The Design and Implementation of the Anykernel and Rump Kernels

176
stdin/stdout, the new file descriptor numbers always signify the host kernel. To
solve this conflict, we maintain a file descriptor aliasing table which keeps track of
cross-kernel dup2’s. There are a number of details involved, such as making sure that
closing the original fd does not close the dup2’d fd in the different kernel namespace,
and making sure we do not return a host descriptor with a value duplicate to one in
the dup2 space. In fact, a large portion of the code in the hijack library exists solely
to deal with complexities related to dup2. All of the complexity is fully contained
within the hijack and rumpclient libraries and it is not visible to applications using
the libraries.
Another issue we must address is protecting the file descriptors used by rumpclient.
Currently they include the communication socket file descriptor and the kqueue
descriptor which rumpclient uses for I/O multiplexing. Recall, the socket connection
between the remote client and the rump kernel associates the remote client with a
rump kernel process context, and if the connection is lost all process state such
as file descriptors are lost with it. In some scenarios applications want to close file
descriptors en masse. One example of such a scenario is when an application prepares
to call exec(). There are two approaches to mass closing: either calling close() in a
loop up to an arbitrary descriptor number or calling closefrom() (which essentially
calls fcntl(F_DUPFD)). Since the application never sees the rumpclient internal file
descriptors and hence should not close them, we take precautions to prevent it from
happening. The hijack library notifies rumpclient every time a descriptor is going
to be closed. There are two distinct cases:
• A call closes an individual host descriptor. In addition to the obvious close()
call, dup2() also belongs into this category. Here we inform rumpclient of a
descriptor being closed and in case it is a rumpclient descriptor, it is dup’d
to another value, after which the hijack library can proceed to invalidate the
file descriptor by calling close or dup2.