). The previous code logic would
assume that since NS_LEADER is set to some value, the leader process
exists. In reality, the child loses the only source of information about
the leader process (note that FINDNS is sent only to the parent), so the
only meaningful action is to set myself as the new leader.
- Changed type of shim_ipc_msg.size from int to size_t.
- Renamed shim_ipc_msg_obj to shim_ipc_msg_duplex for readability.
- Simplified function signatures and changed to better names.
- Removed unused IPC_FINDURI & IPC_TELLURI and corresponding functions.
- Replaced macros IPC_MSG_SIZE & IPC_MSGOBJ_SIZE with inline functions.
- Removed dangerous create_xxx_on_stack() functions and changed all
invocations to have explicit __alloca's. Those functions relied on
being inlined in the callers otherwise their created objects would
become corrupted. Explicit __alloca's avoid this brittle
implementation and make object ownership clear.
- Removed unnecessary wrapper function do_ipc_duplex(), replacing it
with send_ipc_message_duplex().
- Removed unnecessary macros (IPC_PORT_IFPOLL, DEBUG_REF, etc).
- Simplified function signatures and changed to better names.
- Removed unused functions (del_ipc_port, del_ipc_port_by_id).
- Malloc instead of huge stack allocations.
- Removed complex logic of exit_with_ipc_helper(), now IPC thread exits
similarly to Async helper thread.
- Removed ipc_port_pool hash list (used as perf optimization but
providing no tangible benefit at the cost of high complexity).
- Simplified IPC helper thread states to only ALIVE & NOTALIVE.
- Removed unused broadcast_port.
- Reworked IPC helper thread's while-loop similarly to Async helper
thread; removed perf optimization of keeping the same list of ports to
listen on DkObjectsWaitAny(), instead simply repopulate this list
every time (may become too slow if lots of IPC on hundreds of ports).
Compilation of bookkeep/shim_signal.c:__handle_one_signal() under GCC8
failed with cast-function-type error on k_sa_handler assignment to
handler. This commit fixes this error via cast to void*.
This commit adds vDSO support: creates vDSO memory region which contains
necessary symbols __vdso_{gettimeofday, clock_getime, time, getcpu} with
wrappers to call function pointers with actual LibOS implementation.
On startup, function pointers are setup to point to actual functions.
With this commit, the Glibc modification to not use vDSO can be removed.
Data race between creating and exiting the async helper thread: during
async helper thread breaking its while-loop and exiting, another thread
may call install_async_event() and read that the helper is alive, thus
skipping create_async_helper(). Therefore, the other thread installs the
event but there is no async helper thread to trigger it. This commit
fixes this data race by moving check-if-alive under the lock.
- Add error case: fail with EISDIR if directory is open()'ed with
writable access.
- Add additional checks: O_TRUNC must work only on regular writable
files (otherwise do not truncate).
The commit also improves LibOS regression test on FS corner cases and
fixes a tiny bug in DkStreamSetLength() with assert hanging Graphene.
Previously, Graphene had a bug when dentry's rel_path was not initialized
to actual relative path if parent + filename length was longer than
256B. The problem was that rel_path was a shim_qstr which could contain
maximum 256 chars. This commit increases the limit to 4096B and adds
checks to fail explicitly if rel_path is still too large. Also, it adds
LibOS regression test.
Note that relative paths greater than 256 chars in length are not
uncommon. Most OSes impose the limit of 4096 chars or no limit at all.
Previously, OpenMP apps failed to run under Graphene-SGX because it did
not support raw system calls (used inside of OpenMP lib, in particular
the futex() syscall). Since recently, Graphene-SGX has support for raw
syscall execution. This commit adds a test showing that OpenMP works.
During checkpointing, qstr->oflow was redirected to point to the memory
region in the checkpoint and the old memory region was not freed. We
cannot keep qstr->oflow pointing to the checkpoint memory area
because it will be freed after migration, leaving the parent with a
dangling pointer. Instead, keep parent's qstr->oflow intact but copy its
content inside the checkpoint and rebase accordingly in the child as
part of checkpoint restore.
Isaku Yamahata