From patchwork Fri Jun 9 11:13:10 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Nikolay Borisov X-Patchwork-Id: 105558 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a59:994d:0:b0:3d9:f83d:47d9 with SMTP id k13csp872084vqr; Fri, 9 Jun 2023 04:25:00 -0700 (PDT) X-Google-Smtp-Source: ACHHUZ55RP76cCFWW38Z/5Gzeftr7TEjugiKl+6ypWz85drC29ob7CH5KaL2fjtEyFiuder++umJ X-Received: by 2002:a05:6a20:918f:b0:10f:f672:6e88 with SMTP id v15-20020a056a20918f00b0010ff6726e88mr696302pzd.4.1686309900435; Fri, 09 Jun 2023 04:25:00 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1686309900; cv=none; d=google.com; s=arc-20160816; b=DqOB45nP3tZEHiNB6LW1Ar4SrcO6bCKE7syFb6S5+xvGerZjwZ9sNTMdud+Z6SFBWL vSmuzjo2hAEQSVdfKS6M+dMEMrkjNXLsMAJae3cM7kKGHkgBn3Qgk2CWesF+EqyT9RbR JWTiLNIedFdKyVcytMr50q5N9StL89fk7r3GKse/NgQi+qZ8OPrsFbaiXy+fhGkAeSXl ROsdjQPoMBRsVK8NHnZlyIStajseuDmRrLKcJ2xTMq0qNlNloxxrEyMTObAnvDSIr9Zh jAkgzqe2DsVmyIdzOArBDlZ/MjW9rr8Bk/+8h9ujf+7Fu9NTDmLu3Rib0UUckSDIasSr ilhg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :dkim-signature; bh=8Bsnn3ZvwL3jkB5fYcFeMyxQu6CGb7wI0Eum5AnPafo=; b=kWkXegdyFoJSEBucq+8jOPAXDhK7MUayCgqGpkYiGx8SNlOCHlWZRh2Zv7sK43y/sO NywwmfrR1EfJ6hGZRAldcvk/0HzJQI3SNtselu475hCl9nhrApOCTNZROnBglTdDlhMu T8na5vL/Ns4xzDhHw7jMHHOi1iTASj4PACkYC/bIgndi0/Y6y/0vKW+cBcum2r/1qf/+ hKTV8V6R9jS04oPAfGneHoPRIGwGkA8eMrUiOu5MqHAiky7Qyj2OfKoFeteFPDFB00Ud TR/ZnIPmfKlJVarAM72DmtkY9kh2lXjgcm6jEUvBW7PeiQPwR/W1L1Lf4qJFXWw7jWOP Dwmw== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@suse.com header.s=susede1 header.b="OX/qyPwN"; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=suse.com Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id n7-20020a170902e54700b001adf26a9390si2697816plf.191.2023.06.09.04.24.44; Fri, 09 Jun 2023 04:25:00 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@suse.com header.s=susede1 header.b="OX/qyPwN"; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=suse.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S239266AbjFILNb (ORCPT + 99 others); Fri, 9 Jun 2023 07:13:31 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:57048 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S238991AbjFILNS (ORCPT ); Fri, 9 Jun 2023 07:13:18 -0400 Received: from smtp-out2.suse.de (smtp-out2.suse.de [195.135.220.29]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 6083F2113 for ; Fri, 9 Jun 2023 04:13:17 -0700 (PDT) Received: from imap2.suse-dmz.suse.de (imap2.suse-dmz.suse.de [192.168.254.74]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-521) server-digest SHA512) (No client certificate requested) by smtp-out2.suse.de (Postfix) with ESMTPS id 19A471FDF2; Fri, 9 Jun 2023 11:13:16 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=suse.com; s=susede1; t=1686309196; h=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc: mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=8Bsnn3ZvwL3jkB5fYcFeMyxQu6CGb7wI0Eum5AnPafo=; b=OX/qyPwNWV6gO9OKITAPQ6wDiGhtagZFt2q2cnd2SnjCyQCU9/Mvy8PtfVp24tPkRlgJyl hFx+AWKfEROmKYu+Fxsa9plDRjd+O6JGg6bX/ZWk/FGek0TVSAhezsY+V+dvu2kyQuLoqe U0Qgt4ywpIUxQgS06NbhNoCWHV6kMJo= Received: from imap2.suse-dmz.suse.de (imap2.suse-dmz.suse.de [192.168.254.74]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-521) server-digest SHA512) (No client certificate requested) by imap2.suse-dmz.suse.de (Postfix) with ESMTPS id B7508139C8; Fri, 9 Jun 2023 11:13:15 +0000 (UTC) Received: from dovecot-director2.suse.de ([192.168.254.65]) by imap2.suse-dmz.suse.de with ESMTPSA id GHgTKksJg2ReIwAAMHmgww (envelope-from ); Fri, 09 Jun 2023 11:13:15 +0000 From: Nikolay Borisov To: x86@kernel.org Cc: linux-kernel@vger.kernel.org, mhocko@suse.com, jslaby@suse.cz, Nikolay Borisov Subject: [PATCH v2 3/4] x86/entry: Disable IA32 syscall if ia32_disabled is true Date: Fri, 9 Jun 2023 14:13:10 +0300 Message-Id: <20230609111311.4110901-4-nik.borisov@suse.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20230609111311.4110901-1-nik.borisov@suse.com> References: <20230609111311.4110901-1-nik.borisov@suse.com> MIME-Version: 1.0 X-Spam-Status: No, score=-4.4 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_MED,SPF_HELO_NONE, SPF_PASS,T_SCC_BODY_TEXT_LINE,URIBL_BLOCKED autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1768224090526496113?= X-GMAIL-MSGID: =?utf-8?q?1768224090526496113?= First stage of disabling ia32 compat layer is to disable 32bit syscall entry points. Legacy int 0x80 vector is disabled by zeroing out its gate descriptor in the idt and the sysenter vector is disabled by re-using the existing code in case IA32_EMULATION is disabled. Signed-off-by: Nikolay Borisov --- arch/x86/include/asm/desc.h | 1 + arch/x86/kernel/cpu/common.c | 37 ++++++++++++++++++------------------ arch/x86/kernel/idt.c | 7 +++++++ 3 files changed, 27 insertions(+), 18 deletions(-) diff --git a/arch/x86/include/asm/desc.h b/arch/x86/include/asm/desc.h index ab97b22ac04a..1182a5b10be9 100644 --- a/arch/x86/include/asm/desc.h +++ b/arch/x86/include/asm/desc.h @@ -8,6 +8,7 @@ #include #include #include +#include #include #include diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c index b20774181e1a..3c4055184d0f 100644 --- a/arch/x86/kernel/cpu/common.c +++ b/arch/x86/kernel/cpu/common.c @@ -2053,24 +2053,25 @@ void syscall_init(void) wrmsr(MSR_STAR, 0, (__USER32_CS << 16) | __KERNEL_CS); wrmsrl(MSR_LSTAR, (unsigned long)entry_SYSCALL_64); -#ifdef CONFIG_IA32_EMULATION - wrmsrl_cstar((unsigned long)entry_SYSCALL_compat); - /* - * This only works on Intel CPUs. - * On AMD CPUs these MSRs are 32-bit, CPU truncates MSR_IA32_SYSENTER_EIP. - * This does not cause SYSENTER to jump to the wrong location, because - * AMD doesn't allow SYSENTER in long mode (either 32- or 64-bit). - */ - wrmsrl_safe(MSR_IA32_SYSENTER_CS, (u64)__KERNEL_CS); - wrmsrl_safe(MSR_IA32_SYSENTER_ESP, - (unsigned long)(cpu_entry_stack(smp_processor_id()) + 1)); - wrmsrl_safe(MSR_IA32_SYSENTER_EIP, (u64)entry_SYSENTER_compat); -#else - wrmsrl_cstar((unsigned long)entry_SYSCALL32_ignore); - wrmsrl_safe(MSR_IA32_SYSENTER_CS, (u64)GDT_ENTRY_INVALID_SEG); - wrmsrl_safe(MSR_IA32_SYSENTER_ESP, 0ULL); - wrmsrl_safe(MSR_IA32_SYSENTER_EIP, 0ULL); -#endif + if ((IS_ENABLED(CONFIG_IA32_EMULATION) && ia32_disabled) || + !IS_ENABLED(CONFIG_IA32_EMULATION)) { + wrmsrl_cstar((unsigned long)entry_SYSCALL32_ignore); + wrmsrl_safe(MSR_IA32_SYSENTER_CS, (u64)GDT_ENTRY_INVALID_SEG); + wrmsrl_safe(MSR_IA32_SYSENTER_ESP, 0ULL); + wrmsrl_safe(MSR_IA32_SYSENTER_EIP, 0ULL); + } else { + wrmsrl_cstar((unsigned long)entry_SYSCALL_compat); + /* + * This only works on Intel CPUs. + * On AMD CPUs these MSRs are 32-bit, CPU truncates MSR_IA32_SYSENTER_EIP. + * This does not cause SYSENTER to jump to the wrong location, because + * AMD doesn't allow SYSENTER in long mode (either 32- or 64-bit). + */ + wrmsrl_safe(MSR_IA32_SYSENTER_CS, (u64)__KERNEL_CS); + wrmsrl_safe(MSR_IA32_SYSENTER_ESP, + (unsigned long)(cpu_entry_stack(smp_processor_id()) + 1)); + wrmsrl_safe(MSR_IA32_SYSENTER_EIP, (u64)entry_SYSENTER_compat); + } /* * Flags to clear on syscall; clear as much as possible diff --git a/arch/x86/kernel/idt.c b/arch/x86/kernel/idt.c index a58c6bc1cd68..d1f388ef2e66 100644 --- a/arch/x86/kernel/idt.c +++ b/arch/x86/kernel/idt.c @@ -226,6 +226,13 @@ void __init idt_setup_early_traps(void) void __init idt_setup_traps(void) { idt_setup_from_table(idt_table, def_idts, ARRAY_SIZE(def_idts), true); + + if (IS_ENABLED(CONFIG_IA32_EMULATION) && ia32_disabled) { + gate_desc null_desc = {}; + write_idt_entry(idt_table, IA32_SYSCALL_VECTOR, &null_desc); + clear_bit(IA32_SYSCALL_VECTOR, system_vectors); + } + } #ifdef CONFIG_X86_64