From: Szabolcs Nagy <nsz@port70.net>
To: Rich Felker <dalias@libc.org>
Cc: musl@lists.openwall.com
Subject: Re: [musl] More thoughts on wrapping signal handling
Date: Thu, 29 Oct 2020 15:21:17 +0100 [thread overview]
Message-ID: <20201029142117.GZ2947641@port70.net> (raw)
In-Reply-To: <20201029063448.GK534@brightrain.aerifal.cx>
* Rich Felker <dalias@libc.org> [2020-10-29 02:34:50 -0400]:
> In "Re: [musl] Re: [PATCH] Make abort() AS-safe (Bug 26275)."
> (20201010002612.GC17637@brightrain.aerifal.cx,
> https://www.openwall.com/lists/musl/2020/10/10/1) I raised the
> longstanding thought of having libc wrap signal handling. This is a
> little bit of a big hammer for what it was proposed for -- fixing an
> extremely-rare race between abort and execve -- but today I had a
> thought about another use of it that's really compelling.
>
> What I noted before was that, by wrapping signal handlers, libc could
> implement a sort of "rollback" to restart a critical section that was
> interrupted. However this really only has any use when the critical
> section has no side effects aside from its final completion, and
> except for execve where replacement of the process gives the atomic
> cutoff for rollback, it requires __cp_end-like asm label of the end of
> the critical section. So it's of limited utility.
>
> However, what's more interesting than restarting the critical section
> when a signal is received is *allowing it to complete* before handling
> the signal. This can be implemented by having the wrapper, upon seeing
> that it interrupted a critical section, save the siginfo_t in TLS and
> immediately return, leaving signals blocked, without executing the
> application-installed signal handler. Then, when leaving the critical
> section, the unlock function can see the saved siginfo_t and call the
> application's signal handler. Effectively, it's as if the signal were
> just blocked until the end of the critical section.
this probably does not work with SIGSEGV and SIGBUS:
execution likely cannot continue to leave the critical
section, but the handlers must be invoked.
>
> What is the value in this?
>
> 1. It eliminates the need for syscalls to mask and unmask signals
> around all existing AS-safe locks and critical sections that can't
> safely be interrupted by application code.
>
> 2. It makes it so we can make almost any function that was AS-unsafe
> due to locking AS-safe, without any added cost. Even malloc can be
> AS-safe.
i guess this can introduce delay into signal handling,
depending on how long libc internal locks are held.
>
> 3. It makes it so a signal handler that fails to return promptly in
> one thread can't arbitrarily delay other threads waiting for
> libc-internal locks, because application code never interrupts our
> internal critical sections.
>
> This last property, #3, is the really exciting one -- it means that,
> short of swapping etc. (e.g. with mlockall and other realtime measures
> taken) most libc locks can be considered as held only for very small
> bounded time, rather than potentially-unbounded due to interruption by
> signal.
sounds interesting.
>
> I'm not sure if this is something worth pursuing, and certainly not in
> the immediate future, but it is sounding more appealing.
>
> Rich
next prev parent reply other threads:[~2020-10-29 14:21 UTC|newest]
Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-10-29 6:34 Rich Felker
2020-10-29 11:45 ` Alexey Izbyshev
2020-10-29 13:38 ` Rich Felker
2020-10-29 13:51 ` Alexander Monakov
2020-10-29 14:02 ` Alexander Monakov
2020-10-29 14:12 ` Florian Weimer
2020-10-29 14:18 ` Alexander Monakov
2020-10-29 14:28 ` Rich Felker
2020-10-31 17:33 ` Alexey Izbyshev
2020-10-29 14:21 ` Szabolcs Nagy [this message]
2020-10-29 14:43 ` Rich Felker
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20201029142117.GZ2947641@port70.net \
--to=nsz@port70.net \
--cc=dalias@libc.org \
--cc=musl@lists.openwall.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this public inbox
https://git.vuxu.org/mirror/musl/
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).