SUNOS 4 IMPLEMENTATION OF PROTECTION MODULE
                           design.mps.protsu
                             incomplete doc
                             drj 1997-03-20

INTRODUCTION

.readership: Any MPS developer

.intro: This is the design of the SunOS 4 implementation of the protection 
module.  It is intended to be used only in SunOS 4 (os.su).  It makes use of 
various services provided by SunOS 4.

[largely unwritten]

REQUIREMENTS

.req.general: Required to implement the general protection interface defined in 
design.mps.prot.if.*.


OVERVIEW

[uses mprotect]

MISC

.improve.sig-stack: Currently we do not handle signals on a separate signal 
stack.  If we handled signals on our own stack then we could guarantee not to 
run out of stack while we were handling the signal.  This would be useful (it 
may even be required).  We would have to use sigvec(2) rather than signal(3) 
(set the SV_ONSTACK flag and use sigstack(2)).  This has drawbacks as the 
signal stack is not grown automatically, so we would have to to frig the stacks 
back if we wanted to pass on the signal to some other handler as that handler 
may require arbitrary amounts of stack.

.improve.sigvec: Note 1 of ProtSetup notes that we can't honour the sigvec(2) 
entries of the next handler in the chain.  What if when we want to pass on the 
signal instead of calling the handler we call sigvec with the old entry and use 
kill to send the signal to ourselves and then restore our handler using sigvec 
again.  ramble ramble. [need more detail and analysis here].

assume mprotect never fails and why.  [We also need a policy here]

DATASTRUCTURES

.data.signext: This is static.  Because that is the only communications channel 
available to signal handlers. [write a little more here]


FUNCTIONS

.fun.setup:

ProtSetup

The setup involves installing a signal handler for the signal SIGSEGV to catch 
and handle protection faults (this handler is the function sigHandle, see 
.fun.sighandle). The previous handler is recorded (in the variable sigNext, see 
.data.signext) so that it can be reached from sigHandle if it fails to handle 
the fault.

The problem with this approach is that we can't honor the wishes of the 
sigvec(2) entry for the previous handler (in terms of masks in particular).

Obviously it would be okay to always chain the previous signal handler onto 
sigNext, however in the case where the previous handler is the one we've just 
installed (ie, sigHandle) then it is not necessary to chain the handler, so we 
don't.

.fun.set:

void ProtSet(Addr base, Addr limit, AccessSet mode)

.fun.set.convert: The requested protection (which is expressed in the mode 
parameter, see design.mps.prot.if.set) is translated into an OS protection.  If 
read accesses are to be forbidden then all accesses are forbidden, this is done 
by setting the protection of the page to PROT_NONE.  If write access are to be 
forbidden (and not read accesses) then write accesses are forbidden and read 
accesses are allowed, this is done by setting the protection of the page to 
PROT_READ|PROT_EXEC.  Otherwise (all access are okay), the protection is set to 
PROT_READ|PROT_WRITE|PROT_EXEC.

.fun.set.assume.mprotect: We assume that the call to mprotect always succeeds.  
.fun.set.assume.mprotect: This is because we should always call the function 
with valid arguments (aligned, references to mapped pages, and with an access 
that is compatible with the access of the underlying object).

.fun.sync:

void ProtSync(Space space);

This does nothing in this implementation as ProtSet sets the protection without 
any delay.

.fun.tramp:

void ProtTramp(void **resultReturn, void *(*f)(void *, size_t), void *p, size_t 
s);

The protection trampoline is trivial under SunOS, as there is nothing that 
needs to be done in the dynamic context of the mutator in  order to catch 
faults.  (Contrast this with Win32 Structured Exception Handling.)