Closed JorelHan closed 2 years ago
Please note that prior to Icelake server, Intel SGX had only ~100MB of physical enclave cache size (EPC size). So if you have an older/weaker CPU, then SGX enclaves will exhibit very poor performance on memory-intensive workloads like MySQL.
What is the output of is-sgx-available
(this is a tool of Gramine that show SGX-relevant info)?
How does you manifest file for MySQL look like? The error that you observe (The table 'sbtest' is full
) looks like there is not enough enclave and/or stack memory allocated. Please try to increase enclave memory via sgx.enclave_size
and stack memory via sys.stack.size
.
Thank you for your reply! We set sgx.enclave_size = 8G, sgx.thread.num=1024. When set sys.stack.size = 12M, worker threads failed to initialize within 30 seconds. I don't know how to look at Gramine version. view the version of Gramine if have the command, pls tell me. Thanks!
Below is the information I collected.
is-sgx-available output:
SGX supported by CPU: true
SGX1 (ECREATE, EENTER, ...): true
SGX2 (EAUG, EACCEPT, EMODPR, ...): true
Flexible Launch Control (IA32_SGXPUBKEYHASH{0..3} MSRs): true
SGX extensions for virtualizers (EINCVIRTCHILD, EDECVIRTCHILD, ESETCONTEXT): true
Extensions for concurrent memory management (ETRACKC, ELDBC, ELDUC, ERDINFO): true
CET enclave attributes support (See Table 37-5 in the SDM): false
Key separation and sharing (KSS) support (CONFIGID, CONFIGSVN, ISVEXTPRODID, ISVFAMILYID report fields): true
Max enclave size (32-bit): 0x80000000
Max enclave size (64-bit): 0x100000000000000
EPC size: 0x1fcf800000
SGX driver loaded: true
AESMD installed: false
SGX PSW/libsgx installed: false
entrypoint --version
GNU bash, version 5.0.17(1)-release (x86_64-pc-linux-gnu)
Copyright (C) 2019 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software; you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
Docker images information is as follows:
[
{
"Id": "sha256:6158c778e53835b38c3dca7a21d29c9914d753ea746fd600ee3d610fcb970f68",
"RepoTags": [
"gar-registry.caas.intel.com/cpio/gsc-ubuntu18.04-mysql:latest"
],
"Created": "2021-12-14T09:34:59.392410222Z",
"Container": "e28a742661a847ba8b3f0f6550cdb2b8cb07f14f1761ba053b5f759d6a171a76",
"ContainerConfig": {
"Hostname": "e28a742661a8",
"Domainname": "",
"User": "",
"AttachStdin": false,
"AttachStdout": false,
"AttachStderr": false,
"ExposedPorts": {
"3306/tcp": {},
"33060/tcp": {}
},
"Tty": false,
"OpenStdin": false,
"StdinOnce": false,
"Env": [
"PATH=/gramine/meson_build_output/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
"PYTHONPATH=:/gramine/meson_build_output/lib/python3.8/site-packages",
"GSC=2"
],
"Cmd": [
"/bin/sh",
"-c",
"#(nop) ",
"ENTRYPOINT [\"./apploader.sh\"]"
],
"Image": "sha256:4c0df41d9e706f1049acf8989dc39e4f9d8579cb339857cc18991199c4538099",
"Volumes": {
"/var/lib/mysql": {}
},
"WorkingDir": "",
"Entrypoint": [
"./apploader.sh"
],
"OnBuild": null,
"Labels": {}
},
"DockerVersion": "20.10.8",
"Author": "",
"Config": {
"Hostname": "",
"Domainname": "",
"User": "",
"AttachStdin": false,
"AttachStdout": false,
"AttachStderr": false,
"ExposedPorts": {
"3306/tcp": {},
"33060/tcp": {}
},
"Tty": false,
"OpenStdin": false,
"StdinOnce": false,
"Env": [
"PATH=/gramine/meson_build_output/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
"PYTHONPATH=:/gramine/meson_build_output/lib/python3.8/site-packages",
"GSC=2"
],
"Cmd": null,
"Image": "sha256:4c0df41d9e706f1049acf8989dc39e4f9d8579cb339857cc18991199c4538099",
"Volumes": {
"/var/lib/mysql": {}
},
"WorkingDir": "",
"Entrypoint": [
"./apploader.sh"
],
"OnBuild": null,
"Labels": null
},
"Architecture": "amd64",
"Os": "linux",
"Size": 1084894048,
"VirtualSize": 1084894048,
"Metadata": {
"LastTagTime": "2021-12-30T15:04:25.608575254+08:00"
}
}
]
I don't know how to look at Gramine version. view the version of Gramine if have the command, pls tell me. Thanks!
It looks like you're using GSC to build graminized Docker images. What are the contents of config.yaml
in your GSC?
Since you're using GSC, please add -d
to the gsc build
command (see https://gramine.readthedocs.io/projects/gsc/en/latest/#cmdoption-gsc-build-d).
This will enable the debug logs, which will give you more information to analyze.
This mirror image is not made by me. What information I need to provide you to better help you judge the problem.
You need to ask a person who generated this GSC Docker image to re-generate it with -d
. And you need to analyze the resulting Gramine logs to figure out the root cause.
@dimakuv assign this one to me pls
i was able to build and run mysql with GSC, however i ran into an issue of running scripts from Gramine thats not supported today (i'm working on getting this added now). Below is procedure to get to a state where I am at now.
create a base image using the below docker file.
From mysql:latest
ENTRYPOINT ["/bin/bash", "/usr/local/bin/docker-entrypoint.sh"]
and then create a GSC build (refer to the GSC documentation). After creation of a successful GSC image, run as below
docker run --device=/dev/sgx_enclave <gsc-build-name> "mysqld"
submitted https://github.com/gramineproject/gramine/pull/459 to add support for executing scripts. Now the mysql server starts, but exits after the below output. Looking into this further now
2022-03-15 06:49:17+00:00 [Note] [Entrypoint]: Entrypoint script for MySQL Server 8.0.28-1debian10 started. 2022-03-15 06:49:24+00:00 [Note] [Entrypoint]: Switching to dedicated user 'mysql'
Hi anees and dimakuv, I tried to run mysql in gramine 1.1 and also met similar errors. I didn't use gsc or a docker image. Here are the steps to reproduce: OS: ubuntu20.04 Kernel:5.11
apt-get install mysql-server
comment log in /etc/mysql/mysql.conf.d/mysqld.cnf to see the logs on console:
#log_error = /var/log/mysql/error.log
systemctl stop mysql.service
;
mkdir /var/run/mysqld && chown -R mysql:mysql /var/run/mysqld
mkdir /tmp/mysql && chown -R mysql:mysql /tmp/mysql
add the following 2 lines to /etc/apparmor.d/usr.sbin.mysqld:
/tmp/mysql r,
/tmp/mysql/** rwk,
and restart apparmor:
service apparmor restart
mysqld --initialize-insecure --user=mysql --datadir=/tmp/mysql
rm /tmp/mysql/undo*
cd gramine/CI-Examples/mysql
make
gramine-direct mysql --datadir /tmp/mysql
Then mysql would output:
2022-03-24T16:40:46.284335Z 0 [System] [MY-013169] [Server] /usr/sbin/mysqld (mysqld 8.0.28-0ubuntu0.20.04.3) initializing of server in progress as process 207406
2022-03-24T16:40:46.296736Z 1 [System] [MY-013576] [InnoDB] InnoDB initialization has started.
2022-03-24T16:40:46.832322Z 1 [System] [MY-013577] [InnoDB] InnoDB initialization has ended.
2022-03-24T16:40:48.288941Z 6 [Warning] [MY-010453] [Server] root@localhost is created with an empty password ! Please consider switching off the --initialize-insecure option.
2022-03-24T16:40:51.268092Z 0 [Warning] [MY-010939] [Server] Failed to get absolute path of program executable mysql
2022-03-24T16:41:57.832530Z 0 [System] [MY-010116] [Server] mysql (mysqld 8.0.28-0ubuntu0.20.04.3) starting as process 1
2022-03-24T16:41:57.840972Z 1 [System] [MY-013576] [InnoDB] InnoDB initialization has started.
2022-03-24T16:41:57.854539Z 1 [ERROR] [MY-012585] [InnoDB] Linux Native AIO interface is not supported on this platform. Please check your OS documentation and install appropriate binary of InnoDB.
2022-03-24T16:41:57.854626Z 1 [Warning] [MY-012654] [InnoDB] Linux Native AIO disabled.
2022-03-24T16:41:58.158630Z 1 [Warning] [MY-012128] [InnoDB] posix_fallocate(): Failed to preallocate data for file ./#innodb_temp/temp_1.ibt, desired size 81920 Operating system error number 38 - Function not implemented. Check that the disk is not full or a disk quota exceeded. Make sure the file system supports this function. Refer to your operating system documentation for operating system error code information.
2022-03-24T16:41:58.160318Z 1 [Warning] [MY-012579] [InnoDB] fallocate(14, FALLOC_FL_PUNCH_HOLE | FALLOC_FL_KEEP_SIZE, 0, 16384) returned errno: 38
2022-03-24T16:41:58.161658Z 1 [Warning] [MY-012128] [InnoDB] posix_fallocate(): Failed to preallocate data for file ./#innodb_temp/temp_2.ibt, desired size 81920 Operating system error number 38 - Function not implemented. Check that the disk is not full or a disk quota exceeded. Make sure the file system supports this function. Refer to your operating system documentation for operating system error code information.
...
2022-03-24T16:41:58.481722Z 2 [ERROR] [MY-012144] [InnoDB] posix_fallocate(): Failed to preallocate data for file ./#innodb_temp/temp_10.ibt, desired size 16384 bytes. Operating system error number 38. Check that the disk is not full or a disk quota exceeded. Make sure the file system supports this function. Refer to your operating system documentation for operating system error code information.
...
2022-03-24T16:41:58.639969Z 0 [Warning] [MY-010068] [Server] CA certificate ca.pem is self signed.
2022-03-24T16:41:58.640069Z 0 [System] [MY-013602] [Server] Channel mysql_main configured to support TLS. Encrypted connections are now supported for this channel.
2022-03-24T16:41:58.640953Z 0 [Warning] [MY-011810] [Server] Insecure configuration for --pid-file: Location '/tmp' in the path is accessible to all OS users. Consider choosing a different directory.
2022-03-24T16:41:58.673889Z 0 [System] [MY-011323] [Server] X Plugin ready for connections. Bind-address: '127.0.0.1' port: 33060, socket: /var/run/mysqld/mysqlx.sock
2022-03-24T16:41:58.674405Z 0 [System] [MY-010931] [Server] mysql: ready for connections. Version: '8.0.28-0ubuntu0.20.04.3' socket: '/var/run/mysqld/mysqld.sock' port: 3306 (Ubuntu).
mysqladmin -h 127.0.0.1 -P 3306 create sbtest;
apt-get install sysbench
sysbench --db-driver=mysql --mysql-host=127.0.0.1 --mysql-port=3306 --mysql-user=root --mysql-db=sbtest /usr/share/sysbench/oltp_common.lua --tables=10 --table_size=100000 prepare
sysbench --db-driver=mysql --mysql-host=127.0.0.1 --mysql-port=3306 --mysql-user=root --mysql-db=sbtest --threads=4 --time=20 --report-interval=5 /usr/share/sysbench/oltp_read_write.lua --tables=10 --table_size=100000 run
Then mysql would output errors and abort:
...
2022-03-24T16:12:54.502268Z 9 [ERROR] [MY-012144] [InnoDB] posix_fallocate(): Failed to preallocate data for file ./sbtest/sbtest7.ibd, desired size 16384 bytes. Operating system error number 38. Check that the disk is not full or a disk quota exceeded. Make sure the file system supports this function. Refer to your operating system documentation for operating system error code information.
2022-03-24T16:12:54.504173Z 9 [ERROR] [MY-012144] [InnoDB] posix_fallocate(): Failed to preallocate data for file ./sbtest/sbtest7.ibd, desired size 16384 bytes. Operating system error number 38. Check that the disk is not full or a disk quota exceeded. Make sure the file system supports this function. Refer to your operating system documentation for operating system error code information.
2022-03-24T16:12:54.506305Z 9 [ERROR] [MY-012144] [InnoDB] posix_fallocate(): Failed to preallocate data for file ./sbtest/sbtest7.ibd, desired size 16384 bytes. Operating system error number 38. Check that the disk is not full or a disk quota exceeded. Make sure the file system supports this function. Refer to your operating system documentation for operating system error code information.
2022-03-24T16:12:54.508279Z 9 [ERROR] [MY-012144] [InnoDB] posix_fallocate(): Failed to preallocate data for file ./sbtest/sbtest7.ibd, desired size 16384 bytes. Operating system error number 38. Check that the disk is not full or a disk quota exceeded. Make sure the file system supports this function. Refer to your operating system documentation for operating system error code information.
mysql(my_print_stacktrace(unsigned char const*, unsigned long)+0x41) [0x674965a56e91]
mysql(print_fatal_signal(int)+0x2fb) [0x6749648e332b]
mysql(handle_fatal_signal+0xa5) [0x6749648e33e5]
/lib/libc.so.6(+0x41b40) [0x67496292db40]
mysql(+0x2658040) [0x674965e08040]
mysql(+0x265eefc) [0x674965e0eefc]
mysql(dict_stats_update(dict_table_t*, dict_stats_upd_option_t)+0xf07) [0x674965e11bd7]
mysql(dict_stats_thread()+0xab2) [0x674965e13b32]
mysql(std::thread::_State_impl<std::thread::_Invoker<std::tuple<Detached_thread, void (*)()> > >::_M_run()+0xbc) [0x674965b5e29c]
/usr//lib/x86_64-linux-gnu/libstdc++.so.6(+0xd6de4) [0x674962cb4de4]
/lib/libc.so.6(+0x8b907) [0x674962977907]
/lib/libc.so.6(clone+0x51) [0x6749629f92e1]
Trying to get some variables. Some pointers may be invalid and cause the dump to abort. Query (0): is an invalid pointer Connection ID (thread ID): 0 Status: NOT_KILLED
The manual page at http://dev.mysql.com/doc/mysql/en/crashing.html contains information that should help you find out what is causing the crash.
@qqing-li - could you share the manifest file that you used
@qqing-li - could you share the manifest file that you used
Already attached a zip file in step 5. Can you download it?
i'm able to get it working further ahead
intel@intel-M50CYP2SB2U:~/aneessahib/gramine/CI-Examples/bash$ gramine-direct bash -c "/usr/sbin/mysqld --datadir /tmp/mysql1" 2022-03-31T09:04:19.454128Z 0 [Warning] TIMESTAMP with implicit DEFAULT value is deprecated. Please use --explicit_defaults_for_timestamp server option (see documentation for more details). 2022-03-31T09:04:19.455677Z 0 [Note] /usr/sbin/mysqld (mysqld 5.7.37-0ubuntu0.18.04.1) starting as process 1 ... 2022-03-31T09:04:19.455751Z 0 [ERROR] Can't find error-message file '/usr/share/mysql/errmsg.sys'. Check error-message file location and 'lc-messages-dir' configuration directive. 2022-03-31T09:04:19.459442Z 0 [Note] InnoDB: PUNCH HOLE support available 2022-03-31T09:04:19.459470Z 0 [Note] InnoDB: Mutexes and rw_locks use GCC atomic builtins 2022-03-31T09:04:19.459474Z 0 [Note] InnoDB: Uses event mutexes 2022-03-31T09:04:19.459479Z 0 [Note] InnoDB: GCC builtin __atomic_thread_fence() is used for memory barrier 2022-03-31T09:04:19.459482Z 0 [Note] InnoDB: Compressed tables use zlib 1.2.11 2022-03-31T09:04:19.459487Z 0 [Note] InnoDB: Using Linux native AIO 2022-03-31T09:04:19.459671Z 0 [Note] InnoDB: Number of pools: 1 2022-03-31T09:04:19.459747Z 0 [Note] InnoDB: Using CPU crc32 instructions Emulating a raw system/supervisor call. This degrades performance, consider patching your application to use Gramine syscall API. 2022-03-31T09:04:19.460140Z 0 [ERROR] InnoDB: Linux Native AIO interface is not supported on this platform. Please check your OS documentation and install appropriate binary of InnoDB. 2022-03-31T09:04:19.460148Z 0 [Note] InnoDB: You can disable Linux Native AIO by setting innodb_use_native_aio = 0 in my.cnf 2022-03-31T09:04:19.460152Z 0 [Warning] InnoDB: Linux Native AIO disabled. 2022-03-31T09:04:19.460861Z 0 [Note] InnoDB: Initializing buffer pool, total size = 128M, instances = 1, chunk size = 128M 2022-03-31T09:04:19.466472Z 0 [Note] InnoDB: Completed initialization of buffer pool 2022-03-31T09:04:19.471938Z 0 [Note] InnoDB: If the mysqld execution user is authorized, page cleaner thread priority can be changed. See the man page of setpriority(). 2022-03-31T09:04:19.483653Z 0 [Note] InnoDB: Highest supported file format is Barracuda. 2022-03-31T09:04:19.492634Z 0 [Note] InnoDB: Creating shared tablespace for temporary tables 2022-03-31T09:04:19.492684Z 0 [Note] InnoDB: Setting file './ibtmp1' size to 12 MB. Physically writing the file full; Please wait ... 2022-03-31T09:04:19.550791Z 0 [Note] InnoDB: File './ibtmp1' size is now 12 MB. 2022-03-31T09:04:19.551614Z 0 [Note] InnoDB: 96 redo rollback segment(s) found. 96 redo rollback segment(s) are active. 2022-03-31T09:04:19.551628Z 0 [Note] InnoDB: 32 non-redo rollback segment(s) are active. 2022-03-31T09:04:19.555056Z 0 [Note] InnoDB: 5.7.37 started; log sequence number 2750229 2022-03-31T09:04:19.555614Z 0 [Note] InnoDB: Loading buffer pool(s) from /tmp/mysql1/ib_buffer_pool 2022-03-31T09:04:19.557091Z 0 [Note] Plugin 'FEDERATED' is disabled. 2022-03-31T09:04:19.560011Z 0 [Note] InnoDB: Buffer pool(s) load completed at 220331 14:34:19 2022-03-31T09:04:19.566594Z 0 [Note] Found ca.pem, server-cert.pem and server-key.pem in data directory. Trying to enable SSL support using them. 2022-03-31T09:04:19.566624Z 0 [Note] Skipping generation of SSL certificates as certificate files are present in data directory. 2022-03-31T09:04:19.566636Z 0 [Warning] 2022-03-31T09:04:19.566645Z 0 [Warning] 2022-03-31T09:04:19.567525Z 0 [Warning] CA certificate ca.pem is self signed. 2022-03-31T09:04:19.567581Z 0 [Note] Skipping generation of RSA key pair as key files are present in data directory. 2022-03-31T09:04:19.567720Z 0 [Note] Server hostname (bind-address): '127.0.0.1'; port: 3306 2022-03-31T09:04:19.567748Z 0 [Note] - '127.0.0.1' resolves to '127.0.0.1'; 2022-03-31T09:04:19.567767Z 0 [Note] Server socket created on IP: '127.0.0.1'. 2022-03-31T09:04:19.585401Z 0 [Note] Event Scheduler: Loaded 0 events 2022-03-31T09:04:19.586574Z 0 [Note]
@qqing-li I will try with sysbench. @HtSmy - for the issue that you are facing with mysql containers, the issue is that the docker-entrypoint runs mysqld switching to another user. Gramine does not support switching users at this point, but I'm trying to see if any workaround is possible with GSC.
@aneessahib Thanks anees, I've tried the latest gramine instead of 1.1, now mysql starts successfully, and won't crash when using sysbench, but still continue outputting error logs like:
2022-04-01T10:47:05.958326Z 7 [ERROR] InnoDB: posix_fallocate(): Failed to preallocate data for file ./sbtest/sbtest3.ibd, desired size 4194304 bytes. Operating system error number 38. Check that the disk is not full or a disk quota exceeded. Make sure the file system supports this function. Some operating system error numbers are described at http://dev.mysql.com/doc/refman/5.7/en/operating-system-error-codes.html
I'm not sure if it matters.
@qqing-li Regarding your last error InnoDB: posix_fallocate()
. This function calls the underlying fallocate()
system call, which is not implemented in Gramine: https://github.com/gramineproject/gramine/blob/dbb843a515be5869f30c87b6b3035c7e46740a65/LibOS/shim/src/arch/x86_64/shim_table.c#L303
Therefore MySQL complains about this (...Make sure the file system supports this function
). This may be a problem for your MySQL workload. Does MySQL continue running? Does MySQL do what you're expecting it to do? Then you can ignore this error (maybe MySQL has a fall-back in this case, so it just continues running).
@pwmarcz Any idea how hard would it be to implement fallocate()
? To me, it feels like we can always return success, because in our threat model we can't control the underlying disk space anyway (the attacker can always pretend to have more/less disk space at any moment in time).
Please try with https://github.com/gramineproject/gramine/pull/522.
@HtSmy What's the state of this? Why did you reopen?
Description of the problem
I encountered some problems when testing MySQL performance in a Gramine environment.
Version information:
Start MySQL: MySQL run command:
MySQL log:
TPS and QPS are very low when using sysbench for insert and update operations. Threads: 24 TPS:690 QPS:3453 sysbench run command:
MySQL log:
Sysbench error and terminated mysql process, when sysbench threads is 64. sysbench run command:
sysbench log:
MySQL log: