Re: why pager in utcb

[Wei Shen]
> Hi,
> I studied the pistachio kernel and found the pager thread id of a
> thread is saved in its utcb. Why not save the pager attribute in
> tcbs as the scheduler?

You can do no harm (except to yourself) by changing your own pager.  A
scheduler, on the other hand, has certain privileges and you therefore
need to restrict the system from designating arbitrary threads as
schedulers.  This is the reason why setting the scheduler is a
privileged operation.  The only reason why the pager can also be set
using ThreadControl is that the pager needs to be set in order to
serve the initial page faults raised by a newly created thread.

> IMHO, it may cause some security problems if a thread can freely
> change its pager. For example envn if we prohibit the direct IPC
> between two threads, they may still be possible to exploit page
> fault IPC to achieve communication. And we may have to check
> pagefault IPC to avoid such problems, which I think is not a good
> idea for performance consideration.

Page fault RPCs are regular IPC operations.  If two threads are not
allowed to communicate via IPC, this also includes page fault RPCs.

> If I modify the kernel so that threads' pagers are stored in tcbs
> and can only be altered through thread_control privileged system
> call, whether current applications (e.g. kenge and iguana) on
> pistachio will be affected?  How severe the result is? Could you
> give some thoughts on the demand for unprivileged pager
> modification?

I don't see why you want to do these changes.  There does indeed exist
a case where you don't want an application to be able to change its
pager, but the case that you gave above is not it.

	eSk