From a3ad465ce3a8977d541b2e9d507369b4afd57187 Mon Sep 17 00:00:00 2001
From: "Tate, Hongliang Tian" <tate.thl@antfin.com>
Date: Sat, 11 Jul 2020 14:15:39 +0000
Subject: [PATCH] Fix SGX simulation mode broken by the interrupt subsystem

The new interrupt subsystem breaks the simulation mode in two ways:

1. The signal 64 is not handled by Intel SGX SDK in simulation mode. A
handled real-time signal crashes the process.

2. The newly-enabled test case exit_group depends on interrupts. But
enclave interrupts, like enclave exceptions, are not supported in
simulation mode.

This commit ensures signal 64 is ignored by default and exit_group test
case is not enabled in simulation mode.
---
 src/pal/src/pal_api.c         |  5 +++++
 src/pal/src/pal_sig_handler.c | 19 +++++++++++++++++++
 src/pal/src/pal_sig_handler.h | 15 +++++++++++++++
 test/exit_group/main.c        |  6 ++++++
 4 files changed, 45 insertions(+)
 create mode 100644 src/pal/src/pal_sig_handler.c
 create mode 100644 src/pal/src/pal_sig_handler.h

diff --git a/src/pal/src/pal_api.c b/src/pal/src/pal_api.c
index 11f6f483..3863c87b 100644
--- a/src/pal/src/pal_api.c
+++ b/src/pal/src/pal_api.c
@@ -4,6 +4,7 @@
 #include "pal_error.h"
 #include "pal_interrupt_thread.h"
 #include "pal_log.h"
+#include "pal_sig_handler.h"
 #include "pal_syscall.h"
 #include "pal_thread_counter.h"
 #include "errno2str.h"
@@ -29,6 +30,10 @@ int occlum_pal_init(const struct occlum_pal_attr *attr) {
         return -1;
     }
 
+    if (pal_register_sig_handlers() < 0) {
+        return -1;
+    }
+
     if (pal_init_enclave(attr->instance_dir) < 0) {
         return -1;
     }
diff --git a/src/pal/src/pal_sig_handler.c b/src/pal/src/pal_sig_handler.c
new file mode 100644
index 00000000..995c6b37
--- /dev/null
+++ b/src/pal/src/pal_sig_handler.c
@@ -0,0 +1,19 @@
+#include "pal_sig_handler.h"
+#include "pal_log.h"
+#include <signal.h>
+#include <string.h>
+
+// Signal 64 is used to notify interrupts
+#define SIGRT_INTERRUPT     64
+
+int pal_register_sig_handlers(void) {
+    struct sigaction action;
+    action.sa_handler = SIG_IGN;
+    memset(&action.sa_mask, 0, sizeof(action.sa_mask));
+    action.sa_flags = 0;
+    if (sigaction(SIGRT_INTERRUPT, &action, NULL) < 0) {
+        PAL_ERROR("Failed to regiter signal handlers");
+        return -1;
+    }
+    return 0;
+}
diff --git a/src/pal/src/pal_sig_handler.h b/src/pal/src/pal_sig_handler.h
new file mode 100644
index 00000000..1cedc481
--- /dev/null
+++ b/src/pal/src/pal_sig_handler.h
@@ -0,0 +1,15 @@
+#ifndef __PAL_SIG_HANDLER_H__
+#define __PAL_SIG_HANDLER_H__
+
+// Register signal handlers for PAL.
+//
+// Currently, there is only one signal number that needs to be covered: signal
+// 64, which is used to notify interrupts (see LibOS code for more info). For
+// a hardware-mode enclave, the signal is handled by the signal handlers
+// registered by Intel SGX SDK. So we are ok in this case. But for a
+// simulation-mode enclave, there is no signal handler registered by Intel SGX
+// SDK. Without a signal handler, the delivery of the signal will kill the
+// process. This crash can be prevented by this API.
+int pal_register_sig_handlers(void);
+
+#endif /* __PAL_SIG_HANDLER_H__ */
diff --git a/test/exit_group/main.c b/test/exit_group/main.c
index 4402d601..ada7cf01 100644
--- a/test/exit_group/main.c
+++ b/test/exit_group/main.c
@@ -38,6 +38,11 @@ static void *futex_wait_thread_func(void *_) {
 
 // exit_group syscall should terminate all threads in a thread group.
 int test_exit_group_to_force_threads_terminate(void) {
+#ifdef SGX_MODE_SIM
+    printf("WARNING: Skip this test case as we do not support "
+           "enclave interruption in SGX simulation mode\n");
+    return 0;
+#else
     // Create three types of threads that will not exit voluntarily
     pthread_t busyloop_thread;
     if (pthread_create(&busyloop_thread, NULL, busyloop_thread_func, NULL) < 0) {
@@ -63,6 +68,7 @@ int test_exit_group_to_force_threads_terminate(void) {
     // main function returns. If Occlum can terminate normally, this means
     // exit_group syscall taking effect.
     return 0;
+#endif
 }
 
 // ============================================================================