klange changed the topic of #osdev to: Operating System Development || Don't ask to ask---just ask! || For 3+ LoC, use a pastebin (for example https://gist.github.com/) || Stats + Old logs: http://osdev-logs.qzx.com New Logs: https://libera.irclog.whitequark.org/osdev || Visit https://wiki.osdev.org and https://forum.osdev.org || Books: https://wiki.osdev.org/Books
Left_Turn has quit [Read error: Connection reset by peer]
<mcrod> hi
<zid> heat: news is going on about image loader bugs in uefi, that secure thing you love that doesn't get hacked
dude12312414 has quit [Quit: THE RAM IS TOO DAMN HIGH]
<heat> zid, where??
<bslsk05> ​arstechnica.com: Just about every Windows and Linux device vulnerable to new LogoFAIL firmware attack | Ars Technica
<zid> heat: also is there a quick list of what all the functions are called in the uefi function pointer list somewhere?
<zid> I assume you could find one on google by slamming 5 of the names into a google search easily
<heat> oh
<heat> i thought it was about the PE image loader
<heat> anyway FUCKIN HILARIOUS LMAO
<heat> GET FUCKED
<heat> zid, wdym uefi function pointer list? you have like at least 30 different function pointer structs
<zid> fine, do 30 google searches for me
<bslsk05> ​uefi.org: UEFI Specification 2.10 — UEFI Specification 2.10 documentation
<zid> now process it for me
<heat> open the sections named "services - *" or "protocols - *"
elastic_dog has quit [Ping timeout: 240 seconds]
rpnx has joined #osdev
elastic_dog has joined #osdev
<heat> lol they defeated spectre mitigations with top byte ignore on AMD, ARM and Intel
<zid> I also ignore tops
<bl4ckb0ne> what about bottom byte
rpnx has quit [Quit: My laptop has gone to sleep.]
rustyy has quit [Ping timeout: 260 seconds]
agent314 has joined #osdev
<geist> hello
<heat> hi
<heat> geist, here's your monthly cpu vulnerability newsletter: https://download.vusec.net/papers/slam_sp24.pdf
<geist> ah hah we cant have nice things
<zid> nice things areillegal
<geist> not like top byte ignore and whantot is a ‘nice thing’ to kernel people. but the security people love it
<geist> until its terribad
<geist> because intel
<clever> i feel like thats the same as an xbox exploit
<clever> there was a bytecode intrepreter in the boot rom, that ran unsigned bytecode to bring up the dram
<clever> and to restrict what the unsigned code can do, it did a 32bit compare against the IO port being written to
<clever> except, the IO port is a 16bit number, the hardware ignores the upper 16bits :P
<heat> geist, doesn't TBI allow for hwasan»
<heat> and easier ways to stash random bits in a pointer, and we love those don't we
<zid> what's wrong with nanboxing, smh
<zid> people do silly things, then want hw support for their silly thing is the problem here, they should be content with wishing they had hw support
[itchyjunk] has quit [Read error: Connection reset by peer]
<geist> back in my day!
* geist shakes fist at people with their bits and memory
<zid> They'rejust greedy
<geist> we gave em 48 bits, they’re not even using it!
<geist> then they want to use the rest
srjek has quit [Ping timeout: 268 seconds]
<clever> geist: and dont forget about the good old A20 gate!
<heat> they should force-disable the A20 line again and lay out 64gigs of memory with A20 = 0
<clever> lol
edr has quit [Quit: Leaving]
heat has quit [Ping timeout: 276 seconds]
rustyy has joined #osdev
sbalmos has quit [Ping timeout: 256 seconds]
sbalmos has joined #osdev
Arthuria has joined #osdev
agent314 has quit [Ping timeout: 264 seconds]
Arthuria has quit [Killed (NickServ (GHOST command used by Guest684531))]
Arthuria has joined #osdev
agent314 has joined #osdev
Arthuria has quit [Remote host closed the connection]
Arthuria has joined #osdev
agent314 has quit [Ping timeout: 255 seconds]
eddof13 has quit [Quit: eddof13]
netbsduser has joined #osdev
GeDaMo has joined #osdev
Arthuria has quit [Remote host closed the connection]
netbsduser has quit [Ping timeout: 245 seconds]
alexander has quit [Remote host closed the connection]
alexander has joined #osdev
gbowne1 has quit [Quit: Leaving]
danilogondolfo has joined #osdev
Nixkernal has quit [Quit: https://quassel-irc.org - Chat comfortably. Anywhere.]
pretty_dumm_guy has joined #osdev
eddof13 has joined #osdev
zxrom has quit [Ping timeout: 256 seconds]
eddof13 has quit [Ping timeout: 246 seconds]
zid` has joined #osdev
zid has quit [Read error: Connection reset by peer]
heat has joined #osdev
elastic_dog has quit [Ping timeout: 240 seconds]
* Ermine tries hard to not use -en in $dayjob docs
<heat> docen
<heat> docken?
<Ermine> docker containen
<GeDaMo> Drunken
<GeDaMo> Hopefully the docs are not about Windows Eleven :P
<heat> windowen elevenen
elastic_dog has joined #osdev
kalj has joined #osdev
zxrom has joined #osdev
Nixkernal has joined #osdev
roper has joined #osdev
kalj has quit [Quit: Client closed]
goliath has joined #osdev
tomith has joined #osdev
srjek has joined #osdev
srjek has quit [Ping timeout: 268 seconds]
<benlyn>
<benlyn> INTERESTS
<benlyn> Arts & Culture, Books, Cars, Computer games, Music, Nature, Philosophy, Psychology, Sport, Theatre, Travelling
<benlyn> Spiritual:
<benlyn> Hobbies:
<benlyn> Astrology, Numerology, Tarot
benlyn has quit [Remote host closed the connection]
benlyn has joined #osdev
benlyn has quit [Remote host closed the connection]
Gurkenglas has joined #osdev
foudfou has joined #osdev
heat_ has joined #osdev
heat has quit [Read error: Connection reset by peer]
Left_Turn has joined #osdev
Gurkenglas has quit [Ping timeout: 250 seconds]
edr has joined #osdev
joe9 has joined #osdev
Left_Turn has quit [Ping timeout: 256 seconds]
Left_Turn has joined #osdev
srjek has joined #osdev
dude12312414 has joined #osdev
pebble has joined #osdev
foudfou has quit [Remote host closed the connection]
foudfou has joined #osdev
dude12312414 has quit [Quit: THE RAM IS TOO DAMN HIGH]
eddof13 has joined #osdev
eddof13 has quit [Quit: eddof13]
eddof13 has joined #osdev
craigo has joined #osdev
<immibis> the only spectre solution that actually works will be some kind of cache segregation
<immibis> which won't happen
eddof13 has quit [Quit: eddof13]
eddof13 has joined #osdev
eddof13 has quit [Client Quit]
eddof13 has joined #osdev
eddof13 has quit [Client Quit]
qubasa has quit [Remote host closed the connection]
Vercas has quit [Ping timeout: 240 seconds]
Vercas has joined #osdev
pebble has quit []
<gorgonical> How is it going on this Thursday afternoon my kernal developers
danilogondolfo has quit [Quit: Leaving]
<gorgonical> I have an actual question, too: why does musl ld.so use mmap MAP_FIXED to change permissions of a region and not mprotect?
<zid`> post your advent day 7 or riot
<gorgonical> I have difficulty completing the aoc. I have tried at least three times and never finished it
<zid`> MAP_FIXED is essentially dup2 isn't it
<zid`> nobody *finishes* aoc
<zid`> you get 2 weeks in then give up
<gorgonical> oh then I have done that several years now
<gorgonical> lol
<gorgonical> but yes map_fixed is basically the mmap variant of dup2 I think
<gorgonical> musl's ld.so uses it to map in rw segments because it already maps all the segments as ronly so it has to change some to rw
<gorgonical> I have heard glibc's does this too
<gorgonical> but mprotect does exactly the same thing as map_fixed with fd=-1 with much less overloading
<zid`> overloading?
<gorgonical> mmap is about mapping some data into memory. map fixed says put it where I want. map fixed with fd -1 says actually dont map new memory in, just change the mappings of old memory
<gorgonical> It does a new kind of job, one that mprotect already did
teroshan97 has quit [Quit: The Lounge - https://thelounge.chat]
<Ermine> Random questions time
<mjg> 9
<zid`> six
teroshan97 has joined #osdev
<Ermine> Seems like it's CRT which is responsible for setting proper memory protection
<zid`> if you want different to what ELF provides, sure
<gorgonical> right
<Ermine> Idk if I want, but strace on literally everything starts with a bunch of mprotect's
teroshan97 has quit [Client Quit]
<zid`> you -> the c environment
<gorgonical> And I mean here the ELF dynamic loader
teroshan97 has joined #osdev
<zid`> If your C implementation wishes for certain things to be true of the environment
<zid`> then the crt needs to do it before main()
<zid`> most of what a C environment wants is provided already by elf though, so they don't need to do things like zero their statics
<zid`> because elf provides functionality for this (.bss)
<gorgonical> yep
<Ermine> If I build my stuff crt-less (for whatever reason), do I get some default protection?
<gorgonical> yeah, whatever your elf segments say
<zid`> you get what your loader gave you
<zid`> which is probably, what you told your linker to tell your elf to give you
<gorgonical> yes, modulo what the loader does with them
<zid`> nommu systems aren't going to honor -w even if you ask for it, and some systems might enforce w^x without asking you, etc
<Ermine> don't they enforce w^x by default?
<zid`> who is they?
<Ermine> systems
<zid`> ?
<zid`> Only like, two systems even have that hardware
<zid`> and it's a global toggle on intel
<zid`> more or less
<gorgonical> we mean write but no exec right?
<zid`> write xor exec, neither, write or exec, but not write + exec
<gorgonical> oh
<zid`> intel implements it by the NX bit, bit 63 in the address, when the bit in cr..0? is set
<gorgonical> yeah for like instruction memory or kernel stuff
<zid`> windows calls it DEP I think
<Ermine> okay, thank you
<zid`> btw those mprotect that you are seeing
<zid`> are most likely a security feature to stop the GOT being writeable after ld.so fills it out
<zid`> it acts as a REALLY easy way to turn write gadgets into full exploits otherwise
<zid`> *printf = payload(); printf();
<zid`> 0x0804845f <+36>:call 0x8048300 <puts@plt>
<zid`> => 0x8048300 <puts@plt>:jmp DWORD PTR ds:0x804a00c
<zid`> so if you can write to 0x804a00c you can just turn any puts() in the original code into an arbitrary call to any address
<zid`> -Wl,-z,relro is what enables that
<zid`> which might be in your default gcc specs
<Ermine> it isn't
netbsduser has joined #osdev
<zid`> I get an entire extra mprotect with full relro
<zid`> DESKTOP-VCLC0NQ ~/dev/advent # gcc day7.c -o day7 -O2 -W -Wall -Wl,-z,now,-z,relro; strace ./day7 2>&1 -f | grep -E "(mmap|mprotect)" | wc -l
<zid`> 11
<zid`> DESKTOP-VCLC0NQ ~/dev/advent # gcc day7.c -o day7 -O2 -W -Wall -Wl,-z,lazy,-z,norelro; strace ./day7 2>&1 -f | grep -E "(mmap|mprotect)" | wc -l
<zid`> 10
<zid`> so there's two doing.. something else, as well
<zid`> (and 8 mmaps)
eddof13 has joined #osdev
heat_ has quit [Remote host closed the connection]
heat has joined #osdev
<zid`> heat are you a pokemon
goliath has quit [Quit: SIGSEGV]
heat_ has joined #osdev
heat has quit [Ping timeout: 240 seconds]
Left_Turn has quit [Read error: Connection reset by peer]
Left_Turn has joined #osdev
q3lont has joined #osdev
Left_Turn has quit [Ping timeout: 264 seconds]
eddof13 has quit [Quit: eddof13]
<heat_> zid`, no im a digimon
<heat_> i'm an off-brand pokemon
<zid`> digimon are not off brand pokemon
<zid`> they are DIGITAL MONSTERS
<heat_> ohhhhh, pocket monsters != digital monsters
<heat_> completely different
<zid`> digimon are the champions
<heat_> gorgonical, ok so i'm late to your question
<heat_> but basically musl isn't using MMAP for mprotect
<heat_> hth
<zid`> RCU
<heat_> follow me for more tips and tricks
<zid`> read, constipation ungodly.
<zid`> Remember crabs, unspecified.
<heat_> god the musl ldso is as almost as impenetrable as the dns parser
<mjg> R in RCU stands for Rust
<mjg> Rust Concurrency Unfearned
<mjg> :X
<moon-child> Rusten
<heat_> cargo craten
<zid`> (love dogs, sometimes otters)
<gorgonical> heat_: what do you mean, they are absolutely using mmap map_fixed to do mprotect stuff
<heat_> they are not
<zid`> I thought they were dup2ing it
<zid`> never know when you might need a spare
GeDaMo has quit [Quit: That's it, you people have stood in my way long enough! I'm going to clown college!]
<heat_> boss
<bslsk05> ​github.com: musl/ldso/dynlink.c at master · bminor/musl · GitHub
<moon-child> if dup2 is so good how come there isn't dup22 yet
<heat_> gorgonical, what
<heat_> show me where they're using mmap for protection (they're not)
<zid`> showme in the source code where the day 3 solution is heat
<heat_> they only mmap_fixed when the segments aren't contiguous
<heat_> zid`, isn't the day3 solution the friends we make along the way?
<zid`> nope
<heat_> well, then i don't have one
<zid`> any friends?
<zid`> correct
<heat_> gog is definitely my friend
<gorgonical> but heat_ definitionally if you map_fixed without a backing fd all that does is change the permissions
<heat_> mcrod is also my friend and loves me
<heat_> gorgonical, what
<mcrod> it is true
<mcrod> i am friend
<heat_> gorgonical, it also changes the backing
<gorgonical> how and why
<heat_> how what?
<zid`> Don't interpret addr as a hint: place the mapping at exactly that address.
<zid`> That's what it be doin
<gorgonical> what does it change it to? if you have anonymous then it makes sense to change the backing
<heat_> if you map a file at addr X, then map a new file or a MAP_ANON at addr X it changes the backing
<heat_> there's a new mapping
<zid`> heat_: if I overlap does it fail, or does it succeed I have to call mumap in very creative ways after?
<heat_> also, fwiw mmap isn't quite the same as mprotect: mprotect PROT_NONE is required to keep your data (dirty pages!), mmap isn't
<heat_> zid`, MAP_FIXED always succeeds on overlap unless it for some reason can't remove the mapping
Left_Turn has joined #osdev
<zid`> but does it remove theoverhang too
<heat_> no
<zid`> or leave it and I now have to call munmap at start+size
<zid`> and start
<heat_> yep
<zid`> neat
<zid`> what if I call munmap in the middle, do I get to delete half?
<heat_> there's MAP_FIXED_NOREPLACE that takes care of failing when overlaps happen
<gorgonical> aggravating
<heat_> zid`, yes
<zid`> neat
<gorgonical> seems I must have misread the code and also my advisor did too lol
<gorgonical> Or maybe just misunderstanding
<heat_> i am now your advisor
<heat_> give me money give me
<gorgonical> my advisor pays me
<heat_> hello its me your advisor i gave you money give me money give me
<gorgonical> Not much, but the money flows in that direction
<gorgonical> well damn. I guess I just implemented mprotect inside of mmap
<gorgonical> Does raise the question of if you can actually use mmap to do this or if most OSes would reject that
eddof13 has joined #osdev
<heat_> ok but srsly ldso only seems to mmap_fixed if 1) the .so isn't contiguous in virtual memory 2) to map the bss
<heat_> to do what? mprotect? sure, you're required to
<zid`> calling mprotect means either you fucked up your mmap
<heat_> it has the funny side effect of forcibly freeing dirty pages, which PROT_NONE wouldn't do
<zid`> or you want to make your plt read only
<zid`> true fact
<heat_> in this case, no, cuz you always need one big mapping for each dso
<heat_> in order to place it in virtual memory
<heat_> then you'll get to breaking it down and mapping the correct offsets
<zid`> gorgonical: heat is just gaslamping you
<gorgonical> the discontiguous mapping is what's happening at around 779?
<gorgonical> oh so that shit is just to map in the bss for that segment
<zid`> nobody took my funny bait :(
<gorgonical> i just assumed it was some quirky britishism
<gorgonical> like how you call chips crisps
<heat_> cheaps
<heat_> gorgonical, yes that's bss
<heat_> it's also not what you're supposed to look at
<heat_> ignore DL_FDPIC
<heat_> look at 844 instead
<zid`> gorgonical: no it's always been gaslamping
<gorgonical> heat_: yeah that's doing the same hting right?
<heat_> yea
<gorgonical> the use of map_fixed makes perfect sense here, unlike my harebrained delusion
<gorgonical> You need whatever underlying memory is available but it has to go at this point in memory because that's the bss
<heat_> you always need an anon backing beyond possibly the first page of .bss
<heat_> unless you want it to maybe SIGBUS
<gorgonical> do .bss sections have defined length? it's not the heap
<bslsk05> ​github.com: Onyx/kernel/kernel/binfmt/elf.cpp at master · heatd/Onyx · GitHub
<heat_> yess bss sections have a defined length
<heat_> all sections do
<gorgonical> of course
<gorgonical> just making sure I still have my head on right
<zid`> no bss is infinite length
<zid`> nobody has managed to map one yet, we're still trying
<gorgonical> but if you have an in-memory so when you mmap it you *could* file-back the bss
<gorgonical> but then nobody can reuse it lol
<zid`> I have no idea what any of those words means
<zid`> bss is just the part of the C program where the statics are allocated
<zid`> done
<gorgonical> if your .so is on an in-memory fs
<zid`> how are you supposed to reuse it?
<gorgonical> then you could just actually put the bss where the elf lives, in memory
<zid`> it doesn't exist on the fs
<heat_> you can't file-back the bss because it can be larger than the file
<zid`> that's the point of the bss
<zid`> it's "this area is just 0s, so I'm only recording the size"
<zid`> then you mmap some space for it, p->phr_memsz or whatever it is, and memset it to 0, or use a real OS that returns zero'd memory
<gorgonical> I am just generating bad ideas, but you could totally allocate the bss space directly after the end of the elf in memory, so when you mapped it in you could just do one big contiguous map
<zid`> rather than _filesz like .data
<zid`> yes, you could, but then that's not bss
<gorgonical> because then it would be shared between all uses of that .so which is not correct
<zid`> and you can do it anyway with .data : { .data (*.o); .bss (*.o); }
<zid`> which is how you make rom images
<gorgonical> yes exactly
<zid`> it's pointless unless you are infact, nommu
<heat_> gorgonical, no it wouldn't??
<heat_> MAP_PRIVATE bud
<zid`> I don't understand how you intend to reuse data
<gorgonical> yeah but then you have to do some copy on write shit or you have to allocate anonymous backings anyway
<zid`> .bss is for *statics*, not immutable stringibois
<zid`> exactly
<zid`> now we're eating loads of page faults for no reason, yay
<heat_> MAP_PRIVATE does copy on write shit per the POSIX spec
<zid`> just fukin allocate it
<zid`> like a real woman
<heat_> you'd eat exactly as many page faults as you would, normally
<zid`> none
<zid`> is how many I'd normally eat
<gorgonical> why does posix specify how my os has to implement map_private?
<heat_> page faults are yummy have you tried them?
<heat_> what
<gorgonical> that's what you just said
<gorgonical> to be posix-compliant my OS *must* do COW for private mappings?
<heat_> oh sorry
<heat_> mmap(2) is not quite like POSIX there
<heat_> it just says "If MAP_PRIVATE is specified, modifications to the mapped data by the calling process shall be visible only to the calling process and shall not change the underlying object."
<gorgonical> that makes more sense
<gorgonical> obv cow is faster but certainly not the only way to accomplish that
<heat_> >The MAP_PRIVATE function can be implemented efficiently when memory protection hardware is available. When such hardware is not available, implementations can implement such "mappings" by simply making a real copy of the relevant data into process private memory, though this tends to behave similarly to read().
<heat_> this implies you want CoW
<heat_> as was done always
<zid`> this is the "I would like cow behavior" flag
<gorgonical> moo moo
<gorgonical> of course
<heat_> i'm not sure if MAP_PRIVATE was ever implemented in a real UNIX without CoW
<gorgonical> well then in what way is an anonymous mapping not just malloc? you can specify protections for it?
<zid`> that is infact
<zid`> how you implement malloc
<zid`> malloc ain't a syscall baby, it needs something behind it to back it
<gorgonical> sure sure
<gorgonical> but now you can argue that direct use of mmap like this is a code smell
<gorgonical> stinky
<heat_> what
<zid`> why?
<zid`> why would you use the mmap wrapper with byte tracking
<zid`> if you're not tracking bytes
<heat_> also IN WHAT WAY IS ANONYMOUS MEMORY NOT A FILE MAPPING WITH /DEV/ZERO
<heat_> EXPLAIN THIS LIBERAL DEMOCRATS
<gorgonical> it is only if you don't have write
<zid`> mmap pool allocators are the coolest innovation that C++ can't afford
<heat_> IT'S ALWAYS THE SAME
<zid`> "whaa I have to use new"
q3lont has quit [Ping timeout: 256 seconds]
<heat_> NICK CLEGG CAN'T EXPLAIN WHY HIM AND HIS BUDDIES CREATED ANONYMOUS MEMORY, WHEN FILE MAPPINGS OF /DEV/ZERO WERE JUST FINE
<zid`> is click negg still alive
<heat_> yes he works at facebook
<gorgonical> map_anon == map /dev/zero, map_private
<gorgonical> ?
<heat_> yes
netbsduser has quit [Ping timeout: 255 seconds]
<gorgonical> Yes I suppose so
<heat_> and MAP_SHARED = MAP_ANON | MAP_SHARED
<zid`> error: recursive loop detected in grammar
<gorgonical> though it doesn't have to be does it
<gorgonical> if map_shared implies no private mappings, then you could file back it
<gorgonical> implied* i should say
<heat_> for /dev/zero? yes it does have to be
<gorgonical> true
<heat_> it has been set in stone for 35 years
<gorgonical> I can't read stone so I am not constrained by your rules
<gorgonical> it just occurred to me that if you map_anon you could fuck your own mapping up if you brk() after that
<heat_> i don't think brk can overwrite mmaps
<heat_> but i'm not too sure on that
<gorgonical> unless some fancypants decided to track the end of mmap and reject calls where they would collide
<heat_> also: thats not usually a problem cuz mmap and brk both start at opposite ends of the address space
<gorgonical> also true
<gorgonical> wait but then does that mean your mmap could end up in an island?
<gorgonical> if you mmap stuff and heap alloc stuff, brk further, and then heap alloc a lot more stuff?
<zid`> my mmaps are already an island
<heat_> what
<zid`> gorgonical: BRKBRKRBRK....................MMAPMAPAMAMAP
<zid`> [NON CANONICAL BADLANDS]KERNLERNERLENRNEL
<heat_> KERNAL*
<gorgonical> this is a limitation of the design I've chosen then
<heat_> what are you on about
<gorgonical> my mmap allocator puts anon mappings at the top of the heap
<gorgonical> and it grows toward the heap's end, so they could collide if the heap's not big enough
<gorgonical> this is possible because applications get a pre-alloced heap
<zid`> what is
<zid`> the heap
<zid`> the heap is an abstraction on *top* of this decision, not below it
<gorgonical> the data segment
<zid`> that's an ELF abstraction
<heat_> >my mmap allocator puts anon mappings at the top of the heap
<heat_> >and it grows toward the heap's end, so they could collide if the heap's not big enough
<heat_> how? if it's already at the top?
<gorgonical> like in zid`'s diagram, if map and brk keep growing they'll hit each other eventually
<zid`> that's called
<zid`> running out of memory
<gorgonical> yes
<zid`> you can't do anything about that
<zid`> for.. obvious reasons
<gorgonical> indeed you cannot
<heat_> right
<gorgonical> no demand paging means you get some memory at the beginning of your life and it's yours until you die
<gorgonical> and that's all you get basically
<gorgonical> though i guess applications could do some exciting tricks to acquire new memory, like abusing the in_mem_fs to create files and then map thoes in
<zid`> heat_: Can I have enough dimms to allocate 48 bits of memory pls
<heat_> yes but i dont have em
<zid`> what's 2^48 in human numbers
<gorgonical> "a lot"
<bslsk05> ​'Clean Coders Hate What Happens to Your Code When You Use These Enterprise Programming Tricks' by NDC Conferences (01:11:23)
<zid`> 2^30 is a gigabyte right? so 2^18 gigglebytes
<heat_> 2^48 is 256TiB IIRC
<zid`> 2^16 is 65000, so a quarter million gigglebytes.. 250TB
<zid`> 256TiB
<zid`> not bad
eddof13 has quit [Quit: eddof13]
<zid`> side note, had you just asked me how much address space is in kernel and user space
<zid`> I'd have been able to say -256TB to 256TB, oops
<zid`> brains are stupid
vdamewood has joined #osdev
roper has quit [Quit: chao]
<gorgonical> Makes me wonder how many implementations support read-only anonymous mappings
goliath has joined #osdev
<heat_> all of them
<gorgonical> but what would the point be
<zid`> JITs?
<gorgonical> I think that implies also MAP_SHARED right?
<zid`> share wit who?
<gorgonical> I don't know. That's what I'm asking
<zid`> you're the one who suggested it
<zid`> not me
<zid`> why would I know
<gorgonical> What's the point of a zeroed, read-only region of memory?
<gorgonical> just to look at it?
<zid`> > JIT
<heat_> there's no particular point
<heat_> it just... works
<zid`> mprotecting off the SHF_WRITE is perfectly logical
<zid`> that gives you a read only mapping full of juicy bytecode
<gorgonical> yeah in combination with mprotect it makes sense
<heat_> it may be that you're mmap'ing PROT_READ (or PROT_NONE) to mprotect it back later
<gorgonical> but then why start with it ro
<heat_> i don't fucking know gorgonical
<zid`> or dup2ing the region to a protected userspace one, from kernelspace
<heat_> there's just no reason you should not support this
<heat_> it's a trivial thing
<gorgonical> indeed it is
<heat_> like mmap(PROT_READ) = mmap(PROT_WRITE | PROT_EXEC | PROT_READ) + mprotect(PROT_READ)
eddof13 has joined #osdev
Piraty has quit [Quit: -]
Piraty has joined #osdev
<zid`> heat_: day 3 done?
<heat_> no
<zid`> dw, you'll figure out how to do it eventually
<zid`> we believe in you
Piraty has quit [Quit: -]
Piraty has joined #osdev
raphaelsc has joined #osdev
eddof13 has quit [Quit: eddof13]
eddof13 has joined #osdev
<bslsk05> ​modarchive.org: The Mod Archive v4.0b - A distinctive collection of modules - longstabben - longstab.xm (XM)
* kof123 blinks
<ghostbuster> do the brk/sbrk posix syscalls depend on memory segmentation? does that mean they don't work on ARM (because no segmentation)
<ghostbuster> or aarch64 if you prefer
<Cindy> there's a mistake in the m68000 family programmer book
<Cindy> where BFFFO and BFEXTU has the same opcode format
<Cindy> like wtf
<Cindy> i keep flipping between pages to realize the opcode format is the EXACT same between 2 instructions, even though it shouldn't be
<nortti> ghostbuster: no. why would they?
<ghostbuster> a lot of the descriptions of sbrk i've found say it manages memory by resizing the "data segment"
<nortti> ah, that's a different sense of "segment"
<ghostbuster> is it the same segment as in "segmentation fault"
<nortti> yeah
<nortti> to simplify a bit, in early unix the program was split into text segment (code) and data segment (data). by default the data segment would be only as big as needed to hold the .data section of the executable
<ghostbuster> those segments were initially implemented with the help of the segment registers on x86?
<nortti> no. this was on the pdp-11 which (again, to simplify a bit) has a similar but different mechanism that's also called segments
<nortti> the whole segment thing became no longer relevant once unix was ported to 32-bit architectures with paging
<nortti> it's just stuck around in some terminology
<ghostbuster> where do the funky x86 registers come in
<zid`> nowhere
<zid`> unless you want them to
<zid`> do you want them to?
<heat_> there was never an x86 UNIX with segmentation
eddof13 has quit [Quit: eddof13]
<heat_> xenix already used the MMU
<nortti> I *think* there was a 286 port of xenix that used segments, but don't quote me on that
<heat_> 286? that doesn't sound very plausible, sysv was 32-bit only
<ghostbuster> my angle is to learn about malloc internals, from a security perspective
craigo has quit [Ping timeout: 255 seconds]
<zid`> 286 had PROTECTION
<zid`> go read the source then?
<ghostbuster> thanks
<zid`> glibc malloc, jemalloc,etc
<zid`> are all just.. out there
<nortti> heat_: early xenix was v7-based, not sysv
<ghostbuster> yeh, just trying to understand the history of brk
<ghostbuster> i guess it has nothing to do with SS/DS/etc so I don't need to worry about those
<zid`> You never do
<nortti> https://www.os2museum.com/wp/ibm-xenix-1-0-incompatibility-details/ looks like it's using the descriptor tables on 286 at least
<bslsk05> ​www.os2museum.com: IBM XENIX 1.0 Incompatibility Details | OS/2 Museum
<zid`> they're basically force disabled on everything but a 386
<zid`> The only segment regs that get used are fs and gs, but they're used with weird nonstandard kernel mode instructions, to implement TLS
<ghostbuster> nonstandard mean not conforming to x86/64?
<heat_> no
<ghostbuster> oh
<ghostbuster> nonstandard how then?
<zid`> meaning they don't act like cs/ds/es/ss
<zid`> you can't load them with values
<ghostbuster> ah
<zid`> you write to weird MSRs and use 'swapgs' and shit instead
<zid`> it's all very silly
gbowne1 has joined #osdev
gbowne1 has quit [Remote host closed the connection]
gbowne1 has joined #osdev
raphaelsc has quit [Quit: Leaving]
raphaelsc has joined #osdev
eddof13 has joined #osdev
Left_Turn has quit [Read error: Connection reset by peer]
eddof13 has quit [Quit: eddof13]
eddof13 has joined #osdev
eddof13 has quit [Client Quit]
eddof13 has joined #osdev
[itchyjunk] has joined #osdev
pretty_dumm_guy has quit [Quit: WeeChat 3.5]