Re: Testing PROT_NONE and other protections, and a surprise

Richard Curnow
2004-07-01T14:26:13Z

Hi Jamie,

* Jamie Lokier <jamie@shareable.org> [2004-07-01]:
>
> I've just written a thorough test. The attached program tries every
> combination of PROT_* flags, and tells you what protection you really get.
>
> It'll be interesting to see the results on other architectures.

I've got this working on sh64/2.6 (which was only merged a couple of
days ago); here are the results:

Requested PROT | --- R-- -W- RW- --X R-X -WX RWX
========================================================================
MAP_SHARED | --- r-- -w- rw- r-x r-x rwx rwx
MAP_PRIVATE | --- r-- -w- rw- r-x r-x rwx rwx

Although the hardware is capable of distinguish R and X, the kernel
always allows R if X is specified to mmap(). This is for 2 reasons :

1. jump tables for switch() get embedded into the code in 32-bit
(SHmedia) mode
2. constant pools embedded in the code in 16-bit (SHcompact, i.e. SH-4
compatible) mode

so in practice an exec-only page is pretty useless to a typical userland
program.

> This program should hopefully run on all architectures, however it
> does depend on an empty function working when relocated.

The empty function relocated fine. But I had to make 2 trivial changes to
handle using &void_function as an argument to memcpy and when casting
addr to a function pointer. These result from the way the SH-5 uses the
LSB in function addresses and branch targets to switch between the
SHmedia and SHcompact instruction sets. (I can send you the patch if you
want.)

--
Richard \\\ SH-4/SH-5 Core & Debug Architect
Curnow \\\ SuperH (UK) Ltd, Bristol