From nobody Mon Feb 9 00:42:08 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 29E69C7EE2E for ; Fri, 9 Jun 2023 11:13:24 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S239166AbjFILNW (ORCPT ); Fri, 9 Jun 2023 07:13:22 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:57036 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S238861AbjFILNR (ORCPT ); Fri, 9 Jun 2023 07:13:17 -0400 Received: from smtp-out1.suse.de (smtp-out1.suse.de [IPv6:2001:67c:2178:6::1c]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 8ADA01FF3 for ; Fri, 9 Jun 2023 04:13:16 -0700 (PDT) Received: from imap2.suse-dmz.suse.de (imap2.suse-dmz.suse.de [192.168.254.74]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-521) server-digest SHA512) (No client certificate requested) by smtp-out1.suse.de (Postfix) with ESMTPS id 3BBEC21A16; Fri, 9 Jun 2023 11:13:15 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=suse.com; s=susede1; t=1686309195; h=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc: mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=ecoq/MeSTUdA9EHpJzCSHxssfrpaWGQ/APku+m/fpZA=; b=DTuVqxzMbPp0jvWo/EQZo+YOwoS2sLnSLXu2c3YigVj41K9ewnilOGCS46mjfhWGY4TFz/ j71rmdWB6fMiPW/WTvPsJuxwHvT/r758wfvAqxrjGgfXnU9WbYJJ4Zm6t5IBw382/oBfSc 338bCt/HcpI3g0TU1WFuhY0FTrGN6jk= Received: from imap2.suse-dmz.suse.de (imap2.suse-dmz.suse.de [192.168.254.74]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-521) server-digest SHA512) (No client certificate requested) by imap2.suse-dmz.suse.de (Postfix) with ESMTPS id DBADB139C8; Fri, 9 Jun 2023 11:13:14 +0000 (UTC) Received: from dovecot-director2.suse.de ([192.168.254.65]) by imap2.suse-dmz.suse.de with ESMTPSA id KDnuMkoJg2ReIwAAMHmgww (envelope-from ); Fri, 09 Jun 2023 11:13:14 +0000 From: Nikolay Borisov To: x86@kernel.org Cc: linux-kernel@vger.kernel.org, mhocko@suse.com, jslaby@suse.cz, Nikolay Borisov Subject: [PATCH v2 1/4] x86: Introduce CONFIG_IA32_EMULATION_DEFAULT_DISABLED Kconfig option Date: Fri, 9 Jun 2023 14:13:08 +0300 Message-Id: <20230609111311.4110901-2-nik.borisov@suse.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20230609111311.4110901-1-nik.borisov@suse.com> References: <20230609111311.4110901-1-nik.borisov@suse.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" Distributions would like to reduce their attack surface as much as possible but at the same time they have to cater to a wide variety of legacy software. One such avenue where distros have to strike a balance is the support for 32bit syscalls on a 64bit kernel. Ideally distributions would have a way to set that policy in their kernel config files and at the same time users should also have the ability to override this decision. Introduce such mechanism in the face of CONFIG_IA32_EMULATION_DEFAULT_DISABLED compile time option, which defaults to 'N' i.e retains current behavio in case CONFIG_IA32_EMULATION is enabled. If, however, a distributor would like to change this policy they can do so via the newly introduced CONFIG_IA32_EMULATION_DEFAULT_DISABLED. As a final note allow users to override the decision via the ia32_mode boot time parameter. Signed-off-by: Nikolay Borisov --- Documentation/admin-guide/kernel-parameters.txt | 4 ++++ arch/x86/Kconfig | 5 +++++ arch/x86/entry/common.c | 16 ++++++++++++++++ arch/x86/include/asm/traps.h | 4 ++++ 4 files changed, 29 insertions(+) diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentatio= n/admin-guide/kernel-parameters.txt index 9e5bab29685f..7c01ab8bcd56 100644 --- a/Documentation/admin-guide/kernel-parameters.txt +++ b/Documentation/admin-guide/kernel-parameters.txt @@ -1865,6 +1865,10 @@ 0 -- machine default 1 -- force brightness inversion + ia32_mode=3D [X86-64] + Format: ia32_mode=3Ddisabled, ia32_mode=3Denabled + Allows to override the compile-time IA32_EMULATION option at boot time + icn=3D [HW,ISDN] Format: [,[,[,]]] diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig index 53bab123a8ee..9c32fd720701 100644 --- a/arch/x86/Kconfig +++ b/arch/x86/Kconfig @@ -3038,6 +3038,11 @@ config IA32_EMULATION 64-bit kernel. You should likely turn this on, unless you're 100% sure that you don't have any 32-bit programs left. +config IA32_EMULATION_DEFAULT_DISABLED + bool "IA32 Emulation default disabled" + default n + depends on IA32_EMULATION + config X86_X32_ABI bool "x32 ABI for 64-bit mode" depends on X86_64 diff --git a/arch/x86/entry/common.c b/arch/x86/entry/common.c index 6c2826417b33..6da89575e03e 100644 --- a/arch/x86/entry/common.c +++ b/arch/x86/entry/common.c @@ -19,6 +19,7 @@ #include #include #include +#include #ifdef CONFIG_XEN_PV #include @@ -96,6 +97,21 @@ static __always_inline int syscall_32_enter(struct pt_re= gs *regs) return (int)regs->orig_ax; } +#ifdef CONFIG_IA32_EMULATION +bool ia32_disabled =3D IS_ENABLED(CONFIG_IA32_EMULATION_DEFAULT_DISABLED); + +static int ia32_mode_override_cmdline(char *arg) +{ + if (!strcmp(arg, "disabled")) + ia32_disabled =3D true; + else if (!strcmp(arg, "enabled")) + ia32_disabled =3D false; + + return 1; +} +__setup("ia32_mode=3D", ia32_mode_override_cmdline); +#endif + /* * Invoke a 32-bit syscall. Called with IRQs on in CONTEXT_KERNEL. */ diff --git a/arch/x86/include/asm/traps.h b/arch/x86/include/asm/traps.h index 47ecfff2c83d..dd93aac3718b 100644 --- a/arch/x86/include/asm/traps.h +++ b/arch/x86/include/asm/traps.h @@ -20,6 +20,10 @@ asmlinkage __visible noinstr struct pt_regs *vc_switch_o= ff_ist(struct pt_regs *e extern bool ibt_selftest(void); +#ifdef CONFIG_IA32_EMULATION +extern bool ia32_disabled; +#endif + #ifdef CONFIG_X86_F00F_BUG /* For handling the FOOF bug */ void handle_invalid_op(struct pt_regs *regs); -- 2.34.1 From nobody Mon Feb 9 00:42:08 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id E4268C7EE2E for ; Fri, 9 Jun 2023 11:13:26 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S239295AbjFILNZ (ORCPT ); Fri, 9 Jun 2023 07:13:25 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:57044 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S238948AbjFILNS (ORCPT ); Fri, 9 Jun 2023 07:13:18 -0400 Received: from smtp-out1.suse.de (smtp-out1.suse.de [IPv6:2001:67c:2178:6::1c]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 0417E210E for ; Fri, 9 Jun 2023 04:13:17 -0700 (PDT) Received: from imap2.suse-dmz.suse.de (imap2.suse-dmz.suse.de [192.168.254.74]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-521) server-digest SHA512) (No client certificate requested) by smtp-out1.suse.de (Postfix) with ESMTPS id A476721A1B; Fri, 9 Jun 2023 11:13:15 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=suse.com; s=susede1; t=1686309195; h=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc: mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=7GTMhjbKkfMR0diFswT0M7pEjVhfOQYpv6YQslqR+6M=; b=kymnpBYGPFy89uI8Qf3O6etFmzQJob7m/mV8aFmzGVcrsZAQssq6bP9WrHbkxiiCsoQwXi GUvUOJ8cwgSvtfHH19j1APshDMvhRQwh1Veog34mfb7RWL2tTNZnwjAMe2xQ99/zw+1zCe loCXjPEuk8NJJIf2FxZJjMOZp6c3Yro= Received: from imap2.suse-dmz.suse.de (imap2.suse-dmz.suse.de [192.168.254.74]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-521) server-digest SHA512) (No client certificate requested) by imap2.suse-dmz.suse.de (Postfix) with ESMTPS id 4EC41139C8; Fri, 9 Jun 2023 11:13:15 +0000 (UTC) Received: from dovecot-director2.suse.de ([192.168.254.65]) by imap2.suse-dmz.suse.de with ESMTPSA id qDiMEEsJg2ReIwAAMHmgww (envelope-from ); Fri, 09 Jun 2023 11:13:15 +0000 From: Nikolay Borisov To: x86@kernel.org Cc: linux-kernel@vger.kernel.org, mhocko@suse.com, jslaby@suse.cz, Nikolay Borisov Subject: [PATCH v2 2/4] x86/entry: Rename ignore_sysret and compile it unconditionally Date: Fri, 9 Jun 2023 14:13:09 +0300 Message-Id: <20230609111311.4110901-3-nik.borisov@suse.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20230609111311.4110901-1-nik.borisov@suse.com> References: <20230609111311.4110901-1-nik.borisov@suse.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" Give ignore_sysret a more descriptive name as it's actually used to make 32bit syscalls a noop and return ENOSYS, rather than doing anything special to sysret. While at it also compile the function unconditinally as this is going to be used in the patch disabling ia32 syscalls due to 'ia32_disabled' parameter. Signed-off-by: Nikolay Borisov --- arch/x86/entry/entry_64.S | 6 ++---- arch/x86/include/asm/processor.h | 2 +- arch/x86/kernel/cpu/common.c | 2 +- 3 files changed, 4 insertions(+), 6 deletions(-) diff --git a/arch/x86/entry/entry_64.S b/arch/x86/entry/entry_64.S index f31e286c2977..7068af44008a 100644 --- a/arch/x86/entry/entry_64.S +++ b/arch/x86/entry/entry_64.S @@ -1514,18 +1514,16 @@ SYM_CODE_START(asm_exc_nmi) iretq SYM_CODE_END(asm_exc_nmi) =20 -#ifndef CONFIG_IA32_EMULATION /* * This handles SYSCALL from 32-bit code. There is no way to program * MSRs to fully disable 32-bit SYSCALL. */ -SYM_CODE_START(ignore_sysret) +SYM_CODE_START(entry_SYSCALL32_ignore) UNWIND_HINT_END_OF_STACK ENDBR mov $-ENOSYS, %eax sysretl -SYM_CODE_END(ignore_sysret) -#endif +SYM_CODE_END(entry_SYSCALL32_ignore) =20 .pushsection .text, "ax" __FUNC_ALIGN diff --git a/arch/x86/include/asm/processor.h b/arch/x86/include/asm/proces= sor.h index a1e4fa58b357..61c10b4e3e35 100644 --- a/arch/x86/include/asm/processor.h +++ b/arch/x86/include/asm/processor.h @@ -399,7 +399,7 @@ static inline unsigned long cpu_kernelmode_gs_base(int = cpu) return (unsigned long)per_cpu(fixed_percpu_data.gs_base, cpu); } =20 -extern asmlinkage void ignore_sysret(void); +extern asmlinkage void entry_SYSCALL32_ignore(void); =20 /* Save actual FS/GS selectors and bases to current->thread */ void current_save_fsgs(void); diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c index 80710a68ef7d..b20774181e1a 100644 --- a/arch/x86/kernel/cpu/common.c +++ b/arch/x86/kernel/cpu/common.c @@ -2066,7 +2066,7 @@ void syscall_init(void) (unsigned long)(cpu_entry_stack(smp_processor_id()) + 1)); wrmsrl_safe(MSR_IA32_SYSENTER_EIP, (u64)entry_SYSENTER_compat); #else - wrmsrl_cstar((unsigned long)ignore_sysret); + wrmsrl_cstar((unsigned long)entry_SYSCALL32_ignore); wrmsrl_safe(MSR_IA32_SYSENTER_CS, (u64)GDT_ENTRY_INVALID_SEG); wrmsrl_safe(MSR_IA32_SYSENTER_ESP, 0ULL); wrmsrl_safe(MSR_IA32_SYSENTER_EIP, 0ULL); --=20 2.34.1 From nobody Mon Feb 9 00:42:08 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id B8D54C7EE25 for ; Fri, 9 Jun 2023 11:13:35 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S239372AbjFILNe (ORCPT ); Fri, 9 Jun 2023 07:13:34 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:57048 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S238991AbjFILNS (ORCPT ); Fri, 9 Jun 2023 07:13:18 -0400 Received: from smtp-out2.suse.de (smtp-out2.suse.de [195.135.220.29]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 6083F2113 for ; Fri, 9 Jun 2023 04:13:17 -0700 (PDT) Received: from imap2.suse-dmz.suse.de (imap2.suse-dmz.suse.de [192.168.254.74]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-521) server-digest SHA512) (No client certificate requested) by smtp-out2.suse.de (Postfix) with ESMTPS id 19A471FDF2; Fri, 9 Jun 2023 11:13:16 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=suse.com; s=susede1; t=1686309196; h=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc: mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=8Bsnn3ZvwL3jkB5fYcFeMyxQu6CGb7wI0Eum5AnPafo=; b=OX/qyPwNWV6gO9OKITAPQ6wDiGhtagZFt2q2cnd2SnjCyQCU9/Mvy8PtfVp24tPkRlgJyl hFx+AWKfEROmKYu+Fxsa9plDRjd+O6JGg6bX/ZWk/FGek0TVSAhezsY+V+dvu2kyQuLoqe U0Qgt4ywpIUxQgS06NbhNoCWHV6kMJo= Received: from imap2.suse-dmz.suse.de (imap2.suse-dmz.suse.de [192.168.254.74]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-521) server-digest SHA512) (No client certificate requested) by imap2.suse-dmz.suse.de (Postfix) with ESMTPS id B7508139C8; Fri, 9 Jun 2023 11:13:15 +0000 (UTC) Received: from dovecot-director2.suse.de ([192.168.254.65]) by imap2.suse-dmz.suse.de with ESMTPSA id GHgTKksJg2ReIwAAMHmgww (envelope-from ); Fri, 09 Jun 2023 11:13:15 +0000 From: Nikolay Borisov To: x86@kernel.org Cc: linux-kernel@vger.kernel.org, mhocko@suse.com, jslaby@suse.cz, Nikolay Borisov Subject: [PATCH v2 3/4] x86/entry: Disable IA32 syscall if ia32_disabled is true Date: Fri, 9 Jun 2023 14:13:10 +0300 Message-Id: <20230609111311.4110901-4-nik.borisov@suse.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20230609111311.4110901-1-nik.borisov@suse.com> References: <20230609111311.4110901-1-nik.borisov@suse.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" First stage of disabling ia32 compat layer is to disable 32bit syscall entry points. Legacy int 0x80 vector is disabled by zeroing out its gate descriptor in the idt and the sysenter vector is disabled by re-using the existing code in case IA32_EMULATION is disabled. Signed-off-by: Nikolay Borisov --- arch/x86/include/asm/desc.h | 1 + arch/x86/kernel/cpu/common.c | 37 ++++++++++++++++++------------------ arch/x86/kernel/idt.c | 7 +++++++ 3 files changed, 27 insertions(+), 18 deletions(-) diff --git a/arch/x86/include/asm/desc.h b/arch/x86/include/asm/desc.h index ab97b22ac04a..1182a5b10be9 100644 --- a/arch/x86/include/asm/desc.h +++ b/arch/x86/include/asm/desc.h @@ -8,6 +8,7 @@ #include #include #include +#include =20 #include #include diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c index b20774181e1a..3c4055184d0f 100644 --- a/arch/x86/kernel/cpu/common.c +++ b/arch/x86/kernel/cpu/common.c @@ -2053,24 +2053,25 @@ void syscall_init(void) wrmsr(MSR_STAR, 0, (__USER32_CS << 16) | __KERNEL_CS); wrmsrl(MSR_LSTAR, (unsigned long)entry_SYSCALL_64); =20 -#ifdef CONFIG_IA32_EMULATION - wrmsrl_cstar((unsigned long)entry_SYSCALL_compat); - /* - * This only works on Intel CPUs. - * On AMD CPUs these MSRs are 32-bit, CPU truncates MSR_IA32_SYSENTER_EIP. - * This does not cause SYSENTER to jump to the wrong location, because - * AMD doesn't allow SYSENTER in long mode (either 32- or 64-bit). - */ - wrmsrl_safe(MSR_IA32_SYSENTER_CS, (u64)__KERNEL_CS); - wrmsrl_safe(MSR_IA32_SYSENTER_ESP, - (unsigned long)(cpu_entry_stack(smp_processor_id()) + 1)); - wrmsrl_safe(MSR_IA32_SYSENTER_EIP, (u64)entry_SYSENTER_compat); -#else - wrmsrl_cstar((unsigned long)entry_SYSCALL32_ignore); - wrmsrl_safe(MSR_IA32_SYSENTER_CS, (u64)GDT_ENTRY_INVALID_SEG); - wrmsrl_safe(MSR_IA32_SYSENTER_ESP, 0ULL); - wrmsrl_safe(MSR_IA32_SYSENTER_EIP, 0ULL); -#endif + if ((IS_ENABLED(CONFIG_IA32_EMULATION) && ia32_disabled) || + !IS_ENABLED(CONFIG_IA32_EMULATION)) { + wrmsrl_cstar((unsigned long)entry_SYSCALL32_ignore); + wrmsrl_safe(MSR_IA32_SYSENTER_CS, (u64)GDT_ENTRY_INVALID_SEG); + wrmsrl_safe(MSR_IA32_SYSENTER_ESP, 0ULL); + wrmsrl_safe(MSR_IA32_SYSENTER_EIP, 0ULL); + } else { + wrmsrl_cstar((unsigned long)entry_SYSCALL_compat); + /* + * This only works on Intel CPUs. + * On AMD CPUs these MSRs are 32-bit, CPU truncates MSR_IA32_SYSENTER_EI= P. + * This does not cause SYSENTER to jump to the wrong location, because + * AMD doesn't allow SYSENTER in long mode (either 32- or 64-bit). + */ + wrmsrl_safe(MSR_IA32_SYSENTER_CS, (u64)__KERNEL_CS); + wrmsrl_safe(MSR_IA32_SYSENTER_ESP, + (unsigned long)(cpu_entry_stack(smp_processor_id()) + 1)); + wrmsrl_safe(MSR_IA32_SYSENTER_EIP, (u64)entry_SYSENTER_compat); + } =20 /* * Flags to clear on syscall; clear as much as possible diff --git a/arch/x86/kernel/idt.c b/arch/x86/kernel/idt.c index a58c6bc1cd68..d1f388ef2e66 100644 --- a/arch/x86/kernel/idt.c +++ b/arch/x86/kernel/idt.c @@ -226,6 +226,13 @@ void __init idt_setup_early_traps(void) void __init idt_setup_traps(void) { idt_setup_from_table(idt_table, def_idts, ARRAY_SIZE(def_idts), true); + + if (IS_ENABLED(CONFIG_IA32_EMULATION) && ia32_disabled) { + gate_desc null_desc =3D {}; + write_idt_entry(idt_table, IA32_SYSCALL_VECTOR, &null_desc); + clear_bit(IA32_SYSCALL_VECTOR, system_vectors); + } + } =20 #ifdef CONFIG_X86_64 --=20 2.34.1 From nobody Mon Feb 9 00:42:08 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 13AB4C7EE25 for ; Fri, 9 Jun 2023 11:13:31 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S239361AbjFILN3 (ORCPT ); Fri, 9 Jun 2023 07:13:29 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:57050 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S239066AbjFILNS (ORCPT ); Fri, 9 Jun 2023 07:13:18 -0400 Received: from smtp-out2.suse.de (smtp-out2.suse.de [IPv6:2001:67c:2178:6::1d]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D44D11FDC for ; Fri, 9 Jun 2023 04:13:17 -0700 (PDT) Received: from imap2.suse-dmz.suse.de (imap2.suse-dmz.suse.de [192.168.254.74]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-521) server-digest SHA512) (No client certificate requested) by smtp-out2.suse.de (Postfix) with ESMTPS id 7F7FA1FDF8; Fri, 9 Jun 2023 11:13:16 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=suse.com; s=susede1; t=1686309196; h=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc: mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=HtizpSkxYlWAXraFNdbEL4Y1/gcbY1LlaDxMnphho2M=; b=UfksIQJpywX61OplTPxdtEDNEBSpbS3sTOKsu5I1T09Sg+g+iZOZnic15IyTQ7jF02wqJk cAAUC0lHEDfDIMbPAsSptmzLjsj6Dep7T7jvofqOl+VMNFnCp2oHgBAm79TsGGQojOkRph pzQb8epcwfI04NZZLFJoct3BG1dBTzQ= Received: from imap2.suse-dmz.suse.de (imap2.suse-dmz.suse.de [192.168.254.74]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-521) server-digest SHA512) (No client certificate requested) by imap2.suse-dmz.suse.de (Postfix) with ESMTPS id 2BBDA139C8; Fri, 9 Jun 2023 11:13:16 +0000 (UTC) Received: from dovecot-director2.suse.de ([192.168.254.65]) by imap2.suse-dmz.suse.de with ESMTPSA id cAXTB0wJg2ReIwAAMHmgww (envelope-from ); Fri, 09 Jun 2023 11:13:16 +0000 From: Nikolay Borisov To: x86@kernel.org Cc: linux-kernel@vger.kernel.org, mhocko@suse.com, jslaby@suse.cz, Nikolay Borisov Subject: [PATCH v2 4/4] x86: Disable laoding 32bit processes if ia32_disabled is true Date: Fri, 9 Jun 2023 14:13:11 +0300 Message-Id: <20230609111311.4110901-5-nik.borisov@suse.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20230609111311.4110901-1-nik.borisov@suse.com> References: <20230609111311.4110901-1-nik.borisov@suse.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" In addition to disabling 32bit syscall interface let's also disable the ability to load 32bit compat processes. Signed-off-by: Nikolay Borisov --- arch/x86/include/asm/elf.h | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/arch/x86/include/asm/elf.h b/arch/x86/include/asm/elf.h index 18fd06f7936a..0fa49388ff16 100644 --- a/arch/x86/include/asm/elf.h +++ b/arch/x86/include/asm/elf.h @@ -148,9 +148,16 @@ do { \ #define elf_check_arch(x) \ ((x)->e_machine =3D=3D EM_X86_64) =20 +#ifdef CONFIG_IA32_EMULATION +extern bool ia32_disabled; #define compat_elf_check_arch(x) \ - (elf_check_arch_ia32(x) || \ + ((elf_check_arch_ia32(x) && !ia32_disabled) || \ (IS_ENABLED(CONFIG_X86_X32_ABI) && (x)->e_machine =3D=3D EM_X86_64)) +#else +#define compat_elf_check_arch(x) \ + (elf_check_arch_ia32(x) || \ + (IS_ENABLED(CONFIG_X86_X32_ABI) && (x)->e_machine =3D=3D EM_X86_64)) +#endif =20 static inline void elf_common_init(struct thread_struct *t, struct pt_regs *regs, const u16 ds) --=20 2.34.1