The Design and Implementation of the Anykernel and Rump Kernels

177
• The closefrom() routine closes all file descriptors equal to or greater than
the given descriptor number. We handle this operation in two stages. First,
we loop and call close() for all descriptors which are not internal to rumpclient.
After we reach the highest rumpclient internal descriptor we can
execute a host closefrom() using one greater than the highest rumpclient
descriptor as the argument. Next, we execute closefrom() for the rump
kernel, but this time we avoid closing any dup2’d file descriptors.
Finally, we must deal with asynchronous I/O calls that may have to call both kernels.
For example, in networking clients it is common to pass in one descriptor for the
client’s console and one descriptor for the network socket. Since we do not have a
priori knowledge of which kernel will have activity first, we must query both. This
simultaneous query is done by creating a thread to call the second kernel. Since
only one kernel is likely to produce activity, we also add one host kernel pipe and
one rump kernel pipe to the file descriptor sets being polled. After the operation
returns from one kernel, we write to the pipe of the other kernel to signal the end
of the operation, join the thread, collect the results, and return.
3.12.7 A Tale of Two Syscalls: fork() and execve()
The fork() and execve() system calls require extra consideration both on the client
side and the rump kernel side due to their special semantics. We must preserve those
semantics both for the client application and the rump kernel context. While these
operations are implemented in librumpclient, they are most relevant when running
hijacked clients. Many programs such as the OpenSSH [90] sshd or the mutt [83]
MUA fail to operate as remote rump clients if support is handled incorrectly.