Re: [PATCH][RFC] x86 multiple user-mode privilege rings

[ebiederm@xmission.com (Eric W. Biederman)]

Luca Barbieri <ldb@ldb.ods.org> writes:

> Short explaination: 
> This patch implements a feature called "x86 multiring", which is a
> shorthand for x86 multiple user-mode privilege rings support. 
> It allows user-mode programs to create DPL 1 and 2 segments and get a
> modifiable per-process copy of IDT. 
> 
> User Mode Linux can use these features to implement a syscall mechanism
> identical to the one used by the kernel-mode kernel, and thus much
> faster than the current one, with free memory protection and with zero
> context switches. 

But there are privilege switches.
 
> Wine could also use it to achieve fast syscall-level emulation of
> Windows NT (and, to a lesser extent, Windows 3.1 and 9x). 
> 
> Obviously there is some risk of the patch creating security holes. 

Let me get the gist of the idea.
To accelerate UML, and wine type applications:
1) setup segments with restricted limits, so their children cannot
   write into their supervisor process even though they share a mm.
2) load a special system call table that switches processor modes
   when any system call is activated.

Unless I am mistaken all of the above can be accomplished without
using the cpus multiple rings of privilege.  Which would allow nesting
only limited by the address space reduction of each task.

Eric