Re: [PATCH v2] x86: Preserve iopl on fork and execve

From: Austin S Hemmelgarn <ahferroin7@gmail.com>
To: Alex Henrie <alexhenrie24@gmail.com>
Cc: Arjan van de Ven <arjanvandeven@gmail.com>,
	Ingo Molnar <mingo@kernel.org>,
	One Thousand Gnomes <gnomes@lxorguk.ukuu.org.uk>,
	Kees Cook <keescook@chromium.org>,
	"H . Peter Anvin" <hpa@zytor.com>,
	Doug Johnson <dougvj@gmail.com>,
	Thomas Gleixner <tglx@linutronix.de>,
	Ingo Molnar <mingo@redhat.com>,
	Tyler Hicks <tyhicks@canonical.com>,
	Al Viro <viro@zeniv.linux.org.uk>,
	LKML <linux-kernel@vger.kernel.org>,
	Andy Lutomirski <luto@kernel.org>,
	Linus Torvalds <torvalds@linux-foundation.org>,
	Andrew Morton <akpm@linux-foundation.org>,
	Borislav Petkov <bp@alien8.de>,
	Peter Zijlstra <a.p.zijlstra@chello.nl>,
	Arjan van de Ven <arjan@infradead.org>,
	Denys Vlasenko <dvlasenk@redhat.com>,
	Brian Gerst <brgerst@gmail.com>
Subject: Re: [PATCH v2] x86: Preserve iopl on fork and execve
Date: Tue, 12 May 2015 14:12:13 -0400	[thread overview]
Message-ID: <5552427D.9070806@gmail.com> (raw)
In-Reply-To: <CAMMLpeR-JZTTLGY6yovnHdz7esAvRMrMeSRpWAKyvgenREM24g@mail.gmail.com>

[-- Attachment #1: Type: text/plain, Size: 1279 bytes --]

On 2015-05-12 14:05, Alex Henrie wrote:
> 2015-05-12 9:47 GMT-06:00 Austin S Hemmelgarn <ahferroin7@gmail.com>:
>> On 2015-05-12 11:25, Arjan van de Ven wrote:
>>> If you look at a modern linux distro, nothing should need/use iopl and
>>> co anymore, so maybe an interesting
>>> question is if we can stick these behind a CONFIG_ option (default on
>>> of course for compatibility)... just like
>>> some of the /dev/mem like things are now hidable for folks who know
>>> they don't need them.
>>
>> Personally, I _really_ like this idea.  The only thing I know of on any
>> modern distro that even considers using ioperm is hwclock, and it only does
>> so if it can't access the RTC through other means (and if you have an RTC,
>> you really should have the /dev interface enabled).
>
> Removing iopl might be OK. Removing ioperm would break my use case of
> legacy code that needs direct access to the parallel port.
>
> -Alex
>
The discussion isn't about outright removing them, just providing a 
config option to disable them.  It might be a good idea though to 
provide separate config options for each of iopl() and ioperm(), as 
iopl() is more dangerous, and ioperm() is more widely used, and people 
may need one but not want to have the other.


[-- Attachment #2: S/MIME Cryptographic Signature --]
[-- Type: application/pkcs7-signature, Size: 2967 bytes --]