Re: [PATCH 1/2] kernel/entry: add CONFIG_SYSCALL_USER_DISPATCH to compile SUD out

[Thomas Gleixner]

Gregory!

On Sat, Jun 27 2026 at 16:55, Gregory Price wrote:

First a few formal notes.

    - Multi patch series require a cover letter

    - The subject prefix is not a matter of personal preference

See https://docs.kernel.org/process/maintainer-tip.html and the related
generic process documentation.

Please also refrain from made up acronyms in the subject line. What the
heck is SUD and why needs this to spell out the CONFIG option name
prominently.

    syscall_user_dispatch: Make it configurable in Kconfig

or something like that is concise and clear, no?

> Syscall User Dispatch is built under CONFIG_GENERIC_SYSCALL and cannot
> be disabled independent of the core syscall-entry machinery.
>
> Native foreign-binary emulators (Wine/Proton) need it, but it should
> be an optional for minimal/high security systems.

I buy the miminal system aspect, but high security is just a voodoo
argument. Why?

  1) The functionality needs to be enabled with a PRCTL, which can be
     filtered.

  2) It requires LD_PRELOAD to be effective

If your high security system allows #2 then it's not a high security
system to begin with. If you fail to add the proper filters then it does
not pass the test either.

I agree that disabling it alltogether reduces the effort, but it's not a
prerequisite.

> +config SYSCALL_USER_DISPATCH
> +	bool "Syscall User Dispatch (SUD)"
> +	depends on GENERIC_ENTRY
> +	default y
> +	help
> +	  Syscall User Dispatch (SUD) lets a thread have its own system calls
> +	  redirected to a userspace handler.  It is used by emulators that run
> +	  foreign binaries which issue system calls directly.

Huch?

What is foreign? Different country, different universe or different
mindset?

It's also not restricted to emulators. It allows to intercept and abort
system calls which are issued within a certain IP address range and
redirect them to a emulator or debugger. 


>--- a/include/linux/syscall_user_dispatch.h
>+++ b/include/linux/syscall_user_dispatch.h
>@@ -7,8 +7,22 @@
>
> #include <linux/thread_info.h>
> #include <linux/syscall_user_dispatch_types.h>
> +#include <linux/sched.h>

Why does this require to pull in the heaviest header?

> +bool syscall_user_dispatch(struct pt_regs *regs);
> +
> +static inline bool syscall_user_dispatch_clear_on_dispatch(void)

Wants to be __always_inline as otherwise agressive compilers like CLANG
happily put it out of line.

Thanks,

        tglx