From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751427AbcFKJtr (ORCPT ); Sat, 11 Jun 2016 05:49:47 -0400 Received: from www.linutronix.de ([62.245.132.108]:50399 "EHLO Galois.linutronix.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750929AbcFKJtp (ORCPT ); Sat, 11 Jun 2016 05:49:45 -0400 Date: Sat, 11 Jun 2016 11:47:44 +0200 (CEST) From: Thomas Gleixner To: Dave Hansen cc: linux-kernel@vger.kernel.org, x86@kernel.org, linux-api@vger.kernel.org, linux-arch@vger.kernel.org, linux-mm@kvack.org, torvalds@linux-foundation.org, akpm@linux-foundation.org, dave.hansen@linux.intel.com Subject: Re: [PATCH 2/9] mm: implement new pkey_mprotect() system call In-Reply-To: <20160609000120.A3DD5140@viggo.jf.intel.com> Message-ID: References: <20160609000117.71AC7623@viggo.jf.intel.com> <20160609000120.A3DD5140@viggo.jf.intel.com> User-Agent: Alpine 2.11 (DEB 23 2013-08-11) MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII X-Linutronix-Spam-Score: -1.0 X-Linutronix-Spam-Level: - X-Linutronix-Spam-Status: No , -1.0 points, 5.0 required, ALL_TRUSTED=-1,SHORTCIRCUIT=-0.0001 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Wed, 8 Jun 2016, Dave Hansen wrote: > Proposed semantics: > 1. protection key 0 is special and represents the default, > unassigned protection key. It is always allocated. > 2. mprotect() never affects a mapping's pkey_mprotect()-assigned > protection key. A protection key of 0 (even if set explicitly) > represents an unassigned protection key. > 2a. mprotect(PROT_EXEC) on a mapping with an assigned protection > key may or may not result in a mapping with execute-only > properties. pkey_mprotect() plus pkey_set() on all threads > should be used to _guarantee_ execute-only semantics. > 3. mprotect(PROT_EXEC) may result in an "execute-only" mapping. The > kernel will internally attempt to allocate and dedicate a > protection key for the purpose of execute-only mappings. This > may not be possible in cases where there are no free protection > keys available. Shouldn't we just reserve a protection key for PROT_EXEC unconditionally? Thanks, tglx