From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751384AbbJGHLr (ORCPT ); Wed, 7 Oct 2015 03:11:47 -0400 Received: from mail-wi0-f180.google.com ([209.85.212.180]:35049 "EHLO mail-wi0-f180.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751329AbbJGHL2 (ORCPT ); Wed, 7 Oct 2015 03:11:28 -0400 Date: Wed, 7 Oct 2015 09:11:24 +0200 From: Ingo Molnar To: Dave Hansen Cc: Andy Lutomirski , Kees Cook , "x86@kernel.org" , LKML , Linux-MM , Linus Torvalds , Andrew Morton , Peter Zijlstra , Andy Lutomirski , Borislav Petkov Subject: Re: [PATCH 26/26] x86, pkeys: Documentation Message-ID: <20151007071124.GC7837@gmail.com> References: <55FF88BA.6080006@sr71.net> <20150924094956.GA30349@gmail.com> <56044A88.7030203@sr71.net> <20151001111718.GA25333@gmail.com> <20151002062340.GB30051@gmail.com> <560EC3EC.2080803@sr71.net> <20151003072755.GA23524@gmail.com> <56145905.6070109@sr71.net> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <56145905.6070109@sr71.net> User-Agent: Mutt/1.5.23 (2014-03-12) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org * Dave Hansen wrote: > On 10/03/2015 12:27 AM, Ingo Molnar wrote: > > - I'd also suggest providing an initial value with the 'alloc' call. It's true > > that user-space can do this itself in assembly, OTOH there's no reason not to > > provide a C interface for this. > > You mean an initial value for the rights register (PKRU), correct? > > So init_val would be something like > > PKEY_DENY_ACCESS > PKEY_DENY_WRITE > > and it would refer only to the key that was allocated. Correct. > > - Along similar considerations, also add a sys_pkey_query() system call to query > > the mapping of a specific pkey. (returns -EBADF or so if the key is not mapped > > at the moment.) This too could be vDSO accelerated in the future. > > Do you mean whether the key is being used on a mapping (VMA) or rather > whether the key is currently allocated (has been returned from > sys_pkey_alloc() in the past)? So in my mind 'pkeys' are an array of 16 values. The hardware allows us to map any 'protection key value' to any of the 16 indices. The query interface would only query this array, i.e. it would tell us what current protection value a given pkey index has - if it's allocated. So sys_pkey_query(6) would return the current protection key value for index 6. If the index has not been allocated yet, it would return -EBADF or so. This is what 'managed pkeys' means in essence. Allocation/freeing of pkeys is a relatively rare operation, and pkeys get inherited across fork()/clone() (which further cuts down on management activities), but it looks simple in any case. Thanks, Ingo