Distributions would like to reduce their attack surface as much as
possible but at the same time they have to cater to a wide variety of
legacy software. One such avenue where distros have to strike a balance
is the support for 32bit syscalls on a 64bit kernel. Ideally we'd have
the ability to disable the the compat support at boot time. This would
allow the decision whether it should be disabled/enabled can be
delegated to system administrators.

This patch simply introduces ia32_disable boot parameter which aims at
disabling 32 bit process support even if CONFIG_IA32_EMULATION has been
selected at build time.

Signed-off-by: Nikolay Borisov <nik.borisov@suse.com>
---
 arch/x86/entry/common.c      | 12 ++++++++++++
 arch/x86/include/asm/traps.h |  4 ++++
 2 files changed, 16 insertions(+)

diff --git a/arch/x86/entry/common.c b/arch/x86/entry/common.c
index 6c2826417b33..817518768ba2 100644
--- a/arch/x86/entry/common.c
+++ b/arch/x86/entry/common.c
@@ -19,6 +19,7 @@
 #include <linux/nospec.h>
 #include <linux/syscalls.h>
 #include <linux/uaccess.h>
+#include <linux/init.h>
 
 #ifdef CONFIG_XEN_PV
 #include <xen/xen-ops.h>
@@ -96,6 +97,17 @@ static __always_inline int syscall_32_enter(struct pt_regs *regs)
 	return (int)regs->orig_ax;
 }
 
+#ifdef CONFIG_IA32_EMULATION
+bool ia32_disabled = false;
+
+static int ia32_disabled_cmdline(char *arg)
+{
+	ia32_disabled = true;
+	return 1;
+}
+__setup("ia32_disabled", ia32_disabled_cmdline);
+#endif
+
 /*
  * Invoke a 32-bit syscall.  Called with IRQs on in CONTEXT_KERNEL.
  */
diff --git a/arch/x86/include/asm/traps.h b/arch/x86/include/asm/traps.h
index 47ecfff2c83d..dd93aac3718b 100644
--- a/arch/x86/include/asm/traps.h
+++ b/arch/x86/include/asm/traps.h
@@ -20,6 +20,10 @@ asmlinkage __visible noinstr struct pt_regs *vc_switch_off_ist(struct pt_regs *e
 
 extern bool ibt_selftest(void);
 
+#ifdef CONFIG_IA32_EMULATION
+extern bool ia32_disabled;
+#endif
+
 #ifdef CONFIG_X86_F00F_BUG
 /* For handling the FOOF bug */
 void handle_invalid_op(struct pt_regs *regs);
-- 
2.34.1

On Wed, Jun 07 2023 at 10:29, Nikolay Borisov wrote:
> Distributions would like to reduce their attack surface as much as
> possible but at the same time they have to cater to a wide variety of
> legacy software. One such avenue where distros have to strike a balance
> is the support for 32bit syscalls on a 64bit kernel. Ideally we'd have
> the ability to disable the the compat support at boot time. This would
> allow the decision whether it should be disabled/enabled can be
> delegated to system administrators.
>
> This patch simply introduces ia32_disable boot parameter which aims at

https://www.kernel.org/doc/html/latest/process/maintainer-tip.html

> disabling 32 bit process support even if CONFIG_IA32_EMULATION has been
> selected at build time.
>
> Signed-off-by: Nikolay Borisov <nik.borisov@suse.com>
> ---
>  arch/x86/entry/common.c      | 12 ++++++++++++
>  arch/x86/include/asm/traps.h |  4 ++++

New command line parameters require documentation.

https://www.kernel.org/doc/html/latest/process/

Thanks,

        tglx