lkml.org 
[lkml]   [2004]   [Jul]   [1]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectA question about PROT_EXEC-only pages on IA64
Hi IA64 folks,

I'm doing a survey of the different architectural implementations of
PROT_* flags for mmap() and mprotect(). I'm looking at linux-2.6.5.

According to my reading of the source, from include/asm-ia64/pgtable.h
and arch/ia64/mm/fault.c, IA64 on Linux implements the following:

Requested PROT flags | --- R-- -W- RW- --X R-X -WX RWX
=====================+======================================================
ia64 MAP_SHARED | --- r-- !w- rw- *-x r-x !wx rwx
ia64 MAP_PRIVATE | --- r-- !w- rw- *-x r-x !wx rwx

"!" means that a read access raises a signal *sometimes*. This is
because the page protection when the page is installed allows reading,
but if there isn't a page installed, then a read fault will raise a
signal.

(Several architectures have "!" entries, but their places in the table
vary. On x86_64, and i386 with NX, for example, the sequence is "---
r-- !w- rw- r-x r-x rwx rwx": notice no "!" in the -WX case. That's
because of different logic in the fault handler.)

I have a question about about the column with "*". You have
implemented PROT_EXEC-only pages using these flags:

#define __P100 __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_X_RX)

I.e. _PAGE_AR_X_RX. My question is: does this mean that reading those
pages in *kernel* mode will succeed, i.e. so that write() would
succeed in reading from those pages?

If that's the behaviour, and the intention is to create exec-only
pages, then it's a bug. A similar bug has been found on the Sparc for
PROT_NONE pages, which is more serious.

It's not necessarily important on IA64, because IA64 is the _only_
Linux platform which does exec-only pages. (This despite other
hardware being able to have exec-only permissions. See another mail
about that in a few minutes).

I would simply like to know if this is the IA64 behaviour, where a
PROT_EXEC-only area is readable by get_user(), to document it. (It's
possible that I don't understand the technical implications of
_PAGE_AR_X_RX, and that in fact get_user() in kernel won't be able to
read exec-only pages.)

Thanks,
-- Jamie
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 14:04    [W:0.024 / U:0.320 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site