From 35937b7f619cbdbea9aba4d5e561d2d305ae2101 Mon Sep 17 00:00:00 2001 From: Konstantin Bogomolov Date: Fri, 3 Mar 2023 09:55:30 -0800 Subject: [PATCH] Add context decoupling flag. This is a quick and dirty way to activate context decoupling related changes. Will be removed once context decoupling is finalized. PiperOrigin-RevId: 513854004 --- pkg/sentry/platform/systrap/BUILD | 2 ++ .../systrap/context_decoupling_disable.go | 20 ++++++++++++++ .../systrap/context_decoupling_enable.go | 27 +++++++++++++++++++ pkg/sentry/platform/systrap/stub_unsafe.go | 6 ++++- pkg/sentry/platform/systrap/sysmsg/sysmsg.h | 1 + .../platform/systrap/sysmsg/sysmsg_lib.c | 1 + pkg/sentry/platform/systrap/systrap.go | 2 +- 7 files changed, 57 insertions(+), 2 deletions(-) create mode 100644 pkg/sentry/platform/systrap/context_decoupling_disable.go create mode 100644 pkg/sentry/platform/systrap/context_decoupling_enable.go diff --git a/pkg/sentry/platform/systrap/BUILD b/pkg/sentry/platform/systrap/BUILD index de0d70921..00ceb2605 100644 --- a/pkg/sentry/platform/systrap/BUILD +++ b/pkg/sentry/platform/systrap/BUILD @@ -21,6 +21,8 @@ go_template_instance( go_library( name = "systrap", srcs = [ + "context_decoupling_disable.go", + "context_decoupling_enable.go", "filters.go", "filters_amd64.go", "filters_arm64.go", diff --git a/pkg/sentry/platform/systrap/context_decoupling_disable.go b/pkg/sentry/platform/systrap/context_decoupling_disable.go new file mode 100644 index 000000000..51371fa8d --- /dev/null +++ b/pkg/sentry/platform/systrap/context_decoupling_disable.go @@ -0,0 +1,20 @@ +// Copyright 2023 The gVisor Authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +//go:build !context_decoupling +// +build !context_decoupling + +package systrap + +var contextDecouplingExp bool = false diff --git a/pkg/sentry/platform/systrap/context_decoupling_enable.go b/pkg/sentry/platform/systrap/context_decoupling_enable.go new file mode 100644 index 000000000..ab4ab8ae5 --- /dev/null +++ b/pkg/sentry/platform/systrap/context_decoupling_enable.go @@ -0,0 +1,27 @@ +// Copyright 2023 The gVisor Authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +//go:build context_decoupling +// +build context_decoupling + +package systrap + +// contextDecouplingExp is a global flag that enables thread decoupling mode. +// In this mode thread contexts are able to migrate between systrap user +// process threads. This also allows and enables the following experimental +// optimizations: +// - Ability to run M contexts using N threads, where M > N. +// - Reduce synchronization overhead between sentry threads and user +// threads when switching contexts in and out of the sentry. +var contextDecouplingExp bool = true diff --git a/pkg/sentry/platform/systrap/stub_unsafe.go b/pkg/sentry/platform/systrap/stub_unsafe.go index 922f56ebf..0780baaa8 100644 --- a/pkg/sentry/platform/systrap/stub_unsafe.go +++ b/pkg/sentry/platform/systrap/stub_unsafe.go @@ -199,6 +199,10 @@ func stubInit() { *p = handshakeTimeout archState := (*sysmsg.ArchState)(unsafe.Pointer(stubSysmsgStart + uintptr(sysmsg.Sighandler_blob_offset____export_arch_state))) archState.Init() + exp := (*uint64)(unsafe.Pointer(stubSysmsgStart + uintptr(sysmsg.Sighandler_blob_offset____export_context_decoupling_exp))) + if contextDecouplingExp { + *exp = 1 + } prepareSeccompRules(stubSysmsgStart, stubSysmsgRules, stubSysmsgRulesLen) @@ -215,5 +219,5 @@ func stubInit() { stubEnd = stubStart + mapLen + uintptr(gap) log.Debugf("stubStart %x stubSysmsgStart %x stubSysmsgStack %x, mapLen %x", stubStart, stubSysmsgStart, stubSysmsgStack, mapLen) log.Debugf(archState.String()) - + log.Debugf("contextDecouplingExp=%t", contextDecouplingExp) } diff --git a/pkg/sentry/platform/systrap/sysmsg/sysmsg.h b/pkg/sentry/platform/systrap/sysmsg/sysmsg.h index ae5c4f8ca..6a0c91206 100644 --- a/pkg/sentry/platform/systrap/sysmsg/sysmsg.h +++ b/pkg/sentry/platform/systrap/sysmsg/sysmsg.h @@ -93,6 +93,7 @@ struct sysmsg { extern uint64_t __export_pr_sched_core; extern uint64_t __export_deep_sleep_timeout; extern struct arch_state __export_arch_state; +extern uint64_t __export_context_decoupling_exp; // NOLINTBEGIN(runtime/int) static void *sysmsg_sp() { diff --git a/pkg/sentry/platform/systrap/sysmsg/sysmsg_lib.c b/pkg/sentry/platform/systrap/sysmsg/sysmsg_lib.c index 4ce72f6f7..80ff12de3 100644 --- a/pkg/sentry/platform/systrap/sysmsg/sysmsg_lib.c +++ b/pkg/sentry/platform/systrap/sysmsg/sysmsg_lib.c @@ -28,6 +28,7 @@ uint64_t __export_deep_sleep_timeout; uint64_t __export_handshake_timeout; struct arch_state __export_arch_state; +uint64_t __export_context_decoupling_exp; // A per-thread memory region is always align to STACK_SIZE. // *------------* diff --git a/pkg/sentry/platform/systrap/systrap.go b/pkg/sentry/platform/systrap/systrap.go index c40cf21c0..055c07264 100644 --- a/pkg/sentry/platform/systrap/systrap.go +++ b/pkg/sentry/platform/systrap/systrap.go @@ -374,7 +374,7 @@ func (*constructor) OpenDevice(_ string) (*os.File, error) { return nil, nil } -// Flags implements platform.Constructor.Flags(). +// Requirements implements platform.Constructor.Requirements(). func (*constructor) Requirements() platform.Requirements { // TODO(b/75837838): Also set a new PID namespace so that we limit // access to other host processes.