> On May 2, 2018, at 8:12 AM, Florian Weimer <fweimer@xxxxxxxxxx> wrote: > >> On 05/02/2018 04:30 PM, Dave Hansen wrote: >>> On 05/02/2018 06:26 AM, Florian Weimer wrote: >>> pkeys support for IBM POWER intends to inherited the access rights of >>> the current thread in signal handlers. The advantage is that this >>> preserves access to memory regions associated with non-default keys, >>> enabling additional usage scenarios for memory protection keys which >>> currently do not work on x86 due to the unconditional reset to the >>> (configurable) default key in signal handlers. >> What's the usage scenario that does not work? > > Here's what I want to do: > > Nick Clifton wrote a binutils patch which puts the .got.plt section on separate pages. We allocate a protection key for it, assign it to all such sections in the process image, and change the access rights of the main thread to disallow writes via that key during process startup. In _dl_fixup, we enable write access to the GOT, update the GOT entry, and then disable it again. > > This way, we have a pretty safe form of lazy binding, without having to resort to BIND_NOW. > > With the current kernel behavior on x86, we cannot do that because signal handlers revert to the default (deny) access rights, so the GOT turns inaccessible. Dave is right: the current behavior was my request, and I still think it’s correct. The whole point is that, even if something nasty happens like a SIGALRM handler hitting in the middle of _dl_fixup, the SIGALRM handler is preventing from accidentally writing to the protected memory. When SIGALRM returns, PKRU should get restored Another way of looking at this is that the kernel would like to approximate what the ISA behavior *should* have been: the whole sequence “modify PKRU; access memory; restore PKRU” should be as atomic as possible. Florian, what is the actual problematic sequence of events? —Andy
