Skip to content

Commit

Permalink
kernel: Enable CONFIG_ARM64_PAN to restrict kernel access to user spa…
Browse files Browse the repository at this point in the history 
…ce memory

Enable the CONFIG_ARM64_PAN kernel security option, which leverages the
ARMv8.1 Privileged Access Never (PAN) extension to prevent the kernel
from directly accessing user space memory.

Instead, copy_to_user and similar functions must be used for data
transfer between kernel and user space. This feature is automatically
disabled at runtime on CPUs without PAN support, making it a no-op in
those cases.

Link: openwrt#16189
Signed-off-by: Hauke Mehrtens <[email protected]>
  • Loading branch information
@hauke
hauke committed Aug 20, 2024
1 parent fd6ce0d commit a266230
Show file tree
Hide file tree
Showing 10 changed files with 3 additions and 10 deletions.
1 change: 0 additions & 1 deletion target/linux/armsr/armv8/config-6.6
View file
Original file line number Diff line number Diff line change
Expand Up @@ -93,7 +93,6 @@ CONFIG_ARM64_HW_AFDBM=y
CONFIG_ARM64_LD_HAS_FIX_ERRATUM_843419=y
CONFIG_ARM64_MTE=y
CONFIG_ARM64_PAGE_SHIFT=12
CONFIG_ARM64_PAN=y
CONFIG_ARM64_PA_BITS=48
CONFIG_ARM64_PA_BITS_48=y
CONFIG_ARM64_PTR_AUTH=y
Expand Down
1 change: 0 additions & 1 deletion target/linux/bcm27xx/bcm2710/config-6.6
View file
Original file line number Diff line number Diff line change
Expand Up @@ -34,7 +34,6 @@ CONFIG_ARM64_ERRATUM_843419=y
CONFIG_ARM64_HW_AFDBM=y
CONFIG_ARM64_LD_HAS_FIX_ERRATUM_843419=y
CONFIG_ARM64_PAGE_SHIFT=12
CONFIG_ARM64_PAN=y
CONFIG_ARM64_PA_BITS=48
CONFIG_ARM64_PA_BITS_48=y
CONFIG_ARM64_PTR_AUTH=y
Expand Down
1 change: 0 additions & 1 deletion target/linux/bcm27xx/bcm2711/config-6.6
View file
Original file line number Diff line number Diff line change
Expand Up @@ -29,7 +29,6 @@ CONFIG_ARM64_ERRATUM_1319367=y
CONFIG_ARM64_HW_AFDBM=y
CONFIG_ARM64_LD_HAS_FIX_ERRATUM_843419=y
CONFIG_ARM64_PAGE_SHIFT=12
CONFIG_ARM64_PAN=y
CONFIG_ARM64_PA_BITS=48
CONFIG_ARM64_PA_BITS_48=y
CONFIG_ARM64_PTR_AUTH=y
Expand Down
1 change: 0 additions & 1 deletion target/linux/bcm27xx/bcm2712/config-6.6
View file
Original file line number Diff line number Diff line change
Expand Up @@ -33,7 +33,6 @@ CONFIG_ARM64_ERRATUM_3194386=y
CONFIG_ARM64_HW_AFDBM=y
CONFIG_ARM64_LD_HAS_FIX_ERRATUM_843419=y
CONFIG_ARM64_PAGE_SHIFT=12
CONFIG_ARM64_PAN=y
CONFIG_ARM64_PA_BITS=48
CONFIG_ARM64_PA_BITS_48=y
CONFIG_ARM64_PTR_AUTH=y
Expand Down
2 changes: 1 addition & 1 deletion target/linux/generic/config-5.15
View file
Original file line number Diff line number Diff line change
Expand Up @@ -349,7 +349,7 @@ CONFIG_ARCH_MMAP_RND_COMPAT_BITS_MIN=8
# CONFIG_ARM64_LSE_ATOMICS is not set
CONFIG_ARM64_MODULE_PLTS=y
# CONFIG_ARM64_MTE is not set
# CONFIG_ARM64_PAN is not set
CONFIG_ARM64_PAN=y
# CONFIG_ARM64_PMEM is not set
# CONFIG_ARM64_PSEUDO_NMI is not set
# CONFIG_ARM64_PTDUMP_DEBUGFS is not set
Expand Down
2 changes: 1 addition & 1 deletion target/linux/generic/config-6.1
View file
Original file line number Diff line number Diff line change
Expand Up @@ -383,7 +383,7 @@ CONFIG_ARCH_MMAP_RND_COMPAT_BITS_MIN=8
# CONFIG_ARM64_LSE_ATOMICS is not set
CONFIG_ARM64_MODULE_PLTS=y
# CONFIG_ARM64_MTE is not set
# CONFIG_ARM64_PAN is not set
CONFIG_ARM64_PAN=y
# CONFIG_ARM64_PMEM is not set
# CONFIG_ARM64_PSEUDO_NMI is not set
# CONFIG_ARM64_PTDUMP_DEBUGFS is not set
Expand Down
2 changes: 1 addition & 1 deletion target/linux/generic/config-6.6
View file
Original file line number Diff line number Diff line change
Expand Up @@ -358,7 +358,7 @@ CONFIG_ARCH_MMAP_RND_COMPAT_BITS_MIN=8
# CONFIG_ARM64_HW_AFDBM is not set
# CONFIG_ARM64_LSE_ATOMICS is not set
# CONFIG_ARM64_MTE is not set
# CONFIG_ARM64_PAN is not set
CONFIG_ARM64_PAN=y
# CONFIG_ARM64_PMEM is not set
# CONFIG_ARM64_PSEUDO_NMI is not set
# CONFIG_ARM64_PTR_AUTH is not set
Expand Down
1 change: 0 additions & 1 deletion target/linux/layerscape/armv8_64b/config-6.1
View file
Original file line number Diff line number Diff line change
Expand Up @@ -40,7 +40,6 @@ CONFIG_ARM64_ERRATUM_843419=y
CONFIG_ARM64_HW_AFDBM=y
CONFIG_ARM64_LD_HAS_FIX_ERRATUM_843419=y
CONFIG_ARM64_PAGE_SHIFT=12
CONFIG_ARM64_PAN=y
CONFIG_ARM64_PA_BITS=48
CONFIG_ARM64_PA_BITS_48=y
CONFIG_ARM64_PTR_AUTH=y
Expand Down
1 change: 0 additions & 1 deletion target/linux/layerscape/armv8_64b/config-6.6
View file
Original file line number Diff line number Diff line change
Expand Up @@ -41,7 +41,6 @@ CONFIG_ARM64_ERRATUM_843419=y
CONFIG_ARM64_HW_AFDBM=y
CONFIG_ARM64_LD_HAS_FIX_ERRATUM_843419=y
CONFIG_ARM64_PAGE_SHIFT=12
CONFIG_ARM64_PAN=y
CONFIG_ARM64_PA_BITS=48
CONFIG_ARM64_PA_BITS_48=y
CONFIG_ARM64_PTR_AUTH=y
Expand Down
1 change: 0 additions & 1 deletion target/linux/rockchip/armv8/config-6.6
View file
Original file line number Diff line number Diff line change
Expand Up @@ -48,7 +48,6 @@ CONFIG_ARM64_ERRATUM_858921=y
CONFIG_ARM64_HW_AFDBM=y
CONFIG_ARM64_LD_HAS_FIX_ERRATUM_843419=y
CONFIG_ARM64_PAGE_SHIFT=12
CONFIG_ARM64_PAN=y
CONFIG_ARM64_PA_BITS=48
CONFIG_ARM64_PA_BITS_48=y
CONFIG_ARM64_PTR_AUTH=y
Expand Down

0 comments on commit a266230

Please sign in to comment.