From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754685AbcAEVNa (ORCPT ); Tue, 5 Jan 2016 16:13:30 -0500 Received: from mout.kundenserver.de ([217.72.192.74]:51934 "EHLO mout.kundenserver.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753101AbcAEVN0 (ORCPT ); Tue, 5 Jan 2016 16:13:26 -0500 From: Arnd Bergmann To: linux-arm-kernel@lists.infradead.org Cc: Yury Norov , Andrew Pinski , "Kapoor, Prasun" , Catalin Marinas , "Joseph S. Myers" , Nathan Lynch , LKML , Alexander Graf , Alexey Klimov , broonie@kernel.org, Jan Dakinevich , Andrew Pinski , David Daney , Andreas Schwab , "Zhangjian (Bamvor)" , Philipp Tomsich , christoph.muellner@theobroma-systems.com Subject: Re: [PATCH v6 12/20] arm64:ilp32: add sys_ilp32.c and a separate table (in entry.S) to use it Date: Tue, 05 Jan 2016 22:12:20 +0100 Message-ID: <13371161.AI9IgZN0G2@wuerfel> User-Agent: KMail/4.11.5 (Linux/3.16.0-10-generic; KDE/4.11.5; x86_64; ; ) In-Reply-To: <20160105152657.GA31598@yury-N73SV> References: <1450215766-14765-1-git-send-email-ynorov@caviumnetworks.com> <2634904.E1fnEZUKo9@wuerfel> <20160105152657.GA31598@yury-N73SV> MIME-Version: 1.0 Content-Transfer-Encoding: 7Bit Content-Type: text/plain; charset="us-ascii" X-Provags-ID: V03:K0:z2XR2wrxeY8lmrW5FmONM1IZbWFwTOrPmckdtBDYyNdNgvae4T0 aGowH9Wt7d1vWAqKHw5TluLCqwu2lC/3yDSdbvX8h/Kalr+C2V/cmbyxCkauwynwYnv9du+ MeHw4VQ7ER5h8sii6AFw13fX7sN8EdJlYEc38qn+xJmk2bBP5wFUKdiSTaYPv16z8igqLJZ /SF5K+cBidP5Llr3iNe6w== X-UI-Out-Filterresults: notjunk:1;V01:K0:0oLNUTIqVw8=:cJz7eKr4Oqsbyk6P8J9qM4 9XoWnRHRLtKcwxm2INjOET7ITJsXcbffCRzTnEkf5fsfEqCwCt4ffaJyBwSldkfJ0ZjqquFAy fCTZemFP5nhsf58G34AUAicKN0dp8GcoqMZWuf6aGsR3TFYTUm+6UPdJrudBTRZjdNoZ2uh3C Wnv30m5m4W86Dqhl1sZnn+Wk23DCeLqPyfpPxGL6zPL4aIzUgwFSRAF2AENMu78JVi2/F+ipk D0MBXLeuH+Erfe2nPpkMYun2yQnuZJbVVOo2omVj7IAms2ByCH7MyL7n8xazOvfRIbi1u1KvK doBpMJhh4U3dZo9SK3/LIl5RPjBU+9BMA3KUNwtGDrI7I3dUFu2CM6gLzSuLfcYYFxom96rTA 8TzF4DXC136BKcwU8cL/jhJ4edOD+rlX8yL/H+yb7UUcuv7qN2LzLMNoNdX47WmmZz9C9Ygk8 YmGZA+bg1BjWTSQULQtA0K8E7fiPPp22iPRD+WTeH8/t20f9hfSIafdde7dZPgJyDi//urzVz o0xWzt+Wk9xyWQPDtVdHbzaP66haq+6piqlR3EkFW22NROQw1tqks/6vNsvWINlSqZAVSf32Y T1vqoxW5wn+YotJl+0Nzcoro/6c2EVwR3UZSEWiYPJ1QC7WQXuEXGL/gmctRy5l+ZPyR32iN7 XMMtjRXJHckyGddK/kPmdTz8rtaMNJQDuptIWFKhel5uynOBWmJoOzQ5P/U5/p/oZTM1V8XB1 I/jArcJCm8muYCiZ Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Tuesday 05 January 2016 18:26:57 Yury Norov wrote: > > So the calling conventions avoid the problem of being able to set > > the upper bits from malicious user space when the kernel assumes they > > are zeroed out (we had security bugs in this area, before we introduced > > SYSCALL_DEFINEx()), but it means that we need wrappers around each > > syscall that takes an argument that is different length between user > > and kernel space (as Catalin guessed). arch/s390 has the same problem and > > works around it with code in arch/s390/kernel/compat_wrapper.c, while > > other architectures (at least powerpc, x86 and tile IIRC, don't know much > > about mips, parisc and sparc) don't have the problem because of their > > calling conventions. > > > > This also means that we cannot work around it in glibc at all, because > > we have to be able to handle malicious user space, so it has to be > > done in the kernel using something similar to what s390 does. > > > > Arnd > > So it seems like we (should) have 2 compat modes - with and without access > to upper half of register. I'm thinking now on how put it in generic > unistd.h less painfull way. I think we can do that by slightly modifying the existing __SYSCALL/__SC_3264/ __SC_COMP/__SC_COMP_3264 macros: The first two need extra wrappers for arm64-ilp32 and s390, the other two don't. We can use some clever string concatenation to add a ##_wrapper to the name of the handler where needed and then just have a file that implements the wrappers, copied from s390. Unfortunately, we can't just zero out all the upper halves and be done with it: even if we went back to passing 64-bit arguments as separate 32-bit registers, we'd still need to deal with sign-extending negative 32-bit numbers. > Beside of that, I think I almost finished with all current comments. As > this issue is not related to ILP32 directly, I think, it's better to show > it now, as there is pretty massive rework. What do you think? Good idea, yes. Arnd