CODEWITHSUNDEEP
linuxlinux-kerneloperating-systemsystem-calls
Monk
Monk

Reputation: 786

How linux kernel knows the address passed as argument in syscall is invalid?

Currently I am reading System calls chapter of Understanding linux kernel and I could not understand the fact that how linux kernel knows address argument passed via syscall() is invalid.

Book has mentioned that address checking is delayed until it is used and when linux made used this address it generates page fault. It further mentioned a fault can happen in three case in kernel mode

• The kernel attempts to address a page belonging to the process address space, but either the corresponding page frame does not exist, or the kernel is trying to write a read-only page.

• Some kernel function includes a programming bug that causes the exception to be raised when that program is executed; alternatively, the exception might be caused by a transient hardware error.

• A system call service routine attempts to read or write into a memory area whose address has been passed as a system call parameter, but that address does not belong to the process address space.

These cases must be distinguished by the page fault handler, since the actions to be taken are quite different.The page fault handler can easily recognize the first case by determining whether the faulty linear address is included in one of the memory regions owned by the process.

But how kernel distinguishes between remaining two case. Although it is explained in the text book but it looks alien to me. Please help and explain.

Upvotes: 1

Views: 684

Answers (1)

Hadi Brais
Hadi Brais

Reputation: 23719

The page fault handler __do_page_fault includes this piece of code:

if (!(error_code & X86_PF_USER) &&
            !search_exception_tables(regs->ip)) {
            bad_area_nosemaphore(regs, error_code, address, NULL);
            return;
        }

This condition !(error_code & X86_PF_USER) is true when the system call originated from kernel mode rather than user mode. This condition !search_exception_tables(regs->ip) is true when the page fault did not occur from executing one of the instructions that use a linear that was passed to the system call. Note that regs->ip holds the instruction pointer of the instruction that caused the page fault. When both of these conditions are true, it means that either there is a bug in some kernel function or that there is some hardware error (the second case).

regs contains a snapshot of all architectural registers at the time of the page fault. On x86, this includes the CS segment register. The RPL in that register can be used to determine whether system call originated from user mode or kernel mode.

The search_exception_tables performs a binary search on sorted arrays of instruction addresses that are built at compile-time when compiling the kernel. These are basically the instructions that access an address passed to the system call.

For the other two other cases you listed, the condition !(error_code & X86_PF_USER) would be false.

Upvotes: 1

Related Questions