|
| 1 | +/* SPDX-License-Identifier: LGPL-3.0-or-later */ |
| 2 | +/* Copyright (C) 2024 Intel Corporation |
| 3 | + |
| 4 | + */ |
| 5 | + |
| 6 | +/* |
| 7 | + * This file contains code for implementation of "timerfd" filesystem. For more information, see |
| 8 | + * `libos/src/sys/libos_timerfd.c`. |
| 9 | + */ |
| 10 | + |
| 11 | +#include "libos_fs.h" |
| 12 | +#include "libos_handle.h" |
| 13 | +#include "libos_internal.h" |
| 14 | +#include "libos_lock.h" |
| 15 | +#include "linux_abi/errors.h" |
| 16 | +#include "pal.h" |
| 17 | + |
| 18 | +/* Enforce a restriction that all timerfds created in the parent process are marked as invalid in |
| 19 | + * child processes, i.e. inter-process timing signals via timerfds are not allowed. This restriction |
| 20 | + * is because LibOS doesn't yet implement sync between timerfd objects. */ |
| 21 | +static int timerfd_checkin(struct libos_handle* hdl) { |
| 22 | + assert(hdl->type == TYPE_TIMERFD); |
| 23 | + hdl->info.timerfd.broken_in_child = true; |
| 24 | + return 0; |
| 25 | +} |
| 26 | + |
| 27 | +static void timerfd_dummy_host_read(struct libos_handle* hdl) { |
| 28 | + int ret; |
| 29 | + uint64_t buf_dummy_host_val = 0; |
| 30 | + size_t dummy_host_val_count = sizeof(buf_dummy_host_val); |
| 31 | + do { |
| 32 | + ret = PalStreamRead(hdl->pal_handle, /*offset=*/0, &dummy_host_val_count, |
| 33 | + &buf_dummy_host_val); |
| 34 | + } while (ret == -PAL_ERROR_INTERRUPTED); |
| 35 | + if (ret < 0 || dummy_host_val_count != sizeof(buf_dummy_host_val)) { |
| 36 | + /* must not happen in benign case, consider it an attack and panic */ |
| 37 | + BUG(); |
| 38 | + } |
| 39 | +} |
| 40 | + |
| 41 | +static void timerfd_dummy_host_wait(struct libos_handle* hdl) { |
| 42 | + pal_wait_flags_t wait_for_events = PAL_WAIT_READ; |
| 43 | + pal_wait_flags_t ret_events = 0; |
| 44 | + int ret = PalStreamsWaitEvents(1, &hdl->pal_handle, &wait_for_events, &ret_events, NULL); |
| 45 | + if (ret < 0 && ret != -PAL_ERROR_INTERRUPTED) { |
| 46 | + BUG(); |
| 47 | + } |
| 48 | + (void)ret_events; /* we don't care what events the host returned, we can't trust them anyway */ |
| 49 | +} |
| 50 | + |
| 51 | +static ssize_t timerfd_read(struct libos_handle* hdl, void* buf, size_t count, file_off_t* pos) { |
| 52 | + __UNUSED(pos); |
| 53 | + assert(hdl->type == TYPE_TIMERFD); |
| 54 | + |
| 55 | + if (count < sizeof(uint64_t)) |
| 56 | + return -EINVAL; |
| 57 | + |
| 58 | + if (hdl->info.timerfd.broken_in_child) { |
| 59 | + log_warning("Child process tried to access timerfd created by parent process. This is " |
| 60 | + "disallowed in Gramine."); |
| 61 | + return -EIO; |
| 62 | + } |
| 63 | + |
| 64 | + int ret; |
| 65 | + spinlock_lock(&hdl->info.timerfd.expiration_lock); |
| 66 | + |
| 67 | + while (!hdl->info.timerfd.num_expirations) { |
| 68 | + if (hdl->flags & O_NONBLOCK) { |
| 69 | + ret = -EAGAIN; |
| 70 | + goto out; |
| 71 | + } |
| 72 | + spinlock_unlock(&hdl->info.timerfd.expiration_lock); |
| 73 | + timerfd_dummy_host_wait(hdl); |
| 74 | + spinlock_lock(&hdl->info.timerfd.expiration_lock); |
| 75 | + } |
| 76 | + |
| 77 | + memcpy(buf, &hdl->info.timerfd.num_expirations, sizeof(uint64_t)); |
| 78 | + hdl->info.timerfd.num_expirations = 0; |
| 79 | + |
| 80 | + /* perform a read (not supposed to block) to clear the event from polling threads and to send an |
| 81 | + * event to writing threads */ |
| 82 | + if (hdl->info.timerfd.dummy_host_val) { |
| 83 | + timerfd_dummy_host_read(hdl); |
| 84 | + hdl->info.timerfd.dummy_host_val = 0; |
| 85 | + } |
| 86 | + |
| 87 | + ret = (ssize_t)count; |
| 88 | +out: |
| 89 | + spinlock_unlock(&hdl->info.timerfd.expiration_lock); |
| 90 | + maybe_epoll_et_trigger(hdl, ret, /*in=*/true, /*unused was_partial=*/false); |
| 91 | + return ret; |
| 92 | +} |
| 93 | + |
| 94 | +static void timerfd_post_poll(struct libos_handle* hdl, pal_wait_flags_t* pal_ret_events) { |
| 95 | + assert(hdl->type == TYPE_TIMERFD); |
| 96 | + |
| 97 | + if (hdl->info.timerfd.broken_in_child) { |
| 98 | + log_warning("Child process tried to access timerfd created by parent process. This is " |
| 99 | + "disallowed in Gramine."); |
| 100 | + *pal_ret_events = PAL_WAIT_ERROR; |
| 101 | + return; |
| 102 | + } |
| 103 | + |
| 104 | + if (*pal_ret_events & (PAL_WAIT_ERROR | PAL_WAIT_HANG_UP | PAL_WAIT_WRITE)) { |
| 105 | + /* impossible: we control timerfd inside the LibOS, and we never raise such conditions */ |
| 106 | + BUG(); |
| 107 | + } |
| 108 | + |
| 109 | + spinlock_lock(&hdl->info.timerfd.expiration_lock); |
| 110 | + if (*pal_ret_events & PAL_WAIT_READ) { |
| 111 | + /* there is data to read: verify if timerfd has number of expirations greater than zero */ |
| 112 | + if (!hdl->info.timerfd.num_expirations) { |
| 113 | + /* spurious or malicious notification, can legitimately happen if another thread |
| 114 | + * consumed this event between this thread's poll wakeup and the post_poll callback; |
| 115 | + * we currently choose to return a spurious notification to the user */ |
| 116 | + *pal_ret_events &= ~PAL_WAIT_READ; |
| 117 | + } |
| 118 | + } |
| 119 | + spinlock_unlock(&hdl->info.timerfd.expiration_lock); |
| 120 | +} |
| 121 | + |
| 122 | +struct libos_fs_ops timerfd_fs_ops = { |
| 123 | + .checkin = &timerfd_checkin, |
| 124 | + .read = &timerfd_read, |
| 125 | + .post_poll = &timerfd_post_poll, |
| 126 | +}; |
| 127 | + |
| 128 | +struct libos_fs timerfd_builtin_fs = { |
| 129 | + .name = "timerfd", |
| 130 | + .fs_ops = &timerfd_fs_ops, |
| 131 | +}; |
0 commit comments