Instead of depending on dynamic linking for LibOS entry point
(syscalldb), we pass a pointer in the shim_tcb structure, so that
the patched code can enter syscall using 'jmp *%gs:<offset>'.
The same applies to the vDSO syscall code that previously needed
an up-to-date pointer to syscalldb function. Now, there is no
need to adjust the values inside the vDSO page.
In addition, this change removes the other two instances where we
import a symbol directly from LibOS: register_library (can be also
done through GS register) and glibc_version (not important because
we build Graphene and glibc together).
This simplifies things because the dynamic linking necessary to
make the syscalldb function available had to be performed by LibOS
itself (in many cases, effectively doing a second pass of dynamic
linking after ld.so). After this change, there will be no need for
LibOS to perform dynamic linking, and the ELF loading code can be
simplified.
Signed-off-by: Paweł Marczewski <pawel@invisiblethingslab.com>
Unfortunately, specifying environment variables like CC, CXX, AS
during GCC build leads to strange errors. The official GCC docs
simply state "defining certain environment variables such as CC
can interfere with the functioning of make". So we unset them
explicitly for the GCC build.
Many multi-threaded applications rely on OpenMP for efficient
parallelism. Such applications link against the libgomp.so lib.
Unfortunately, the native libgomp.so uses a raw SYSCALL instruction
to issues futex() syscalls instead of syscall() Glibc wrapper (for
performance reasons). SYSCALL instructions are executed on hot paths
of OpenMP, but they are forbidden inside SGX enclaves, so Graphene
traps-and-emulates them. This is very expensive, so this commit
introduces an optional `make -C LibOS gcc` to build libgomp.so where
SYSCALL is replaced by direct call into Graphene, similar to how we
patch Glibc. See `openmp` LibOS regression manifest for example.
This patched libgomp.so improves SGX performance of e.g. PyTorch:
from 25% perf overhead over native to 8% on some workloads.
Note that libgomp.so is built as part of GCC, and the build takes
30 min to 2 hours. That's why we make it optional and do not build
in Jenkins.
This commit removes a lot of unused code in LibOS:
- Graphene-introduced syscalls msgpersist(), benchmark_rpc(),
send_rpc(), recv_rpc() are removed completely. We decided to
introduce new Graphene-specific functionality through pseudo-
files and maybe IOCTLs, but not new syscalls.
- Because of the removed syscalls, there is no need for liblibos
library and corresponding Glibc patches.
- Complex and useless features of the IPC subsystem are removed:
- Moving SYS-V resources to "appropriate" nodes based on scores.
- All code under USE_SHARED_SEMAPHORE macro.
- All code under MIGRATE_SYSV_MSG and MIGRATE_SYSV_SEM macros.
- NOP, arbitrary RPC messages in IPC.
- Useless tests are removed: rpc_latency{2} under benchmark and
msg_{create,send}_libos under native.
Previously, Glibc patches were generated with shortened index hashes.
This commit re-generates all Glibc patches with complete index
hashes using `--full-index` option.
This commit also removes mentions of removed old Glibc 2.19 and the
unused Gold ld patch.
Clear Linux ships with Glibc built with `-Wp,-DFORTIFY_SOURCE=2`.
This overwrites Graphene's `-UFORTIFY_SOURCE` because of the quirk
in how GCC applies arguments (first without Wp, then with Wp).
This commit updates Makefiles to use `-Wp,-UFORTIFY_SOURCE`.
Instead of implementing downloading of external resources in every
Makefile again, use one script. This script adds the following
features:
- Always check the download against a known SHA-256 hash.
- Support caching of downloaded resources (set DL_CACHE=/some/dir).
- Allow offline builds if all files are cached. If DL_OFFLINE=true the
build will never attempt to download anything.
The academic-quality build script was supplanted by industry-grade
Makefile rule.
Also, glibc 2.19 is not supported, because it is not present in any
supported distro.
For detection of SGX/non-SGX (for example in regression tests) always
use the SGX environment variable. To generate launch/EINIT tokens use
the new 'sgx-tokens' Make target.
Previously, PARALLELMFLAGS variable caused warnings during Glibc build:
"-jN forced in submake: disabling jobserver mode". Since make supports
the jobserver such that passing -jN to parent make automatically allows
its child make to parallelize its jobs, we do not have to pass -j flags
to the child make.
Previously, Graphene supported Glibc version 2.19 only. This commit
adds support for Glibc v2.23 (default in Ubuntu 16.04) and Glibc
v2.27 (default in Ubuntu 18.04). The exact version can be chosen by
specifying GLIBC_VERSION during Graphene build. The default version
to be built is v2.27.
Note that for the best GDB experience it is advised to build Graphene
with the same Glibc version as installed on the host OS.
vDSO is supported by Graphene now, so this commit removes the
modification of Glibc which disabled vDSO in Graphene. Currently,
compile-time option GLIBC_DISABLE_VDSO is introduced to be able
to revert to the old behaviour (disabled by default).
Previously, in-LibOS Glibc was patched to prefer fork()
over clone(!CLONE_VM) to spawn a new process. Now that
clone(!CLONE_VM) works correctly, this patch is not needed.
Thus, this Glibc patch is made optional.
Currently cp to Runtime dir is used. Sometimes it is confusing when
binaries are re-built under Pal or LibOS. Symlink is better, so use
it instead.
- It's easy to understand where a file under Runtime dir comes from
- It's easy to understand in which directory to run `make`
- If cp is used, it's quite easy to test old binary under Runtime.
This patch create ln_sf rule and use it instead of cp and applies to
other recipe with cp.
In this context, creating symlink of glibc libraries is mess. This
patch also cleans it up to use Makefile instead of embedding the logic
into python script.
Signed-off-by: Isaku Yamahata <isaku.yamahata@gmail.com>
When glibc patches are updated, glibc won't be re-build.
This patch adds patches and Makefile as dependencies of glibc so that
when patches or Makefile are updated, glibc will be re-build.
.packed directories are originally created for testing on non-Linux platforms. The usage is mostly obsolete right now, and the binaries are completely out-dated. A better strategy would be to create a hook in the github to release binary packages.
Run CI in a Docker image
* Wait a second for lighttp and apache to fully initialize the socket
* Try to add a timeout for lmbench, which is prone to hanging (vfork)
* Set a timeout on gcc; one of the PRs is causing gcc hello to hang. Also, to avoid interference, run apache test on 8001 by default.
* Update lmbench to ignore bin dir
* Do the faster tests first; fail earlier
* Get the IP addr properly for web server tests
* Some notes on flaky LTP tests to debug later. Move a few that tend to heisenbugs off of the required list for now
* Try to detect vma list corruption during the debug dump, lest it be infinite.
* Temporarily disable the lmbench vfork test (Issue #142).
* Catch some failures faster.
* Catch failures in apachebench
* Take apache out of the Linux host/Debug build CI for now, as it hangs consistently. Filed issue #144 to track.
Paweł Marczewski