linux-kernel - Re: [RFC PATCH] rseq: x86: implement abort-at-ip extension

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Wed, 12 Jan 2022 16:24:10 -0500 (EST)
From:   Mathieu Desnoyers <mathieu.desnoyers@...icios.com>
To:     Florian Weimer <fw@...eb.enyo.de>
Cc:     Peter Zijlstra <peterz@...radead.org>,
        linux-kernel <linux-kernel@...r.kernel.org>,
        Thomas Gleixner <tglx@...utronix.de>,
        paulmck <paulmck@...nel.org>, Boqun Feng <boqun.feng@...il.com>,
        "H. Peter Anvin" <hpa@...or.com>, Paul Turner <pjt@...gle.com>,
        linux-api <linux-api@...r.kernel.org>,
        Christian Brauner <christian.brauner@...ntu.com>,
        carlos <carlos@...hat.com>
Subject: Re: [RFC PATCH] rseq: x86: implement abort-at-ip extension

----- On Jan 12, 2022, at 4:00 PM, Florian Weimer fw@...eb.enyo.de wrote:

> * Mathieu Desnoyers:
> 
>> ----- On Jan 12, 2022, at 11:00 AM, Florian Weimer fw@...eb.enyo.de wrote:
>>
>>> * Peter Zijlstra:
>>> 
>>>> On Wed, Jan 12, 2022 at 04:16:36PM +0100, Florian Weimer wrote:
>>>>
>>>>> You could perhaps push a signal frame onto the stack.  It's going to
>>>>> be expensive, but it's already in the context switch path, so maybe it
>>>>> does not matter.
>>>>
>>>> Please no! Signals are a trainwreck that need change (see the whole
>>>> AVX-512 / AMX saga), we shouldn't use more of that just cause.
>>> 
>>> If it's a signal, it should be modeled as such.  I think it's pretty
>>> close to a synchronous signal.
> 
> (an asynchronous signal)
> 
>> Florian, just to validate here: is your argument about AVX-512/AMX or about
>> rseq abort-at-ip ?
> 
> rseq abort-at-ip.  I wonder if it is possible to use regular stack
> unwinding (through the signal frame) to figure out where the abort
> happened, and use the existing cleanup handler functionality in GCC.
> (Although -fnon-call-exceptions is not quite up to this, but in theory
> we would have to fix this for POSIX asynchronous cancellation/Ada
> asynchronous transfer of control support anyway.)

OK, so if we take x86-64 as an example, the abort would do:

/* Skip redzone and sigframe */
regs->sp -= 128 + sizeof(struct rt_sigframe);

It's unclear to me what should be the size of rt_sigframe here. Should it
include floating point state as well ?

Then at regs->sp, we can store a signal frame. The interesting bits would
go into (struct rt_sigframe  __user *)->uc which is a struct sigcontext.
It would contain all register state at the point where the critical section
was aborted.

The only register state we really care about is sigcontext "rip", given that
the userspace abort handler can save all other relevant registers by itself.

Then should we populate the other struct rt_sigframe fields or just zero them ?
I wonder what the meaning of "pretcode" and "struct siginfo" would be in the
context of an rseq abort ?

Thanks,

Mathieu

-- 
Mathieu Desnoyers
EfficiOS Inc.
http://www.efficios.com