mirror of
https://github.com/clearlinux/graphene.git
synced 2026-08-28 13:25:43 +00:00
borysp
c24bddd5aa
Change log (most important only):
- unify CPU context structures - now we have only one version -
`PAL_CONTEXT` - which is shared between LibOS and PALs and it should
depend only on the host architecture (not OS),
- syscalls emulation changed:
- dedicated LibOS stack is now used for syscalls emulation,
- removed one indirection level in syscalls table - now it stores
`shim_do_*` functions directly,
- signal handling - completely rewritten:
- all signal queues use proper locking schemes now,
- signals are handled *only* when returning to the user app from LibOS
or PAL,
- nested signals are now possible,
- the app is allowed to jump out of signal handler with the same
sematics as on normal Linux,
- signal altstack is now fully supported,
- syscall restarting is now supported,
- doing a backtrace from the signal handler works properly,
- disallow injecting host-level signals, with one exception, see
`sys.enable_sigterm_injection` manifest option for more details.
# Redis This directory contains the Makefile and the template manifest for the most recent version of Redis (as of this writing, version 5.0.5). This was tested on a machine with SGX v1 and Ubuntu 16.04. The Makefile and the template manifest contain extensive comments and are made self-explanatory. Please review them to gain understanding of Graphene-SGX and requirements for applications running under Graphene-SGX. # Quick Start ```sh # build Redis and the final manifest make SGX=1 # run original Redis against a benchmark (redis-benchmark supplied with Redis) ./redis-server --save '' --protected-mode no & src/src/redis-benchmark kill %% # run Redis in non-SGX Graphene against a benchmark ./pal_loader redis-server --save '' --protected-mode no & src/src/redis-benchmark kill %% # run Redis in Graphene-SGX against a benchmark SGX=1 ./pal_loader redis-server --save '' --protected-mode no & src/src/redis-benchmark kill %% ``` # Why this Redis configuration? Notice that we run Redis with two parameters: `save ''` and `protected-mode no`: - `save ''` disables saving DB to disk (both RDB snapshots and AOF logs). We use this parameter to side-step some bugs in Graphene triggered during the graceful shutdown of Redis. - `protected-mode no` allows clients to connect to Redis on any network interface. Even though we use the loopback interface (which is always allowed in Redis), Graphene hides this information. Therefore, we ask Redis to allow clients on all interfaces. # Redis with Select By default, Redis uses the epoll mechanism of Linux to monitor client connections. To test Redis with select, add `USE_SELECT=1`, e.g., `make SGX=1 USE_SELECT=1`.