From mboxrd@z Thu Jan 1 00:00:00 1970 Date: Thu, 1 Nov 2018 14:52:25 -0400 From: Rich Felker To: Jann Horn CC: Andy Lutomirski , Dave Hansen , , , , Florian Weimer , Linux API , Linus Torvalds , the arch/x86 maintainers , linux-arch , kernel list , Peter Zijlstra , , , , , , , Thomas Gleixner , Ingo Molnar , Borislav Petkov , , Subject: Re: RFC: userspace exception fixups Message-ID: <20181101185225.GC5150@brightrain.aerifal.cx> References: Content-Type: text/plain; charset="us-ascii" In-Reply-To: Sender: Rich Felker Return-Path: dalias@aerifal.cx MIME-Version: 1.0 List-ID: On Thu, Nov 01, 2018 at 07:33:33PM +0100, Jann Horn wrote: > > but I'm > > wondering if a more general mechanism would be helpful. > > > > The basic idea would be to allow libc, or maybe even any library, to > > register a handler that gets a chance to act on an exception caused by > > a user instruction before a signal is delivered. As a straw-man > > example for how this could work, there could be a new syscall: > > > > long register_exception_handler(void (*handler)(int, siginfo_t *, void *)); > > > > If a handler is registered, then, if a synchronous exception happens > > (page fault, etc), the kernel would set up an exception frame as usual > > but, rather than checking for signal handlers, it would just call the > > registered handler. > > > That handler is expected to either handle the > > exception entirely on its own or to call one of two new syscalls to > > ask for normal signal delivery > > If you do it this way, these exception handlers would have to chain, There's no need to chain if the handler is specific to the context where the fault happens. You just replace the handler with the one relevant to the code you're about to run before you run it. > > or to ask to retry the faulting instruction. > > Why would that have to be a syscall? For signal handlers registered > with SA_NODEFER, you can basically leave the signal handler with a > longjmp, right? longjmp needs a jmp_buf; it can't return to the faulting instruction. Normally (though this is not defined) signal handlers return to the faulting instruction if they return, but if returning from the exception handler meant passing through to the signal disposition, a different mechanism would be needed to signal that you want to retry the faulting instruction. Rich From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-2.5 required=3.0 tests=HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,SPF_PASS,USER_AGENT_MUTT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7217DC6786F for ; Thu, 1 Nov 2018 18:52:39 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 390A5205F4 for ; Thu, 1 Nov 2018 18:52:39 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 390A5205F4 Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=libc.org Authentication-Results: mail.kernel.org; spf=none smtp.mailfrom=linux-sgx-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727762AbeKBD4t (ORCPT ); Thu, 1 Nov 2018 23:56:49 -0400 Received: from 216-12-86-13.cv.mvl.ntelos.net ([216.12.86.13]:57918 "EHLO brightrain.aerifal.cx" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727065AbeKBD4t (ORCPT ); Thu, 1 Nov 2018 23:56:49 -0400 Received: from dalias by brightrain.aerifal.cx with local (Exim 3.15 #2) id 1gII4v-0001aI-00; Thu, 01 Nov 2018 18:52:25 +0000 Date: Thu, 1 Nov 2018 14:52:25 -0400 From: Rich Felker To: Jann Horn Cc: Andy Lutomirski , Dave Hansen , sean.j.christopherson@intel.com, jethro@fortanix.com, jarkko.sakkinen@linux.intel.com, Florian Weimer , Linux API , Linus Torvalds , the arch/x86 maintainers , linux-arch , kernel list , Peter Zijlstra , nhorman@redhat.com, npmccallum@redhat.com, serge.ayoun@intel.com, shay.katz-zamir@intel.com, linux-sgx@vger.kernel.org, andriy.shevchenko@linux.intel.com, Thomas Gleixner , Ingo Molnar , Borislav Petkov , carlos@redhat.com, adhemerval.zanella@linaro.org Subject: Re: RFC: userspace exception fixups Message-ID: <20181101185225.GC5150@brightrain.aerifal.cx> References: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.21 (2010-09-15) Sender: linux-sgx-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-sgx@vger.kernel.org Message-ID: <20181101185225.Itzn8E5MCeSxkI8-OE3lZq_ym1Ke4jA-07JbR1nLSMM@z> On Thu, Nov 01, 2018 at 07:33:33PM +0100, Jann Horn wrote: > > but I'm > > wondering if a more general mechanism would be helpful. > > > > The basic idea would be to allow libc, or maybe even any library, to > > register a handler that gets a chance to act on an exception caused by > > a user instruction before a signal is delivered. As a straw-man > > example for how this could work, there could be a new syscall: > > > > long register_exception_handler(void (*handler)(int, siginfo_t *, void *)); > > > > If a handler is registered, then, if a synchronous exception happens > > (page fault, etc), the kernel would set up an exception frame as usual > > but, rather than checking for signal handlers, it would just call the > > registered handler. > > > That handler is expected to either handle the > > exception entirely on its own or to call one of two new syscalls to > > ask for normal signal delivery > > If you do it this way, these exception handlers would have to chain, There's no need to chain if the handler is specific to the context where the fault happens. You just replace the handler with the one relevant to the code you're about to run before you run it. > > or to ask to retry the faulting instruction. > > Why would that have to be a syscall? For signal handlers registered > with SA_NODEFER, you can basically leave the signal handler with a > longjmp, right? longjmp needs a jmp_buf; it can't return to the faulting instruction. Normally (though this is not defined) signal handlers return to the faulting instruction if they return, but if returning from the exception handler meant passing through to the signal disposition, a different mechanism would be needed to signal that you want to retry the faulting instruction. Rich