Skip to content

Raise host fd limit to back the guest fd table #148

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
LeoriumDev wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Raise host fd limit to back the guest fd table #148

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 12 additions & 1 deletion mk/tests.mk
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@
test-sysroot-create-paths test-fork-ipc-protocol-host test-identity-override-host \
test-proctitle-host test-proctitle-low-stack \
test-sysroot-procfs-exec test-timeout-disable test-fuse-alpine \
test-sysroot-nofollow test-sysroot-chdir perf
test-sysroot-nofollow test-sysroot-chdir test-fd-limit-stock perf

## Build and run the assembly hello world test
test-hello: $(ELFUSE_BIN) $(TEST_HELLO_DEP)
Expand Down Expand Up @@ -43,6 +43,8 @@ check: $(ELFUSE_BIN) $(TEST_DEPS) check-syscall-coverage \
$(BUILD_DIR)/test-fork-ipc-protocol-host \
$(BUILD_DIR)/test-identity-override-host
@bash tests/driver.sh -e $(ELFUSE_BIN) -d $(TEST_DIR) -v
@printf "\n$(BLUE)━━━ stock fd-limit (256) regression ━━━$(RESET)\n"
@$(MAKE) --no-print-directory test-fd-limit-stock
@printf "\n$(BLUE)━━━ TLBI RVAE1IS encoder unit test ━━━$(RESET)\n"
@$(BUILD_DIR)/test-tlbi-encoder-host
@printf "\n$(BLUE)━━━ fork IPC protocol identity unit test ━━━$(RESET)\n"
Expand Down Expand Up @@ -74,6 +76,15 @@ check: $(ELFUSE_BIN) $(TEST_DEPS) check-syscall-coverage \
@printf "\n$(BLUE)━━━ hot-syscall guardrail ━━━$(RESET)\n"
@$(MAKE) --no-print-directory test-bench-guardrail

## Rerun the fd-heavy stress test with the soft RLIMIT_NOFILE forced to the
## stock macOS default (256): fdtable_init must raise the host limit itself.
FD_LIMIT_STOCK_DEPS := $(ELFUSE_BIN)
ifndef GUEST_TEST_BINARIES
FD_LIMIT_STOCK_DEPS += $(BUILD_DIR)/test-stress
endif
test-fd-limit-stock: $(FD_LIMIT_STOCK_DEPS)

@Max042004 Max042004 Jul 6, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please wrap this target with the same 60-second timeout used by the normal test driver, or move the lowered-rlimit case into a driver script that already has timeout handling.

@bash -c 'ulimit -S -n 256 && exec "$(ELFUSE_BIN)" "$(TEST_DIR)/test-stress"'

@cubic-dev-ai cubic-dev-ai Bot Jul 4, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2: The test-fd-limit-stock test unconditionally sets the soft fd limit to 256, which will fail if the host hard limit is lower. This causes spurious make check failures in constrained CI or container environments. Consider checking the hard limit first and either capping the requested soft limit or skipping the test gracefully when the environment cannot support it.

Prompt for AI agents 
Check if this issue is valid — if so, understand the root cause and fix it. At mk/tests.mk, line 86:

<comment>The `test-fd-limit-stock` test unconditionally sets the soft fd limit to 256, which will fail if the host hard limit is lower. This causes spurious `make check` failures in constrained CI or container environments. Consider checking the hard limit first and either capping the requested soft limit or skipping the test gracefully when the environment cannot support it.</comment>

<file context>
@@ -74,6 +76,15 @@ check: $(ELFUSE_BIN) $(TEST_DEPS) check-syscall-coverage \
+  FD_LIMIT_STOCK_DEPS += $(BUILD_DIR)/test-stress
+endif
+test-fd-limit-stock: $(FD_LIMIT_STOCK_DEPS)
+	@bash -c 'ulimit -S -n 256 && exec "$(ELFUSE_BIN)" "$(TEST_DIR)/test-stress"'
+
 ## Hot-syscall performance guardrail: ensure getpid, libc clock_gettime,
</file context>


## Hot-syscall performance guardrail: ensure getpid, libc clock_gettime,
## and 1-byte /dev/urandom reads stay under their TODO ns/op ceilings.
## Builds the dynamic-glibc variant opportunistically; the script skips
Expand Down
26 changes: 26 additions & 0 deletions src/syscall/fdtable.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,10 +10,12 @@
* access through fd_lock.
*/

#include <limits.h>
#include <stdatomic.h>
#include <stdbool.h>
#include <stdlib.h>
#include <string.h>
#include <sys/resource.h>
#include <unistd.h>
#include <errno.h>
#include <dirent.h>
Expand Down Expand Up @@ -145,11 +147,35 @@ static int fd_bitmap_find_free(int minfd)

/* fdtable_init. */

/* Raise the host RLIMIT_NOFILE soft limit to min(OPEN_MAX, rlim_max), the
* largest value macOS accepts. The stock soft limit is 256, far below the
* FD_TABLE_SIZE fds this table advertises to guests, and every guest fd needs
* at least one backing host fd.
*
* Returns without changing anything if getrlimit fails or the limit already
* meets the target (an inherited higher limit is never lowered); setrlimit
* failure is ignored.
*/
static void fd_raise_host_nofile(void)
{
struct rlimit rl;

if (getrlimit(RLIMIT_NOFILE, &rl) != 0)
return;
rlim_t want = (rl.rlim_max < OPEN_MAX) ? rl.rlim_max : OPEN_MAX;
if (rl.rlim_cur >= want)
return;
rl.rlim_cur = want;
(void) setrlimit(RLIMIT_NOFILE, &rl);

@cubic-dev-ai cubic-dev-ai Bot Jul 4, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2: If raising the host fd limit fails (e.g. in a constrained container or sandbox), the guest-visible RLIMIT_NOFILE is left at the default FD_TABLE_SIZE (1024) while the actual host limit stays low. Host syscalls can then fail with EMFILE well below the guest's advertised capacity, recreating the host/guest divergence this patch is meant to fix.

Consider syncing the guest limit down when setrlimit fails — the codebase already has fd_set_rlimit_nofile() for this purpose. Saving the original rl.rlim_cur before the setrlimit call and passing it to fd_set_rlimit_nofile() on failure would keep the two limits aligned.

Prompt for AI agents 
Check if this issue is valid — if so, understand the root cause and fix it. At src/syscall/fdtable.c, line 169:

<comment>If raising the host fd limit fails (e.g. in a constrained container or sandbox), the guest-visible `RLIMIT_NOFILE` is left at the default `FD_TABLE_SIZE` (1024) while the actual host limit stays low. Host syscalls can then fail with `EMFILE` well below the guest's advertised capacity, recreating the host/guest divergence this patch is meant to fix.

Consider syncing the guest limit down when `setrlimit` fails — the codebase already has `fd_set_rlimit_nofile()` for this purpose. Saving the original `rl.rlim_cur` before the `setrlimit` call and passing it to `fd_set_rlimit_nofile()` on failure would keep the two limits aligned.</comment>

<file context>
@@ -145,11 +147,35 @@ static int fd_bitmap_find_free(int minfd)
+    if (rl.rlim_cur >= want)
+        return;
+    rl.rlim_cur = want;
+    (void) setrlimit(RLIMIT_NOFILE, &rl);
+}
+
</file context>

}

/* Initialize the FD table and bitmap, pre-open stdin/stdout/stderr. Extracted
* from syscall_init(); call before any guest code runs.
*/
void fdtable_init(void)
{
fd_raise_host_nofile();

@Max042004 Max042004 Jul 6, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

fdtable_init() is called from syscall_init(), and fork children call syscall_init() again while rebuilding state in fork_ipc_recv_fd_table(). That means a guest that lowers RLIMIT_NOFILE before fork() can get a child whose host soft limit is silently raised back to OPEN_MAX, which violates Linux rlimit inheritance semantics.

Please either run the host raise only during initial bootstrap, or serialize/restore the guest nofile state across the fork path before guest code resumes.


memset(fd_table, 0, sizeof(fd_table));

/* Mark all FDs as free in bitmap */
Expand Down
Loading