fp emulation (was Re: SECURITY BUG)

[Dick Dunn]

sef at kithrup.COM (Sean Eric Fagan) writes:
> james at bigtex.cactus.org (James Van Artsdalen) writes:
> >there is no
> >reason for 387 support (real or emulated) to need the u block to be
> >writable.

> Yes, there is, unless you want to make the emulated fpu even slower.

[Sean goes on to describe that the FP emulator runs in user state, for good
reasons, and state switches are costly--you don't want to go through a
protection-state transition in the coprocessor trap call gate.]

While Sean's reasoning is correct as far as it goes, Van Artsdalen's point
still holds.  While you probably do need to keep the emulated FP registers
in the u-area (that's the logical place, and I don't know where else you
could put them safely), you don't need to have the "vulnerable" part of the
u-area in the same page as the FP registers.  Put the FP registers in a
writable page; put the goodies in a non-writable page.
-- 
Dick Dunn     rcd at ico.isc.com -or- ico!rcd       Boulder, CO   (303)449-2870
   ...But is it art?