Re: [Syllable-kernel] IO operations

[Kristian V. D. V. <va...@li...>]

On Wednesday 15 December 2004 17:17, Daniel Gryniewicz wrote:
> On Tue, 2004-12-14 at 19:11 -0800, Nathanael Bettridge wrote:
> > IOPL is a chiplevel function. It has no idea what root
> > even is. It sees only the three rings, and in flat
> > paging mode, AFAIK (and definitely in current
> > syllable), only ring 0 (kernel) and 3 (user) are
> > really relevant. In other words, if its allowed in
> > user mode, it can be done, regardless of the user
> > account. It might not be easy to get at via libc or
> > whatever, but it can still be done. To do things
> > properly, we'd have to either shunt hw-accessing code
> > to ring 1 or 2, or have it all done via syscalls.
> >
> > Disclaimer: of course, I could be wrong ;)
>
> No, it's still easy.  IOPL is included in the saved context state when
> transitioning from 3 -> 0 (ie on a syscall or interrupt).  Thus, it's
> restored during the 0 -> 3 transition (ie, on iret).  Since Syllable,
> like all Unix kernels, stores this state on a per-process basis, it's
> easy to enable/disable IOPL on a per-process (or per-user, like most
> Unix does) basis.  Obvsiously, Syllable's not currently doing this, but
> just allowing all processes to have IOPL enabled.  This doesn't mean it
> couldn't be done.
>
> Most likely, we want to enable IOPL on the appserver, and deny it to
> anything else, by default.
>
> Linux does this based on it's fine-grained Capabilities.

Sorry for jumping in late, just got back from holidays.  IOPL should rely on 
the current users ACL capabilities once we have SylSec in place.  That gives 
use full control over who or what gets to mess with IO space; in theory only 
the appserver should ever require that IOPL is enabled, but that's simple to 
deal with once we have ACL's.

At this point there isn't much reason to worry about it, other than doing the 
groundwork to enable or disable IOPL on a process.  If anyone wants to try 
doing IO from user-space on Syllable it'll only mess up there own system, and 
I don't think we need to worry about worms right now!

Any IOPL patches gladly accepted!

-- 
Vanders
http://www.syllable.org
http://www.liqwyd.com