public inbox for linux-kernel@vger.kernel.org
 help / color / mirror / Atom feed
From: David Mosberger <davidm@napali.hpl.hp.com>
To: torvalds@transmeta.com, roland@redhat.com
Cc: linux-kernel@vger.kernel.org
Subject: FIXMAP-related change to mm/memory.c
Date: Thu, 12 Jun 2003 18:24:02 -0700	[thread overview]
Message-ID: <200306130124.h5D1O2DT025311@napali.hpl.hp.com> (raw)

Is it possible to constrain the FIXADDR range on x86/x86-64
(FIXADDR_START-FIXADDR_TOP) such that the entire range is read-only by
user-level?  If so, we could simplify the permission test like this:

===== mm/memory.c 1.124 vs edited =====
--- 1.124/mm/memory.c	Wed May 14 00:53:07 2003
+++ edited/mm/memory.c	Thu Jun 12 18:08:42 2003
@@ -714,8 +714,7 @@
 			if (!pmd)
 				return i ? : -EFAULT;
 			pte = pte_offset_kernel(pmd, pg);
-			if (!pte || !pte_present(*pte) || !pte_user(*pte) ||
-			    !(write ? pte_write(*pte) : pte_read(*pte)))
+			if (!pte || !pte_present(*pte) || write)
 				return i ? : -EFAULT;
 			if (pages) {
 				pages[i] = pte_page(*pte);

Advantages:

	- simpler code
	- gets rid of pte_user() (which was introduced just for this purpose)
	- lets gdb work better on arches which use execute-only page for
	  privilege promotion

I can live with the existing code, but for ia64, it would be useful to
have this patch in place, because otherwise, the gate page used for
lightweight system calls and the signal trampoline is not readable via
ptrace() (that page must be mapped as EXECUTE-only, because otherwise
the SYSENTER-equivalent of ia64, called "epc", cannot be used).
(Note, there is no security issue here, because the EXECUTE-only page
only contains code or ELF-related constant data.)

I considered changing the PTE-checking, but it gets really tricky,
because on many platforms, the privilege-level and the
access-permission bits are not fully orthogonal (for example, the
EXECUTE-only page is actually a kernel-owned page, but it's still
executable at the user level).  In the end I decided that the whole
purpose of the FIXADDR range stuff is to _allow_ user-level access to
that range, so if the range is chosen properly, it should be OK to
allow reads without further pte_read() access checking.  (If writes
needs to be supported, we would have to add back the pte_user() &&
pte_write() checks).

	--david

             reply	other threads:[~2003-06-13  1:10 UTC|newest]

Thread overview: 11+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2003-06-13  1:24 David Mosberger [this message]
2003-06-13  2:07 ` FIXMAP-related change to mm/memory.c Roland McGrath
2003-06-13  2:16   ` David Mosberger
2003-06-13  6:34     ` Roland McGrath
2003-06-13  6:37       ` David Mosberger
2003-06-13  6:56         ` Roland McGrath
2003-06-13  7:15           ` Andrew Morton
2003-06-15  6:51             ` Anton Blanchard
2003-06-13  7:17           ` David Mosberger
2003-06-13  5:24 ` Linus Torvalds
2003-06-13  7:28   ` [BUG] " Riley Williams

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=200306130124.h5D1O2DT025311@napali.hpl.hp.com \
    --to=davidm@napali.hpl.hp.com \
    --cc=davidm@hpl.hp.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=roland@redhat.com \
    --cc=torvalds@transmeta.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox