@@ -1082,9 +1082,65 @@ config RODATA_FULL_DEFAULT_ENABLED
10821082 This requires the linear region to be mapped down to pages,
10831083 which may adversely affect performance in some cases.
10841084
1085+ config ARM64_SW_TTBR0_PAN
1086+ bool "Emulate Privileged Access Never using TTBR0_EL1 switching"
1087+ help
1088+ Enabling this option prevents the kernel from accessing
1089+ user-space memory directly by pointing TTBR0_EL1 to a reserved
1090+ zeroed area and reserved ASID. The user access routines
1091+ restore the valid TTBR0_EL1 temporarily.
1092+
1093+ menuconfig COMPAT
1094+ bool "Kernel support for 32-bit EL0"
1095+ depends on ARM64_4K_PAGES || EXPERT
1096+ select COMPAT_BINFMT_ELF if BINFMT_ELF
1097+ select HAVE_UID16
1098+ select OLD_SIGSUSPEND3
1099+ select COMPAT_OLD_SIGACTION
1100+ help
1101+ This option enables support for a 32-bit EL0 running under a 64-bit
1102+ kernel at EL1. AArch32-specific components such as system calls,
1103+ the user helper functions, VFP support and the ptrace interface are
1104+ handled appropriately by the kernel.
1105+
1106+ If you use a page size other than 4KB (i.e, 16KB or 64KB), please be aware
1107+ that you will only be able to execute AArch32 binaries that were compiled
1108+ with page size aligned segments.
1109+
1110+ If you want to execute 32-bit userspace applications, say Y.
1111+
1112+ if COMPAT
1113+
1114+ config KUSER_HELPERS
1115+ bool "Enable kuser helpers page for 32 bit applications"
1116+ default y
1117+ help
1118+ Warning: disabling this option may break 32-bit user programs.
1119+
1120+ Provide kuser helpers to compat tasks. The kernel provides
1121+ helper code to userspace in read only form at a fixed location
1122+ to allow userspace to be independent of the CPU type fitted to
1123+ the system. This permits binaries to be run on ARMv4 through
1124+ to ARMv8 without modification.
1125+
1126+ See Documentation/arm/kernel_user_helpers.txt for details.
1127+
1128+ However, the fixed address nature of these helpers can be used
1129+ by ROP (return orientated programming) authors when creating
1130+ exploits.
1131+
1132+ If all of the binaries and libraries which run on your platform
1133+ are built specifically for your platform, and make no use of
1134+ these helpers, then you can turn this option off to hinder
1135+ such exploits. However, in that case, if a binary or library
1136+ relying on those helpers is run, it will not function correctly.
1137+
1138+ Say N here only if you are absolutely certain that you do not
1139+ need these helpers; otherwise, the safe option is to say Y.
1140+
1141+
10851142menuconfig ARMV8_DEPRECATED
10861143 bool "Emulate deprecated/obsolete ARMv8 instructions"
1087- depends on COMPAT
10881144 depends on SYSCTL
10891145 help
10901146 Legacy software support may require certain instructions
@@ -1150,13 +1206,7 @@ config SETEND_EMULATION
11501206 If unsure, say Y
11511207endif
11521208
1153- config ARM64_SW_TTBR0_PAN
1154- bool "Emulate Privileged Access Never using TTBR0_EL1 switching"
1155- help
1156- Enabling this option prevents the kernel from accessing
1157- user-space memory directly by pointing TTBR0_EL1 to a reserved
1158- zeroed area and reserved ASID. The user access routines
1159- restore the valid TTBR0_EL1 temporarily.
1209+ endif
11601210
11611211menu "ARMv8.1 architectural features"
11621212
@@ -1479,53 +1529,6 @@ config DMI
14791529
14801530endmenu
14811531
1482- config COMPAT
1483- bool "Kernel support for 32-bit EL0"
1484- depends on ARM64_4K_PAGES || EXPERT
1485- select COMPAT_BINFMT_ELF if BINFMT_ELF
1486- select HAVE_UID16
1487- select OLD_SIGSUSPEND3
1488- select COMPAT_OLD_SIGACTION
1489- help
1490- This option enables support for a 32-bit EL0 running under a 64-bit
1491- kernel at EL1. AArch32-specific components such as system calls,
1492- the user helper functions, VFP support and the ptrace interface are
1493- handled appropriately by the kernel.
1494-
1495- If you use a page size other than 4KB (i.e, 16KB or 64KB), please be aware
1496- that you will only be able to execute AArch32 binaries that were compiled
1497- with page size aligned segments.
1498-
1499- If you want to execute 32-bit userspace applications, say Y.
1500-
1501- config KUSER_HELPERS
1502- bool "Enable kuser helpers page for 32 bit applications."
1503- depends on COMPAT
1504- default y
1505- help
1506- Warning: disabling this option may break 32-bit user programs.
1507-
1508- Provide kuser helpers to compat tasks. The kernel provides
1509- helper code to userspace in read only form at a fixed location
1510- to allow userspace to be independent of the CPU type fitted to
1511- the system. This permits binaries to be run on ARMv4 through
1512- to ARMv8 without modification.
1513-
1514- See Documentation/arm/kernel_user_helpers.txt for details.
1515-
1516- However, the fixed address nature of these helpers can be used
1517- by ROP (return orientated programming) authors when creating
1518- exploits.
1519-
1520- If all of the binaries and libraries which run on your platform
1521- are built specifically for your platform, and make no use of
1522- these helpers, then you can turn this option off to hinder
1523- such exploits. However, in that case, if a binary or library
1524- relying on those helpers is run, it will not function correctly.
1525-
1526- Say N here only if you are absolutely certain that you do not
1527- need these helpers; otherwise, the safe option is to say Y.
1528-
15291532config SYSVIPC_COMPAT
15301533 def_bool y
15311534 depends on COMPAT && SYSVIPC
0 commit comments