Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Message-ID: <84f28ab5-f812-71a0-14b8-8a2108d1f572@suse.com>
Date:   Wed, 21 Jun 2023 22:02:58 +0300
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101
 Thunderbird/102.11.0
Subject: Re: [PATCH v3 1/5] x86: Make IA32_EMULATION boot time configurable
Content-Language: en-US
To:     Borislav Petkov <bp@alien8.de>
Cc:     x86@kernel.org, linux-kernel@vger.kernel.org, mhocko@suse.com,
        jslaby@suse.cz
References: <20230616125730.1164989-1-nik.borisov@suse.com>
 <20230616125730.1164989-2-nik.borisov@suse.com>
 <20230621182710.GOZJNA/q4w1yniKeCr@fat_crate.local>
From:   Nikolay Borisov <nik.borisov@suse.com>
In-Reply-To: <20230621182710.GOZJNA/q4w1yniKeCr@fat_crate.local>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?UjZwcVJQbGhQeW5WVGcwK1JxZjVQaExEd05oUEVScHkxZmowcnBBWVNsNjZL?=
 =?utf-8?B?dWdOamxsM1ZwT1l3cEIwczBDaFBpRFMwcHVKdzRsZFJ1Z3dXTlZZMHRhSDIx?=
 =?utf-8?B?SjlzRS95MTVoem0wTjU4UzlhUnpEWFFTYkJUQTAzaHBVbU5wS2VuKzU3VGRC?=
 =?utf-8?B?QlFRL3lESWd5RmRMRjh1Z2FrN1lPTE5kY3dReVBvLytKTU91SDc2ZGRvVFVQ?=
 =?utf-8?B?NTlJdGdIOEUwSlNtV3lTVzZTcHVabU5mT1M5S0pyNElLQkdtdk5DNi9jTXBO?=
 =?utf-8?B?MTFJd242WE9ybkdVeWpER2piRWg2ajhSbXoweXM5RGdvcHl3OFdpYTVpVjc1?=
 =?utf-8?B?Q3BoZWx2SktxUjBZdUgrZlRwbXlYWG1qSFNwOWVBZ2NJc2lrRjEzVFFpYnFP?=
 =?utf-8?B?akhlaHRTbS96ZFpLVys1cEdSeHhyckk2bzJacmtNOE5GVnNMT2dUOUowbjNP?=
 =?utf-8?B?c0t1TnAzRzNRakQzQzhtUVBBb1NpVHpyeHlveURvSTBRUy9FK01Nd1hNMHBZ?=
 =?utf-8?B?dnpWRW1GNVNsN2IvLzVta3dBelJXR1Vva29lU1gxTVNvajA3dHBNUzF4V3l0?=
 =?utf-8?B?UGZqRGZodEVDc1RvNzJZN05aUkMvUDZDZXk4LzJObzBWL0NmMmtFdXBJaFFy?=
 =?utf-8?B?VEdYblBXREJTdkc4SDBHRXRDbXMybk0rZEhFY2dyVW52NDIvVUExaVp6WEV4?=
 =?utf-8?B?aXE4aVp4WjVuOHBPQllHR21welc1Nm9MdURGZzJaVlJ3MXZnbkdpMFB3bnlN?=
 =?utf-8?B?UE5iTjloalBva3dKd2FMNkZTTUpRclNXRU9RelN0YWozZU9iUm5qRTcwV1Q3?=
 =?utf-8?B?VmQxT1F3cjg4dTRMayt1OE9nTXBrcjU5NWNqZ1ZwUGIyOHJhancwTlpvRVJy?=
 =?utf-8?B?eXhnUG5tQkF6MllJdWxKTjBWN1d3VmhjNzd1R0NGODRQejRzZmZXWC9pVnlW?=
 =?utf-8?B?R1liUzk1bmdFMU0yOXo3T2hqT3dSRWttUnFQeHpPcHJaMndEMWhVbkdvZjJQ?=
 =?utf-8?B?MGd0bTNybEdCOGZxVjFMeW93cktSbGFjaGlTNi9SUTlFTGhJbi9EYlJFMlpU?=
 =?utf-8?B?UDVRTUFpWFpGdWZ3TFdxd3NQaFdieE5VVVZaQjZSQzdSejFRQUFWVWxKMVB5?=
 =?utf-8?B?Qnhza2RDbWMrRzFxclZvdWR2YUVqRTVFRXBDRnJIV216QXpQWFJnU2V6VjRm?=
 =?utf-8?B?N25xd2p6WUVKNm9EbWR0ZS94ZzdNMXg3ZzdRNkFLc0JCVldjYTJMYXkvSnVp?=
 =?utf-8?B?MXB4NkVvRzZXMHB5UVFncEpNWUd2YmlOakFMZGU5NHJrSXZXa0xMdGJRRHZj?=
 =?utf-8?B?Z3NOYkhTbjJxY2t4Tlp6U1ZuK3R3czNNR1lzTUJDZWVXOG44SU5sL29vL3JG?=
 =?utf-8?B?eHdUU29FSVduUldYWjgyTy9zUXd2eWZqbG1qMXlNTmtKblJxc2V0aWtYNE1w?=
 =?utf-8?B?NWhIZWZCYWtmSlBBVFVPRUxJd1FkSFE2Y3hOTzEweUR0Qjc1eEplVCtkczZz?=
 =?utf-8?B?Q2V0b3IrMGF2emwxL0VJRkVPSktjc0t3b1V0UEY5U2dhSzVzYlpxYkpmcTlE?=
 =?utf-8?B?S2doTDNnRG1MZm5RTTAvZGFXVkxtSm9rS1FwL0R2Z2kvUkxxUklVV1E0TDdC?=
 =?utf-8?B?NXZKM29MR3IxUUdGUU81YXNnTnhuSTcrSHBUWVpDL2Q4L3FMN0Rpc0RyM0hX?=
 =?utf-8?B?MFZZV2dZWjE3SCsyT3BETW5yNnA5MmtMMSt2ZW5qODVlUFJkcGpBUmMvSWtm?=
 =?utf-8?B?bGsySzVEZFd5eCtub05jTmp6dUdZR3h2NGJrblNVNTdrME5SeGQ4TUhwZXB1?=
 =?utf-8?B?M2ZmTG5ZQXJwWXZmWDFVVnIzcncwVEgyT2pIYnQwejQyeElacGRrZFVtWnlC?=
 =?utf-8?B?a1U4Zk92ZHBFMW55eFRvUjhoVkluYXQ5NkUxZnBybExjWkNxdUE1UU9JcUQ1?=
 =?utf-8?B?a1VkOWpQd1pvVHZzSTNwVFNTc0pCTzZQVVZkdnNaU0EvNm42L1NZWm52NThL?=
 =?utf-8?B?eEIyd2ptendUQ1N6Z2FsYlZjVEg2RFJOTWhxK0dZK0Eyb3Jhcjh5dTBTbmpv?=
 =?utf-8?B?aGZvaHpJTmJ4WEk1VnpQZlViMmZtb1FzbkZDdUNkWFUyY3cwQ0hBYjc5WjUr?=
 =?utf-8?B?WEhhcldMbU5sNG9ta1IyRE5uVmJlQWFWMnlQR3MzeWZHcStNNE9WU2JQZnhD?=
 =?utf-8?Q?msXM2aDycDtBBDwJxFjDZwQwinEroBR3uOdrFqC2GWz6?=
X-OriginatorOrg: suse.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 83efbe90-ae78-409e-fcd5-08db728a2239
X-MS-Exchange-CrossTenant-AuthSource: PA4PR04MB7790.eurprd04.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 21 Jun 2023 19:03:00.9655
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: f7a17af6-1c5c-4a36-aa8b-f5be247aa4ba
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: pl8xDu5dWN6iRniUct2wQNCxyHzOUeypElvfQOxnrUf6HJCvdGLnRkrIWFr4ugskgQmXiNF1+FoloS2K+LR8sQ==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: AS4PR04MB9412
X-Spam-Status: No, score=-2.2 required=5.0 tests=BAYES_00,DKIM_SIGNED,
        DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,NICE_REPLY_A,RCVD_IN_DNSWL_NONE,
        RCVD_IN_MSPIKE_H2,SPF_HELO_PASS,SPF_PASS,T_SCC_BODY_TEXT_LINE,
        URIBL_BLOCKED autolearn=ham autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org


On 21.06.23 г. 21:27 ч., Borislav Petkov wrote:
> On Fri, Jun 16, 2023 at 03:57:26PM +0300, Nikolay Borisov wrote:
>> Distributions would like to reduce their attack surface as much as
>> possible but at the same time they'd want to retain flexibility to cater
>> to a variety of legacy software. One such avenue where a balance has to
>> be struck is in supporting 32bit syscalls/processes on 64bit kernels. Ideally
>> it should be possible for the distribution to set their own policy and
>> give users the ability to override those policies as appropriate.
>>
>> In order to support this usecase, introduce
>> CONFIG_IA32_EMULATION_DEFAULT_DISABLED compile time option, which
>> controls whether 32bit processes/syscalls should be allowed or not. This
>> allows distributions to set their preferred default behavior in their
>> kernel configs.
>>
>> On the other hand, in order to allow users to override the distro's
>> policy, introduce the 'ia32_mode' parameter which allows overriding
>> CONFIG_IA32_EMULATION_DEFAULT_DISABLED state at boot time.
>>
>> Signed-off-by: Nikolay Borisov <nik.borisov@suse.com>
>> ---
>>   Documentation/admin-guide/kernel-parameters.txt |  5 +++++
>>   arch/x86/Kconfig                                |  9 +++++++++
>>   arch/x86/entry/common.c                         | 16 ++++++++++++++++
>>   arch/x86/include/asm/ia32.h                     | 16 +++++++++++++++-
>>   4 files changed, 45 insertions(+), 1 deletion(-)
>>
>> diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
>> index 9e5bab29685f..59b1e86ecd9d 100644
>> --- a/Documentation/admin-guide/kernel-parameters.txt
>> +++ b/Documentation/admin-guide/kernel-parameters.txt
>> @@ -1865,6 +1865,11 @@
>>   			 0 -- machine default
>>   			 1 -- force brightness inversion
>>   
>> +	ia32_mode=		[X86-64]
>> +			Format: ia32_mode=disabled, ia32_mode=enabled
> 
> ia32_mode=(on|off)

In the next version I called this ia32_emulation=on|off seems more 
descriptive.
> 
> is less typing. Especially if you're standing somewhere in a server room
> and trying to type on some weird keyboard which always has the wrong
> layout.
> 
> :-)
> 
>> +			Allows overriding the compile-time state of
>> +			IA32_EMULATION_DEFAULT_DISABLED at boot time
> 
> Just say what "=on" and "=off" does here - loading of 32-bit programs
> and 32-bit syscalls is enabled/disabled.

ack
>