From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-0.6 required=3.0 tests=DKIM_SIGNED,DKIM_VALID, DKIM_VALID_AU,FREEMAIL_FORGED_FROMDOMAIN,FREEMAIL_FROM, HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8B07CC433E0 for ; Mon, 1 Jun 2020 09:23:36 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id 4D02C206A4 for ; Mon, 1 Jun 2020 09:23:36 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="HyfftR8B" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 4D02C206A4 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=gmail.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id B5C528E0007; Mon, 1 Jun 2020 05:23:35 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id B0E728E0006; Mon, 1 Jun 2020 05:23:35 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 9FC1F8E0007; Mon, 1 Jun 2020 05:23:35 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0200.hostedemail.com [216.40.44.200]) by kanga.kvack.org (Postfix) with ESMTP id 8474D8E0006 for ; Mon, 1 Jun 2020 05:23:35 -0400 (EDT) Received: from smtpin05.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay02.hostedemail.com (Postfix) with ESMTP id 453C2BF01 for ; Mon, 1 Jun 2020 09:23:35 +0000 (UTC) X-FDA: 76880105190.05.bike84_3c5e0a637ce24 Received: from filter.hostedemail.com (10.5.16.251.rfc1918.com [10.5.16.251]) by smtpin05.hostedemail.com (Postfix) with ESMTP id 28BDA180318FD for ; Mon, 1 Jun 2020 09:23:35 +0000 (UTC) X-HE-Tag: bike84_3c5e0a637ce24 X-Filterd-Recvd-Size: 5745 Received: from mail-io1-f67.google.com (mail-io1-f67.google.com [209.85.166.67]) by imf17.hostedemail.com (Postfix) with ESMTP for ; Mon, 1 Jun 2020 09:23:34 +0000 (UTC) Received: by mail-io1-f67.google.com with SMTP id q8so6155095iow.7 for ; Mon, 01 Jun 2020 02:23:34 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:from:date:message-id:subject:to:cc :content-transfer-encoding; bh=Ma2feR+AOUh5xE+ib2Z3PKlkaj20ICx4TIEHRefbEws=; b=HyfftR8BXmm+yTUSV+fA+XiBhYg28LDT/sn4r2/jCBDA7pq2Tdk7bs3mi5sAZQe79f ARnMCI0HF1dt8OQYqh7o9MgJ6ydhdwgxoWcwuUcf2evEAYAcmXqszkBVdSr2H3WJDsVu quB6jO3Jq9+UUH7xKZNNHplnX7hzWBACLZZFNBo+n2Rkku+ftCylBb/gT/0hgvqKfWFx sBQWA2dK2LLybI9owaE/S2Fr2K96qmDcQjx+TqHJNzNiWshHr16k8AdBFjkKUZBMA2xM OhYeodoZXNCcuu4f5GYwQa7/QddY6OKIippJTFcCaMnG07BCzwWfZsRvlrPIhD1H7cpw urPA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to:cc :content-transfer-encoding; bh=Ma2feR+AOUh5xE+ib2Z3PKlkaj20ICx4TIEHRefbEws=; b=Or6SmHhrNfYNlDZOeG5JUi9UHWklVuqEO7/zGSqr9ETS6TuDgnOLiH0fyGQq4AxRRe FBencG07mHSeRJOVNO9tUDb3+1tI3/4UGd/mbd/3PTAuOHDN6HsdUdT5pFtlEHaTN+sm XClH0hIbrKYEekcmYxPd0JyLGmfElIelsGGBDdblacG7NxTRS/DDnvgWC4NQ0q5gPIw1 Id5ybzhKgrxTvkqQvLD6vJ0kiwOCMD7MmGVLaueiYIcScdvYngrUQ9Bif4mf1H7qhRZV 9/xjGm6q3KlDy3Snx2byG1JVkQSFOWVgiwvWEYkWH5zn5pucY/yJIWgGaVOy/MTnXfCX Hy8A== X-Gm-Message-State: AOAM531LJRGrPXKXKr/cj2lIHqSnTodSFizUyxdwIK+4na2IvrIqaBWq 5RptHr3rCwM1aOFFAPWZ16gPHfPPX745sTIQ9v4= X-Google-Smtp-Source: ABdhPJzFaXxb2niVurpOjlQPS0/LNU74ahpB1bbR9UCt0JKoEIQgU8DSYCgPUJG9gFitymutJHMUxH9STBAvSysOfzo= X-Received: by 2002:a02:84c6:: with SMTP id f64mr8046757jai.25.1591003414074; Mon, 01 Jun 2020 02:23:34 -0700 (PDT) MIME-Version: 1.0 From: Billy Laws Date: Mon, 1 Jun 2020 10:23:23 +0100 Message-ID: Subject: Re: [PATCH RFC] seccomp: Implement syscall isolation based on memory areas To: krisman@collabora.com Cc: gofmanp@gmail.com, hpa@zytor.com, keescook@chromium.org, kernel@collabora.com, linux-kernel@vger.kernel.org, linux-mm@kvack.org, luto@amacapital.net, tglx@linutronix.de, wad@chromium.org Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Rspamd-Queue-Id: 28BDA180318FD X-Spamd-Result: default: False [0.00 / 100.00] X-Rspamd-Server: rspam04 X-Bogosity: Ham, tests=bogofilter, spamicity=0.036850, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: > On May 30, 2020, at 5:26 PM, Gabriel Krisman Bertazi wrote: > > =EF=BB=BFAndy Lutomirski writes: > >>>> On May 29, 2020, at 11:00 PM, Gabriel Krisman Bertazi wrote: >>> >>> =EF=BB=BFModern Windows applications are executing system call instruct= ions >>> directly from the application's code without going through the WinAPI. >>> This breaks Wine emulation, because it doesn't have a chance to >>> intercept and emulate these syscalls before they are submitted to Linux= . >>> >>> In addition, we cannot simply trap every system call of the application >>> to userspace using PTRACE_SYSEMU, because performance would suffer, >>> since our main use case is to run Windows games over Linux. Therefore, >>> we need some in-kernel filtering to decide whether the syscall was >>> issued by the wine code or by the windows application. >> >> Do you really need in-kernel filtering? What if you could have >> efficient userspace filtering instead? That is, set something up so >> that all syscalls, except those from a special address, are translated >> to CALL thunk where the thunk is configured per task. Then the thunk >> can do whatever emulation is needed. > > Hi, > > I suggested something similar to my customer, by using > libsyscall-intercept. The idea would be overwritting the syscall > instruction with a call to the entry point. I'm not a specialist on the > specifics of Windows games, (cc'ed Paul Gofman, who can provide more > details on that side), but as far as I understand, the reason why that > is not feasible is that the anti-cheat protection in games will abort > execution if the binary region was modified either on-disk or in-memory. > > Is there some mechanism to do that without modiyfing the application? Hi, I work on an emulator for the Nintendo Switch that uses a similar technique= , in our testing it works very well and is much more performant than even PTRACE_SYSEMU. To work around DRM reading the memory contents I think mprotect could be used, after patching the syscall a copy of the original code could be kept somewhere in memory and the patched region mapped --X. With this, any time the DRM attempts to read to the patched region and perform integrity checks it will cause a segfault and a branch to the signal handler. This handler can then return the contents of the original, unpatched region to satisfy them checks. Are memory contents checked by DRM solutions too often for this to be performant? -- Billy Laws > >> Getting the details and especially the interaction with any seccomp >> filters that may be installed right could be tricky, but the performance >> should be decent, at least on non-PTI systems. >> >> (If we go this route, I suspect that the correct interaction with >> seccomp is that this type of redirection takes precedence over seccomp >> and seccomp filters are not invoked for redirected syscalls. After all, >> a redirected syscall is, functionally, not a syscall at all.) >> > > > -- > Gabriel Krisman Bertazi