From patchwork Fri Jun 23 11:14:04 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Nikolay Borisov X-Patchwork-Id: 112079 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a59:994d:0:b0:3d9:f83d:47d9 with SMTP id k13csp5698758vqr; Fri, 23 Jun 2023 04:28:50 -0700 (PDT) X-Google-Smtp-Source: ACHHUZ7inoFe5uV987982WKxof3ndWcCsfCEFi1N9zTvxZEA7UKOnGdbBokD9NLyxcE9Q5pxBAcI X-Received: by 2002:a05:6a20:4313:b0:11e:e940:441e with SMTP id h19-20020a056a20431300b0011ee940441emr16031607pzk.25.1687519729944; Fri, 23 Jun 2023 04:28:49 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1687519729; cv=none; d=google.com; s=arc-20160816; b=CTPys/0cFTkuEy7CNJdyDDldNfoEtE9C6fk4VU1KzMPrtI/FX1fLeJZE+yzSAN4pZk E9nkNcK1b7GXPvkjyRQDQzUGCz9iyYcDcibC01nFMP5FPgwqJvOlFSXbRc9tDKvYHbFj C62OtzxK5ivnod75Gac4yqtbdG75vO+iwnpW83V8117BAxD0aKscEcemPfvBovVlwcPX Ll1OF08t0m3nVyWbj6jRqXmTVIpNs3LWSGGMB+V8NaBVXboM3WZOM6ktcNGRrHd5QkNt 6UUC82DJS9/aG+ekOV+BcbXFCNfubBO8SHEiFGy6o8ci+SZJHUl6ZDxHXV90nd1Z1sAv zVvw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :dkim-signature; bh=AYuj5naZGeFE0xaFXho8MoJJxnJ3BHmuLKgH1l9RAc8=; b=SjV7g7oIgJsnng1qBS53HPxyneA0ODZTBnxUsluBMvB1OM+aj55R5vuhsGHM4hP3qN 87SmzPn+cll67dNgY2KQncDRGB6YzP5EmjcPjQaCT35B4wfRGGWHQPK5M8wlFdU8pKpw 3wBQY6N2Z3XEP6tLaWOs6zyxN9Aa/7Ce7OEsrHyb1/qWg0p5i2hn/rY2sMSNwOwa/SHd KG0P3vrxWL78g31LQypPXq75fuDEtb1Q7hH3k0HuON5kF66BNEJw8SlHLBxEsgWa/Fys SGOn/A6AWjBDCNw8ZXJCHYUXrPVFCS+7SR0ZSOxf4uXJbqYw0Wev5Q7hGVRu3qfT6Lj9 NzQQ== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@suse.com header.s=susede1 header.b=qeafabWY; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=suse.com Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id k10-20020a170902c40a00b001b23b699747si10089401plk.10.2023.06.23.04.28.36; Fri, 23 Jun 2023 04:28:49 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@suse.com header.s=susede1 header.b=qeafabWY; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=suse.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231820AbjFWLOU (ORCPT + 99 others); Fri, 23 Jun 2023 07:14:20 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:54758 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229451AbjFWLOQ (ORCPT ); Fri, 23 Jun 2023 07:14:16 -0400 Received: from smtp-out1.suse.de (smtp-out1.suse.de [195.135.220.28]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 85F0DB7 for ; Fri, 23 Jun 2023 04:14:15 -0700 (PDT) Received: from imap2.suse-dmz.suse.de (imap2.suse-dmz.suse.de [192.168.254.74]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-521) server-digest SHA512) (No client certificate requested) by smtp-out1.suse.de (Postfix) with ESMTPS id 3341021B12; Fri, 23 Jun 2023 11:14:14 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=suse.com; s=susede1; t=1687518854; h=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc: mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=AYuj5naZGeFE0xaFXho8MoJJxnJ3BHmuLKgH1l9RAc8=; b=qeafabWYCNR+xeqCAO7OzR4ueyvG2NgkXINY4JmKwTLYfTZmHo4hzIJDQ0Gv0bT48yN4HT zMl96mZ2JNNps134yjbi/J0sV/ZGrXOJ9gSHEmY2DnBBO/kb0RlxELe02ayyHOms8EiW3X ybMExMxcjKJy2UuDNSqAN3jIyRP6cJI= Received: from imap2.suse-dmz.suse.de (imap2.suse-dmz.suse.de [192.168.254.74]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-521) server-digest SHA512) (No client certificate requested) by imap2.suse-dmz.suse.de (Postfix) with ESMTPS id C79151331F; Fri, 23 Jun 2023 11:14:13 +0000 (UTC) Received: from dovecot-director2.suse.de ([192.168.254.65]) by imap2.suse-dmz.suse.de with ESMTPSA id CF7kLYV+lWTcFAAAMHmgww (envelope-from ); Fri, 23 Jun 2023 11:14:13 +0000 From: Nikolay Borisov To: x86@kernel.org Cc: linux-kernel@vger.kernel.org, mohocko@suse.com, jslaby@suse.cz, Nikolay Borisov Subject: [PATCH v4 1/6] x86: Introduce ia32_enabled() Date: Fri, 23 Jun 2023 14:14:04 +0300 Message-Id: <20230623111409.3047467-2-nik.borisov@suse.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20230623111409.3047467-1-nik.borisov@suse.com> References: <20230623111409.3047467-1-nik.borisov@suse.com> MIME-Version: 1.0 X-Spam-Status: No, score=-4.4 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_MED,SPF_HELO_NONE, SPF_PASS,T_SCC_BODY_TEXT_LINE,URIBL_BLOCKED autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1769492688225577697?= X-GMAIL-MSGID: =?utf-8?q?1769492688225577697?= IA32 support on 64bit kernels depends on whether CONFIG_IA32_EMULATION is selected or not. As it is a compile time option it doesn't provide the flexibility to have distributions set their own policy for IA32 support and give the user the flexibility to override it. As a first step introduce ia32_enabled() which abstracts whether IA32 compat is turned on or off. Upcoming patches will implement the ability to set IA32 compat state at boot time. Signed-off-by: Nikolay Borisov --- arch/x86/entry/common.c | 4 ++++ arch/x86/include/asm/ia32.h | 16 +++++++++++++++- 2 files changed, 19 insertions(+), 1 deletion(-) diff --git a/arch/x86/entry/common.c b/arch/x86/entry/common.c index 6c2826417b33..ef5a154a7413 100644 --- a/arch/x86/entry/common.c +++ b/arch/x86/entry/common.c @@ -96,6 +96,10 @@ static __always_inline int syscall_32_enter(struct pt_regs *regs) return (int)regs->orig_ax; } +#ifdef CONFIG_IA32_EMULATION +bool __ia32_enabled = true; +#endif + /* * Invoke a 32-bit syscall. Called with IRQs on in CONTEXT_KERNEL. */ diff --git a/arch/x86/include/asm/ia32.h b/arch/x86/include/asm/ia32.h index fada857f0a1e..5a2ae24b1204 100644 --- a/arch/x86/include/asm/ia32.h +++ b/arch/x86/include/asm/ia32.h @@ -68,6 +68,20 @@ extern void ia32_pick_mmap_layout(struct mm_struct *mm); #endif -#endif /* CONFIG_IA32_EMULATION */ +extern bool __ia32_enabled; + +static inline bool ia32_enabled(void) +{ + return __ia32_enabled; +} + +#else /* !CONFIG_IA32_EMULATION */ + +static inline bool ia32_enabled(void) +{ + return IS_ENABLED(CONFIG_X86_32); +} + +#endif #endif /* _ASM_X86_IA32_H */ From patchwork Fri Jun 23 11:14:05 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Nikolay Borisov X-Patchwork-Id: 112075 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a59:994d:0:b0:3d9:f83d:47d9 with SMTP id k13csp5692145vqr; Fri, 23 Jun 2023 04:16:19 -0700 (PDT) X-Google-Smtp-Source: ACHHUZ7AM6oR02FbqUuktq8nJw65J1pX0Bm0faKEqpKEnvyu4rlHWlQurlrK/qq9c0sGLCuqdtbh X-Received: by 2002:a05:6a00:134c:b0:668:7292:b2c5 with SMTP id k12-20020a056a00134c00b006687292b2c5mr20062421pfu.4.1687518979274; Fri, 23 Jun 2023 04:16:19 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1687518979; cv=none; d=google.com; s=arc-20160816; b=IAH+hs+U+XirgO+rtrVaR5Tpe00ilx5WLXPNDRVojtC+mVgxEFRfnxlgHwtpEF3k5u Wm4DwWhQ9zcyD07GzQPDZv0qQ4bivymCiFvZ+8Ddd0LdiCAeublqdjv4dKFngRIbfpR4 K8ybtwe6a3HhcuYAj8b/KgivIF17sYoXZEkvmr95sULq4FubKIrj8VpeCGtDVNXBFApO 02AWNGVtovHq6vbNztsE71dSdGytSklnJS2JDonXoP5805vmUluNAzfQmz9SZaDcOwM/ R05EtP7S/8twKnOklKngH8vQHH8sIiJp3BV/M+MZOR3VXsC6V16FrZ3cwnZM4XJEeA4+ En2g== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :dkim-signature; bh=EQ/DfJOw6rhJ0Q8RfJ8V8sAvnYjehg1AbCaXsmtUdXc=; b=SewHRbYsyqg90tp2i4nQ6mSdGoPP/lHyqyvM+t/u2QJLWQxgy8SbXbp+qsij2YJ+sa aigHrfnJ/GGJ9DIch+NWsZPW9NWNFtoF568a/Rcjp3pCQmHGJ9Q2EPdo3Xdk45oTWvE8 UMZRULwqmbtsnd7dai/jW6xy/TCK+m6yRFzYOjoU8la63zW6J9qK2d0oNFNaW9oemWb2 n+AR2NAW8dtc4yN0Mbio9/l3RyHnzZ8I/D4lHxaP+C1dq+flLLnNiIIaieNP5kG1fvi5 Iq6lQFf9F4Xvq1Ci142e3STnxQyP4ZGiZjL2vBa8ZPdZcelsCq6PZ54EYroVWJg9VKAe CN6A== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@suse.com header.s=susede1 header.b="aT0CMxf/"; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=suse.com Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id b188-20020a621bc5000000b006695704e631si7439428pfb.176.2023.06.23.04.16.06; Fri, 23 Jun 2023 04:16:19 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@suse.com header.s=susede1 header.b="aT0CMxf/"; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=suse.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231910AbjFWLO1 (ORCPT + 99 others); Fri, 23 Jun 2023 07:14:27 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:54774 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231764AbjFWLOR (ORCPT ); Fri, 23 Jun 2023 07:14:17 -0400 Received: from smtp-out2.suse.de (smtp-out2.suse.de [195.135.220.29]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 72B96199D for ; Fri, 23 Jun 2023 04:14:16 -0700 (PDT) Received: from imap2.suse-dmz.suse.de (imap2.suse-dmz.suse.de [192.168.254.74]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-521) server-digest SHA512) (No client certificate requested) by smtp-out2.suse.de (Postfix) with ESMTPS id A80811F45E; Fri, 23 Jun 2023 11:14:14 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=suse.com; s=susede1; t=1687518854; h=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc: mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=EQ/DfJOw6rhJ0Q8RfJ8V8sAvnYjehg1AbCaXsmtUdXc=; b=aT0CMxf//mOxtK2JGQPKVgpvdTBAyDmbfDByK0o1HQicMpOBP454WZ0xknayZaSYAWsfu2 qhROwC4p2hvnzUkvOHibMENz/6ArlnvWCP5E7PabNv8atyRDrq+Ea2khKy4KiZR4GLm6lq Xsh/56BYRkOM0KZln5iXqf9qC9jsrfQ= Received: from imap2.suse-dmz.suse.de (imap2.suse-dmz.suse.de [192.168.254.74]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-521) server-digest SHA512) (No client certificate requested) by imap2.suse-dmz.suse.de (Postfix) with ESMTPS id 470421331F; Fri, 23 Jun 2023 11:14:14 +0000 (UTC) Received: from dovecot-director2.suse.de ([192.168.254.65]) by imap2.suse-dmz.suse.de with ESMTPSA id wAB3DoZ+lWTcFAAAMHmgww (envelope-from ); Fri, 23 Jun 2023 11:14:14 +0000 From: Nikolay Borisov To: x86@kernel.org Cc: linux-kernel@vger.kernel.org, mohocko@suse.com, jslaby@suse.cz, Nikolay Borisov Subject: [PATCH v4 2/6] x86/entry: Rename ignore_sysret() Date: Fri, 23 Jun 2023 14:14:05 +0300 Message-Id: <20230623111409.3047467-3-nik.borisov@suse.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20230623111409.3047467-1-nik.borisov@suse.com> References: <20230623111409.3047467-1-nik.borisov@suse.com> MIME-Version: 1.0 X-Spam-Status: No, score=-4.4 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_MED,SPF_HELO_NONE, SPF_PASS,T_SCC_BODY_TEXT_LINE,URIBL_BLOCKED autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1769491901422204551?= X-GMAIL-MSGID: =?utf-8?q?1769491901422204551?= The SYSCALL instruction cannot really be disabled in compatibility mode. The best that can be done is to configure the CSTAR msr to point to a minimal handler. Currently this handler has a rather misleading name - ignore_sysret() as it's not really doing anything with sysret. Give it a more descriptive name. Signed-off-by: Nikolay Borisov --- arch/x86/entry/entry_64.S | 4 ++-- arch/x86/include/asm/processor.h | 2 +- arch/x86/kernel/cpu/common.c | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/arch/x86/entry/entry_64.S b/arch/x86/entry/entry_64.S index f31e286c2977..ccce0ccd8589 100644 --- a/arch/x86/entry/entry_64.S +++ b/arch/x86/entry/entry_64.S @@ -1519,12 +1519,12 @@ SYM_CODE_END(asm_exc_nmi) * This handles SYSCALL from 32-bit code. There is no way to program * MSRs to fully disable 32-bit SYSCALL. */ -SYM_CODE_START(ignore_sysret) +SYM_CODE_START(entry_SYSCALL32_ignore) UNWIND_HINT_END_OF_STACK ENDBR mov $-ENOSYS, %eax sysretl -SYM_CODE_END(ignore_sysret) +SYM_CODE_END(entry_SYSCALL32_ignore) #endif .pushsection .text, "ax" diff --git a/arch/x86/include/asm/processor.h b/arch/x86/include/asm/processor.h index a1e4fa58b357..61c10b4e3e35 100644 --- a/arch/x86/include/asm/processor.h +++ b/arch/x86/include/asm/processor.h @@ -399,7 +399,7 @@ static inline unsigned long cpu_kernelmode_gs_base(int cpu) return (unsigned long)per_cpu(fixed_percpu_data.gs_base, cpu); } -extern asmlinkage void ignore_sysret(void); +extern asmlinkage void entry_SYSCALL32_ignore(void); /* Save actual FS/GS selectors and bases to current->thread */ void current_save_fsgs(void); diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c index 80710a68ef7d..b20774181e1a 100644 --- a/arch/x86/kernel/cpu/common.c +++ b/arch/x86/kernel/cpu/common.c @@ -2066,7 +2066,7 @@ void syscall_init(void) (unsigned long)(cpu_entry_stack(smp_processor_id()) + 1)); wrmsrl_safe(MSR_IA32_SYSENTER_EIP, (u64)entry_SYSENTER_compat); #else - wrmsrl_cstar((unsigned long)ignore_sysret); + wrmsrl_cstar((unsigned long)entry_SYSCALL32_ignore); wrmsrl_safe(MSR_IA32_SYSENTER_CS, (u64)GDT_ENTRY_INVALID_SEG); wrmsrl_safe(MSR_IA32_SYSENTER_ESP, 0ULL); wrmsrl_safe(MSR_IA32_SYSENTER_EIP, 0ULL); From patchwork Fri Jun 23 11:14:06 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Nikolay Borisov X-Patchwork-Id: 112082 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a59:994d:0:b0:3d9:f83d:47d9 with SMTP id k13csp5699711vqr; Fri, 23 Jun 2023 04:30:37 -0700 (PDT) X-Google-Smtp-Source: ACHHUZ4DrCC7rkwi59OMnvISAAV5NuSz98GZD1i3ingriIv/1O2GDlyaJ4YrVxsO3cmXoFdpinQl X-Received: by 2002:a17:903:2306:b0:1b2:436b:931c with SMTP id d6-20020a170903230600b001b2436b931cmr17914340plh.43.1687519836936; Fri, 23 Jun 2023 04:30:36 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1687519836; cv=none; d=google.com; s=arc-20160816; b=gmDRjlLrCY4ocu0sfSi3i0yS5ZSL++3Qv4bZ8KtZthN97JlB71v1vw60mmkh0jsXQn pOaNAEt/taXaEgxL4GPk5taVc+2PKfPmYcLFZxOtfliDapgO7EnyWQwMqMWTBR+ZmEo2 07GTqS+RSUOyJA9+F+z6ZBwt2QxbBTOP8oh92hUyvAaV+M8nJVj5tmthFEO2Hq5CgJV5 6/gUs6NQOKZzDZu+xr6O68z/QAKcx4Uc4yypAVgiZpMSTB4ZA+qygKLmztiFQQOg+mxV 55SrdWJEA9NuCMcDK4rN0XrCIVSOk969JjycwfggdOdfCfsNymnNxD8uS6aRyH6rx+eX b4Uw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :dkim-signature; bh=0Yy85zR9fuPHZsIKybiFZXTFB/OLmUVvR9b3i0pMJzE=; b=ZQw+8J8vq7Y5HS8ETQ3vrMYmqLitzDWc5lcCKCCj+I3mf4CrgudLNL1LlxgRUwpTeM KA8B9obYeWxMvIzUMna3YTFNmXvQ6xSlczzyjEMWx9Ux+5qn7yEAHRrE3xhv/cAjIOuY c8i8aWn/7Uqlr5zY0WZvhdkZeI7/en0OSL8HW4Nk2SJgBA2/EPnBcVg0jouWWSEcpWek rnA0pZQRBx2Qa/UGjQMGOzouK1JgTnPTnFACPK66+g3DDsb40WQCamYPSvK4PWEQsHO4 d6M3OpDVVbBrgWxuLjjZeTJCw2wefeExBWjQeXpPvb6ihqASpOXexf04CkAzuW8buLgy dcew== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@suse.com header.s=susede1 header.b=qDURYg8S; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=suse.com Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id v20-20020a170902f0d400b001aaebc66877si2023824pla.147.2023.06.23.04.30.24; Fri, 23 Jun 2023 04:30:36 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@suse.com header.s=susede1 header.b=qDURYg8S; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=suse.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231843AbjFWLOY (ORCPT + 99 others); Fri, 23 Jun 2023 07:14:24 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:54776 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231346AbjFWLOR (ORCPT ); Fri, 23 Jun 2023 07:14:17 -0400 Received: from smtp-out1.suse.de (smtp-out1.suse.de [IPv6:2001:67c:2178:6::1c]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 72D101FF9 for ; Fri, 23 Jun 2023 04:14:16 -0700 (PDT) Received: from imap2.suse-dmz.suse.de (imap2.suse-dmz.suse.de [192.168.254.74]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-521) server-digest SHA512) (No client certificate requested) by smtp-out1.suse.de (Postfix) with ESMTPS id 104EC21B15; Fri, 23 Jun 2023 11:14:15 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=suse.com; s=susede1; t=1687518855; h=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc: mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=0Yy85zR9fuPHZsIKybiFZXTFB/OLmUVvR9b3i0pMJzE=; b=qDURYg8SdKUS2CeWjKzKeaUE2JWhPqjAqw74ROnCesy7Xrt1T6opu1bv0KCx5b0kJdxR5R n2Nlp6Ku8HJK4DaAXcQeUF5NtHKmx2/kRkAMKtv6RPo3bDgj6TnSfP2oowpVrsImFXoUlB ++4SWHnumHiq1/eR7cbNFbkPSH/LDLY= Received: from imap2.suse-dmz.suse.de (imap2.suse-dmz.suse.de [192.168.254.74]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-521) server-digest SHA512) (No client certificate requested) by imap2.suse-dmz.suse.de (Postfix) with ESMTPS id AE9111331F; Fri, 23 Jun 2023 11:14:14 +0000 (UTC) Received: from dovecot-director2.suse.de ([192.168.254.65]) by imap2.suse-dmz.suse.de with ESMTPSA id EO3pJ4Z+lWTcFAAAMHmgww (envelope-from ); Fri, 23 Jun 2023 11:14:14 +0000 From: Nikolay Borisov To: x86@kernel.org Cc: linux-kernel@vger.kernel.org, mohocko@suse.com, jslaby@suse.cz, Nikolay Borisov Subject: [PATCH v4 3/6] x86/entry: Compile entry_SYSCALL32_ignore() unconditionally Date: Fri, 23 Jun 2023 14:14:06 +0300 Message-Id: <20230623111409.3047467-4-nik.borisov@suse.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20230623111409.3047467-1-nik.borisov@suse.com> References: <20230623111409.3047467-1-nik.borisov@suse.com> MIME-Version: 1.0 X-Spam-Status: No, score=-4.4 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_MED,SPF_HELO_NONE, SPF_PASS,T_SCC_BODY_TEXT_LINE,URIBL_BLOCKED autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1769492800588317343?= X-GMAIL-MSGID: =?utf-8?q?1769492800588317343?= To limit the IA32 exposure on 64bit kernels while keeping the flexibility for the user to enable it when required, the compile time enable/disable via CONFIG_IA32_EMULATION is not good enough and will be complemented with a kernel command line option. Right now entry_SYSCALL32_ignore() is only compiled when CONFIG_IA32_EMULATION=n, but boot-time enable- / disablement obviously requires it to be unconditionally available. Remove the #ifndef CONFIG_IA32_EMULATION guard. Signed-off-by: Nikolay Borisov --- arch/x86/entry/entry_64.S | 2 -- 1 file changed, 2 deletions(-) diff --git a/arch/x86/entry/entry_64.S b/arch/x86/entry/entry_64.S index ccce0ccd8589..7068af44008a 100644 --- a/arch/x86/entry/entry_64.S +++ b/arch/x86/entry/entry_64.S @@ -1514,7 +1514,6 @@ SYM_CODE_START(asm_exc_nmi) iretq SYM_CODE_END(asm_exc_nmi) -#ifndef CONFIG_IA32_EMULATION /* * This handles SYSCALL from 32-bit code. There is no way to program * MSRs to fully disable 32-bit SYSCALL. @@ -1525,7 +1524,6 @@ SYM_CODE_START(entry_SYSCALL32_ignore) mov $-ENOSYS, %eax sysretl SYM_CODE_END(entry_SYSCALL32_ignore) -#endif .pushsection .text, "ax" __FUNC_ALIGN From patchwork Fri Jun 23 11:14:07 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Nikolay Borisov X-Patchwork-Id: 112076 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a59:994d:0:b0:3d9:f83d:47d9 with SMTP id k13csp5692303vqr; Fri, 23 Jun 2023 04:16:35 -0700 (PDT) X-Google-Smtp-Source: ACHHUZ7RcXDMdTz/Yzez3GkqSKsffLzR3RWFaMvZF7ruFb/Mxv0eq17CQoRg2kJuv1ElA0P6OF9p X-Received: by 2002:a05:6a20:431f:b0:125:aeeb:f8f1 with SMTP id h31-20020a056a20431f00b00125aeebf8f1mr1193732pzk.40.1687518995017; Fri, 23 Jun 2023 04:16:35 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1687518995; cv=none; d=google.com; s=arc-20160816; b=EdwnbO7pEbbfRY2Dxh/k4PYm0jd6bBVFveTcOplUzHz/ybiq+t5+EfMJfbmh4fFli2 Fuv1WAkWaZy9GwhF+UG981qbMEY3J/8uAnXXwMyFSo+GhloxKd27gaONz/rRk2bD2Mi0 PUwtJ9x2lG5MIo0lJq0VOGB9DNiWiElu83k/24NzvrkzRImkufrX2TMJ+YYziIjR+UA/ 0c6myVTj/t2BXvXjXjK3oqCX1pT98mUxIs7peVuNtEs6QT9qOMTwDvXuMnpxzJkD3byr CMzTI4OE2Dr0jW0jkJ/XzZdftmU50wi64xDbPPXeWqFuE1RqhZikdx7s3V1OoE3HSfYQ uzZA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :dkim-signature; bh=f0VodzPEDQcX9JjZJBEDkNzZARXLsoiBYtSqjF6vfi8=; b=Pi+zB+S5uhMBo5nQNtbfZZXQUoWDx1rbrExly2ibLZu2IY9UM9f+PpPxXrBsMXJCy/ ebaAgO9cjx+ZEbquP/ewFXiyzI1XxomhxB/1LwIesfsM2Sa3NviApUW2F7yzGegdG3eK 7tRijG5P/3uI77UT2TNCJw+Kc696xVvvwiYDOcshoiy+mbQSmCzPde4k2oT7fWdOcgz3 Lb1QyE8Mc7LnXtJzyHRYwv99oxJIAPsJOGp5xdbtuiGibgAiIQUW3+8Nnic08aRmbpkf eKpCpP9t1IhSOEUDdC1+9992fhmgjHlXJ6Uxx7OM9kPB5BA6gNqhWi1EY+IAT4ODzXPq 3Zhg== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@suse.com header.s=susede1 header.b=TlbMDcQx; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=suse.com Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id b18-20020a170902d89200b001ab06251f98si8146247plz.429.2023.06.23.04.16.22; Fri, 23 Jun 2023 04:16:34 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@suse.com header.s=susede1 header.b=TlbMDcQx; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=suse.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231925AbjFWLO3 (ORCPT + 99 others); Fri, 23 Jun 2023 07:14:29 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:54782 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231767AbjFWLOR (ORCPT ); Fri, 23 Jun 2023 07:14:17 -0400 Received: from smtp-out2.suse.de (smtp-out2.suse.de [195.135.220.29]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id C65E62101 for ; Fri, 23 Jun 2023 04:14:16 -0700 (PDT) Received: from imap2.suse-dmz.suse.de (imap2.suse-dmz.suse.de [192.168.254.74]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-521) server-digest SHA512) (No client certificate requested) by smtp-out2.suse.de (Postfix) with ESMTPS id 770E41F6E6; Fri, 23 Jun 2023 11:14:15 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=suse.com; s=susede1; t=1687518855; h=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc: mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=f0VodzPEDQcX9JjZJBEDkNzZARXLsoiBYtSqjF6vfi8=; b=TlbMDcQxYXlK/x5u7ubvCPwPsUHKpUfZI2GFCE+ITXT1GnMRj8C7W0StJCYva9t3+f64O/ Fc6BaA9+wdK3ikB7F0nzb7Lxkn3Fn/eymNPmyTu4Z51VD2wn5JZ63vwZKARBD6R1AOiX+T TdRl3S2TG4GGIFFOhbEqDYmOQs8iEmY= Received: from imap2.suse-dmz.suse.de (imap2.suse-dmz.suse.de [192.168.254.74]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-521) server-digest SHA512) (No client certificate requested) by imap2.suse-dmz.suse.de (Postfix) with ESMTPS id 220221331F; Fri, 23 Jun 2023 11:14:15 +0000 (UTC) Received: from dovecot-director2.suse.de ([192.168.254.65]) by imap2.suse-dmz.suse.de with ESMTPSA id mNOEBYd+lWTcFAAAMHmgww (envelope-from ); Fri, 23 Jun 2023 11:14:15 +0000 From: Nikolay Borisov To: x86@kernel.org Cc: linux-kernel@vger.kernel.org, mohocko@suse.com, jslaby@suse.cz, Nikolay Borisov Subject: [PATCH v4 4/6] x86/elf: Make loading of 32bit processes depend on ia32_enabled() Date: Fri, 23 Jun 2023 14:14:07 +0300 Message-Id: <20230623111409.3047467-5-nik.borisov@suse.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20230623111409.3047467-1-nik.borisov@suse.com> References: <20230623111409.3047467-1-nik.borisov@suse.com> MIME-Version: 1.0 X-Spam-Status: No, score=-4.4 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_MED,SPF_HELO_NONE, SPF_PASS,T_SCC_BODY_TEXT_LINE,URIBL_BLOCKED autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1769491917754868545?= X-GMAIL-MSGID: =?utf-8?q?1769491917754868545?= Major aspect of ia32 emulation is the ability to load 32bit processes. That's currently decided (among others) by compat_elf_check_arch(). Make the macro use ia32_enabled() to decide if IA32 compat is enabled before loading a 32bit process. Signed-off-by: Nikolay Borisov --- arch/x86/include/asm/elf.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/arch/x86/include/asm/elf.h b/arch/x86/include/asm/elf.h index 18fd06f7936a..a0234dfd1031 100644 --- a/arch/x86/include/asm/elf.h +++ b/arch/x86/include/asm/elf.h @@ -7,6 +7,7 @@ */ #include +#include #include #include #include @@ -149,7 +150,7 @@ do { \ ((x)->e_machine == EM_X86_64) #define compat_elf_check_arch(x) \ - (elf_check_arch_ia32(x) || \ + ((elf_check_arch_ia32(x) && ia32_enabled()) || \ (IS_ENABLED(CONFIG_X86_X32_ABI) && (x)->e_machine == EM_X86_64)) static inline void elf_common_init(struct thread_struct *t, From patchwork Fri Jun 23 11:14:08 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Nikolay Borisov X-Patchwork-Id: 112085 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a59:994d:0:b0:3d9:f83d:47d9 with SMTP id k13csp5699796vqr; Fri, 23 Jun 2023 04:30:43 -0700 (PDT) X-Google-Smtp-Source: ACHHUZ6+jE9WpEdvmbXun4jPYNgAPHCzFdfJfbQifA9Duk6969J070FNEeFa1lUjTI9K3Pdb03Vq X-Received: by 2002:a17:90a:190f:b0:258:9995:91cb with SMTP id 15-20020a17090a190f00b00258999591cbmr17698234pjg.49.1687519842833; Fri, 23 Jun 2023 04:30:42 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1687519842; cv=none; d=google.com; s=arc-20160816; b=L6csEpvGidVOj0n4AVVj+EtgWlZwvEdwp3P2Oun3dPlFtgSrohduIIB1+FBpSXvb1W qrR4lqbvzCPW55rlNKmEvgKbGAyQ4BHCKpeadNTYxT+2fvw9/6Yc8KGddQtdgptzaPDh TqTCm1CjPT3CfsKwmZyIGh5k1g6HY77YtTLLUgrKzvFL4TzNf82GcQPswC/LksdZ4YtT LUxgA6VMedOMUJeAwP+IKnSOV88gNm7bPK4dpJhx9p7QwijguCPPe7xquZ9B947NOjyp ESFlMq7CPxwjdmwtj0rElJkLV18jiIKSBEajP0OaC2xllKOqmg44KVtEe6VzT6OAuNh/ z83g== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :dkim-signature; bh=aLQna3YJFjX1iJFd+SNHQelZENitCxnrAQsbOG2qcHg=; fh=rtBECNvN9mDo2k3LELlFgZueR3nwOrhL5NAJRC20j7A=; b=dxKUrjALye5Ih6LhGMX1Er19DOlApgeK3J2OgYQBZSyD+Zo4JjzUjKd7k0XXYgoLP/ EO9+g4j4HQ4So+/e2YFLQowGrR0yuYMF9VWrkClulIzWv0XrNfaNyg/0Hx5vqj96hKpx gCcWCbjFTpaV+ZlU2vV6+UCNQcyQfx1zcVpsJk4dk/OO54r2jstsxpJWzDipcPprjgOw JkoN4VQYqFX6pg8I3+ixdw4e21Q1hQfVjEO1axd7/l+zcVCJEAXhjyoT3WOBMxrbyE2V 6GeHZZZfBquj5Gj9g0TNlpXzFhz2XCMiORhIG/2r8/RQvhRW2gn9Q2ext8zYDPBhMsCa 8z3Q== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@suse.com header.s=susede1 header.b=u7iPIm86; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=suse.com Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id 8-20020a17090a19c800b0025ec19d478bsi1699722pjj.139.2023.06.23.04.30.30; Fri, 23 Jun 2023 04:30:42 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@suse.com header.s=susede1 header.b=u7iPIm86; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=suse.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231933AbjFWLOc (ORCPT + 99 others); Fri, 23 Jun 2023 07:14:32 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:54788 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231770AbjFWLOS (ORCPT ); Fri, 23 Jun 2023 07:14:18 -0400 Received: from smtp-out2.suse.de (smtp-out2.suse.de [195.135.220.29]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 341B310A for ; Fri, 23 Jun 2023 04:14:17 -0700 (PDT) Received: from imap2.suse-dmz.suse.de (imap2.suse-dmz.suse.de [192.168.254.74]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-521) server-digest SHA512) (No client certificate requested) by smtp-out2.suse.de (Postfix) with ESMTPS id DEB8A1F460; Fri, 23 Jun 2023 11:14:15 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=suse.com; s=susede1; t=1687518855; h=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc: mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=aLQna3YJFjX1iJFd+SNHQelZENitCxnrAQsbOG2qcHg=; b=u7iPIm86sgf6oSpl6ZWKQB17ZciWaoZGOhEehOF/CjUorTnknsj2+Hs77nHqnF23PvNjO3 +EuvqLgbfH5xFjccrouWQcgTrxeYK2y9K9jwUSvVLWZUHOs0A+Oy42tMBhgIDUZtX/JZbS voyvodtBDl5QUT6m1cxI0FN4zIjUNrw= Received: from imap2.suse-dmz.suse.de (imap2.suse-dmz.suse.de [192.168.254.74]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-521) server-digest SHA512) (No client certificate requested) by imap2.suse-dmz.suse.de (Postfix) with ESMTPS id 887BF1331F; Fri, 23 Jun 2023 11:14:15 +0000 (UTC) Received: from dovecot-director2.suse.de ([192.168.254.65]) by imap2.suse-dmz.suse.de with ESMTPSA id EP+fHod+lWTcFAAAMHmgww (envelope-from ); Fri, 23 Jun 2023 11:14:15 +0000 From: Nikolay Borisov To: x86@kernel.org Cc: linux-kernel@vger.kernel.org, mohocko@suse.com, jslaby@suse.cz, Nikolay Borisov Subject: [PATCH v4 5/6] x86/entry: Make IA32 syscalls' availability depend on ia32_enabled() Date: Fri, 23 Jun 2023 14:14:08 +0300 Message-Id: <20230623111409.3047467-6-nik.borisov@suse.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20230623111409.3047467-1-nik.borisov@suse.com> References: <20230623111409.3047467-1-nik.borisov@suse.com> MIME-Version: 1.0 X-Spam-Status: No, score=-4.4 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_MED,SPF_HELO_NONE, SPF_PASS,T_SCC_BODY_TEXT_LINE,URIBL_BLOCKED autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1769492806651924188?= X-GMAIL-MSGID: =?utf-8?q?1769492806651924188?= Another major aspect of supporting running of 32bit processes is the ability to access 32bit syscalls. Such syscalls can be invoked by using the legacy int 0x80 handler and sysenter/syscall instructions. If IA32 emulation is disabled ensure that each of those 3 distinct mechanisms are also disabled. For int 0x80 a #GP exception would be generated since the respective descriptor is not going to be loaded at all. Invoking sysenter will also result in a #GP since IA32_SYSENTER_CS contains an invalid segment. Finally, syscall instruction cannot really be disabled so it's configured to execute a minimal handler. Signed-off-by: Nikolay Borisov --- arch/x86/include/asm/proto.h | 3 +++ arch/x86/kernel/cpu/common.c | 37 ++++++++++++++++++------------------ arch/x86/kernel/idt.c | 7 +++++++ 3 files changed, 29 insertions(+), 18 deletions(-) diff --git a/arch/x86/include/asm/proto.h b/arch/x86/include/asm/proto.h index 12ef86b19910..4d84122bd643 100644 --- a/arch/x86/include/asm/proto.h +++ b/arch/x86/include/asm/proto.h @@ -36,6 +36,9 @@ void entry_INT80_compat(void); #ifdef CONFIG_XEN_PV void xen_entry_INT80_compat(void); #endif +#else /* !CONFIG_IA32_EMULATION */ +#define entry_SYSCALL_compat NULL +#define entry_SYSENTER_compat NULL #endif void x86_configure_nx(void); diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c index b20774181e1a..aafb83d1b3a7 100644 --- a/arch/x86/kernel/cpu/common.c +++ b/arch/x86/kernel/cpu/common.c @@ -59,6 +59,7 @@ #include #include #include +#include #include #include #include @@ -2053,24 +2054,24 @@ void syscall_init(void) wrmsr(MSR_STAR, 0, (__USER32_CS << 16) | __KERNEL_CS); wrmsrl(MSR_LSTAR, (unsigned long)entry_SYSCALL_64); -#ifdef CONFIG_IA32_EMULATION - wrmsrl_cstar((unsigned long)entry_SYSCALL_compat); - /* - * This only works on Intel CPUs. - * On AMD CPUs these MSRs are 32-bit, CPU truncates MSR_IA32_SYSENTER_EIP. - * This does not cause SYSENTER to jump to the wrong location, because - * AMD doesn't allow SYSENTER in long mode (either 32- or 64-bit). - */ - wrmsrl_safe(MSR_IA32_SYSENTER_CS, (u64)__KERNEL_CS); - wrmsrl_safe(MSR_IA32_SYSENTER_ESP, - (unsigned long)(cpu_entry_stack(smp_processor_id()) + 1)); - wrmsrl_safe(MSR_IA32_SYSENTER_EIP, (u64)entry_SYSENTER_compat); -#else - wrmsrl_cstar((unsigned long)entry_SYSCALL32_ignore); - wrmsrl_safe(MSR_IA32_SYSENTER_CS, (u64)GDT_ENTRY_INVALID_SEG); - wrmsrl_safe(MSR_IA32_SYSENTER_ESP, 0ULL); - wrmsrl_safe(MSR_IA32_SYSENTER_EIP, 0ULL); -#endif + if (ia32_enabled()) { + wrmsrl_cstar((unsigned long)entry_SYSCALL_compat); + /* + * This only works on Intel CPUs. + * On AMD CPUs these MSRs are 32-bit, CPU truncates MSR_IA32_SYSENTER_EIP. + * This does not cause SYSENTER to jump to the wrong location, because + * AMD doesn't allow SYSENTER in long mode (either 32- or 64-bit). + */ + wrmsrl_safe(MSR_IA32_SYSENTER_CS, (u64)__KERNEL_CS); + wrmsrl_safe(MSR_IA32_SYSENTER_ESP, + (unsigned long)(cpu_entry_stack(smp_processor_id()) + 1)); + wrmsrl_safe(MSR_IA32_SYSENTER_EIP, (u64)entry_SYSENTER_compat); + } else { + wrmsrl_cstar((unsigned long)entry_SYSCALL32_ignore); + wrmsrl_safe(MSR_IA32_SYSENTER_CS, (u64)GDT_ENTRY_INVALID_SEG); + wrmsrl_safe(MSR_IA32_SYSENTER_ESP, 0ULL); + wrmsrl_safe(MSR_IA32_SYSENTER_EIP, 0ULL); + } /* * Flags to clear on syscall; clear as much as possible diff --git a/arch/x86/kernel/idt.c b/arch/x86/kernel/idt.c index a58c6bc1cd68..41f88da58502 100644 --- a/arch/x86/kernel/idt.c +++ b/arch/x86/kernel/idt.c @@ -10,6 +10,7 @@ #include #include #include +#include #include #define DPL0 0x0 @@ -116,6 +117,9 @@ static const __initconst struct idt_data def_idts[] = { #endif SYSG(X86_TRAP_OF, asm_exc_overflow), +}; + +static const struct idt_data ia32_idt[] __initconst = { #if defined(CONFIG_IA32_EMULATION) SYSG(IA32_SYSCALL_VECTOR, entry_INT80_compat), #elif defined(CONFIG_X86_32) @@ -226,6 +230,9 @@ void __init idt_setup_early_traps(void) void __init idt_setup_traps(void) { idt_setup_from_table(idt_table, def_idts, ARRAY_SIZE(def_idts), true); + + if (ia32_enabled()) + idt_setup_from_table(idt_table, ia32_idt, ARRAY_SIZE(ia32_idt), true); } #ifdef CONFIG_X86_64 From patchwork Fri Jun 23 11:14:09 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Nikolay Borisov X-Patchwork-Id: 112099 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a59:994d:0:b0:3d9:f83d:47d9 with SMTP id k13csp5708203vqr; Fri, 23 Jun 2023 04:46:41 -0700 (PDT) X-Google-Smtp-Source: ACHHUZ7ILrJDReRilhdR0BFAYQufifixA0j7T1b8KMTsEyAPSEYtsnLgnA/qG95yOo4yYU5rJhj2 X-Received: by 2002:a17:903:22cd:b0:1b6:7f93:c595 with SMTP id y13-20020a17090322cd00b001b67f93c595mr10044657plg.50.1687520801457; Fri, 23 Jun 2023 04:46:41 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1687520801; cv=none; d=google.com; s=arc-20160816; b=FTWBYUeJX7yz/6SSgFwjWNNjmD4gB5CBd+0qgQf+DnN8EgJa48TpM+HGtk+enEDfcn 2SZARZL0BleRodF7ph6kLZHwmuaZbuc1CNqgu0FinQ/UEivzPZzYc/dU9dIyLXntLwQ6 c2CiOQkdU/wGA4QmIRWTIlek47hQxtHkdQPLQa/6W5Myw2Lcp77wmmVIvy75j/57IrOO SsV8Y2aY0/AmL3iqdTIuC+QFbzaHCTX5fsIyCr697aTysTFFl/oIjY2MkF2PncQOdEvk wpEI/aIytc/h5+jcYOPSTfMP78dBL9+/NuquNSwVZ4JehX/sbq+0BPlxklm6NaCL5UmU jWpA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :dkim-signature; bh=vd0DHG16TEfVtLv+nXFsC8K54PSpOG5XQkdb5dg46oc=; b=RQvC+1anaUoNmjW8jCFwFn+XxbJ3IgFpYq4cY4vmGO89gpwfaJ9XMGDiKruMtsgImv L7gKiGeOSREwd63blErEpAi8X2xOSpmxwxdadlVASJWsxhWYfmO67AwP3HTJRGZk2XDw 1YwimsRUf50y6FDBL0a6fio7a+2xNg/1/lBQ/ppUUh9g6YZIYaY/p7Qblec3tPVb7B4a //NVsEC7AQW6TIHBeCdDWmXvz6eHRuv7IblbFbnvkbV8QWrRT2h+cMcRUg8/EoJyNJgw NwdzAwnRuS+9ML/M6WCd1Uyof71UYEGAWWpKdIOKuMBbR+9zsEaZmGP+I78v9WjItmC8 uAIg== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@suse.com header.s=susede1 header.b=o03RIBvC; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=suse.com Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id e4-20020a170902cf4400b001a6e719421asi3285113plg.366.2023.06.23.04.46.28; Fri, 23 Jun 2023 04:46:41 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@suse.com header.s=susede1 header.b=o03RIBvC; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=suse.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231897AbjFWLOf (ORCPT + 99 others); Fri, 23 Jun 2023 07:14:35 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:54790 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231784AbjFWLOS (ORCPT ); Fri, 23 Jun 2023 07:14:18 -0400 Received: from smtp-out2.suse.de (smtp-out2.suse.de [195.135.220.29]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id B9C9BB7 for ; Fri, 23 Jun 2023 04:14:17 -0700 (PDT) Received: from imap2.suse-dmz.suse.de (imap2.suse-dmz.suse.de [192.168.254.74]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-521) server-digest SHA512) (No client certificate requested) by smtp-out2.suse.de (Postfix) with ESMTPS id 522791F74D; Fri, 23 Jun 2023 11:14:16 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=suse.com; s=susede1; t=1687518856; h=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc: mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=vd0DHG16TEfVtLv+nXFsC8K54PSpOG5XQkdb5dg46oc=; b=o03RIBvCt1I0D3RN0/t1RkTpGK5BsUaQ1nksDEO9nbj/odlwBWpIPyJNKLLOCNLwW+F0M6 RkIx5+EHrv3//LrqZDb2lGJ/bLBDf098Jw54KrLgh1dzkY4wO2u2ugWytoQdp5X8GnnoiT svsFuJpfGqRo9rvXBzD2zitLqAuIuAc= Received: from imap2.suse-dmz.suse.de (imap2.suse-dmz.suse.de [192.168.254.74]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-521) server-digest SHA512) (No client certificate requested) by imap2.suse-dmz.suse.de (Postfix) with ESMTPS id F05A81331F; Fri, 23 Jun 2023 11:14:15 +0000 (UTC) Received: from dovecot-director2.suse.de ([192.168.254.65]) by imap2.suse-dmz.suse.de with ESMTPSA id ACb3N4d+lWTcFAAAMHmgww (envelope-from ); Fri, 23 Jun 2023 11:14:15 +0000 From: Nikolay Borisov To: x86@kernel.org Cc: linux-kernel@vger.kernel.org, mohocko@suse.com, jslaby@suse.cz, Nikolay Borisov Subject: [PATCH v4 6/6] x86: Make IA32_EMULATION boot time configurable Date: Fri, 23 Jun 2023 14:14:09 +0300 Message-Id: <20230623111409.3047467-7-nik.borisov@suse.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20230623111409.3047467-1-nik.borisov@suse.com> References: <20230623111409.3047467-1-nik.borisov@suse.com> MIME-Version: 1.0 X-Spam-Status: No, score=-4.4 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_MED,SPF_HELO_NONE, SPF_PASS,T_SCC_BODY_TEXT_LINE,URIBL_BLOCKED autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1769493812171543781?= X-GMAIL-MSGID: =?utf-8?q?1769493812171543781?= Distributions would like to reduce their attack surface as much as possible but at the same time they'd want to retain flexibility to cater to a variety of legacy software. This stems from the conjecture that compat layer is likely rarely tested and could have latent security bugs. Ideally distributions will set their default policy and also give users the ability to override it as appropriate. To enable this use case, introduce CONFIG_IA32_EMULATION_DEFAULT_DISABLED compile time option, which controls whether 32bit processes/syscalls should be allowed or not. This option is aimed mainly at distributions to set their preferred default behavior in their kernels. To allow users to override the distro's policy, introduce the 'ia32_emulation' parameter which allows overriding CONFIG_IA32_EMULATION_DEFAULT_DISABLED state at boot time. Signed-off-by: Nikolay Borisov --- Documentation/admin-guide/kernel-parameters.txt | 6 ++++++ arch/x86/Kconfig | 9 +++++++++ arch/x86/entry/common.c | 9 ++++++++- 3 files changed, 23 insertions(+), 1 deletion(-) diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt index 9e5bab29685f..99ff94e963b8 100644 --- a/Documentation/admin-guide/kernel-parameters.txt +++ b/Documentation/admin-guide/kernel-parameters.txt @@ -1865,6 +1865,12 @@ 0 -- machine default 1 -- force brightness inversion + ia32_emulation= [X86-64] + Format: + When true, allows loading 32-bit programs and executing 32-bit + syscalls, essentially overriding IA32_EMULATION_DEFAULT_DISABLED at + boot time. When false, unconditionally disables IA32 emulation. + icn= [HW,ISDN] Format: [,[,[,]]] diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig index 53bab123a8ee..15f313399ed4 100644 --- a/arch/x86/Kconfig +++ b/arch/x86/Kconfig @@ -3038,6 +3038,15 @@ config IA32_EMULATION 64-bit kernel. You should likely turn this on, unless you're 100% sure that you don't have any 32-bit programs left. +config IA32_EMULATION_DEFAULT_DISABLED + bool "IA32 emulation disabled by default" + default n + depends on IA32_EMULATION + help + Make IA32 emulation disabled by default. This prevents loading 32-bit + processes and access to 32-bit syscalls. If unsure, leave it to its + default value. + config X86_X32_ABI bool "x32 ABI for 64-bit mode" depends on X86_64 diff --git a/arch/x86/entry/common.c b/arch/x86/entry/common.c index ef5a154a7413..b5dd1e226c99 100644 --- a/arch/x86/entry/common.c +++ b/arch/x86/entry/common.c @@ -19,6 +19,7 @@ #include #include #include +#include #ifdef CONFIG_XEN_PV #include @@ -97,7 +98,13 @@ static __always_inline int syscall_32_enter(struct pt_regs *regs) } #ifdef CONFIG_IA32_EMULATION -bool __ia32_enabled = true; +bool __ia32_enabled = !IS_ENABLED(CONFIG_IA32_EMULATION_DEFAULT_DISABLED); + +static int ia32_emulation_override_cmdline(char *arg) +{ + return kstrtobool(arg, &__ia32_enabled); +} +early_param("ia32_emulation", ia32_emulation_override_cmdline); #endif /*