diff mbox series

[4/4] arm64: Make Aarch32 emulation boot time configurable

Message ID 1029761eb218702d4aafa58d83c4bf9d3a760264.1697614386.git.andrea.porta@suse.com
State New
Headers
Series arm64: Make Aarch32 compatibility enablement optional at boot |

Commit Message

Andrea della Porta Oct. 18, 2023, 11:13 a.m. UTC 
  Distributions would like to reduce their attack surface as much as
possible but at the same time they'd want to retain flexibility to
cater to a variety of legacy software. This stems from the conjecture
that compat layer is likely rarely tested and could have latent
security bugs. Ideally distributions will set their default policy
and also give users the ability to override it as appropriate.

To enable this use case, introduce CONFIG_AARCH32_EMULATION_DEFAULT_DISABLED
compile time option, which controls whether 32bit processes/syscalls
should be allowed or not. This option is aimed mainly at distributions
to set their preferred default behavior in their kernels.

To allow users to override the distro's policy, introduce the
'aarch32_emulation' parameter which allows overriding
CONFIG_AARCH32_EMULATION_DEFAULT_DISABLED state at boot time.

Signed-off-by: Andrea della Porta <andrea.porta@suse.com>
---
 Documentation/admin-guide/kernel-parameters.txt | 7 +++++++
 arch/arm64/Kconfig                              | 9 +++++++++
 arch/arm64/kernel/entry-common.c                | 8 +++++++-
 3 files changed, 23 insertions(+), 1 deletion(-)

Comments

Mark Rutland Oct. 18, 2023, 1:02 p.m. UTC | #1 
On Wed, Oct 18, 2023 at 01:13:22PM +0200, Andrea della Porta wrote:
> Distributions would like to reduce their attack surface as much as
> possible but at the same time they'd want to retain flexibility to
> cater to a variety of legacy software. This stems from the conjecture
> that compat layer is likely rarely tested and could have latent
> security bugs. Ideally distributions will set their default policy
> and also give users the ability to override it as appropriate.
> 
> To enable this use case, introduce CONFIG_AARCH32_EMULATION_DEFAULT_DISABLED
> compile time option, which controls whether 32bit processes/syscalls
> should be allowed or not. This option is aimed mainly at distributions
> to set their preferred default behavior in their kernels.
> 
> To allow users to override the distro's policy, introduce the
> 'aarch32_emulation' parameter which allows overriding
> CONFIG_AARCH32_EMULATION_DEFAULT_DISABLED state at boot time.
> 
> Signed-off-by: Andrea della Porta <andrea.porta@suse.com>
> ---
>  Documentation/admin-guide/kernel-parameters.txt | 7 +++++++
>  arch/arm64/Kconfig                              | 9 +++++++++
>  arch/arm64/kernel/entry-common.c                | 8 +++++++-
>  3 files changed, 23 insertions(+), 1 deletion(-)
> 
> diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
> index 0a1731a0f0ef..a41c5e6f5d2e 100644
> --- a/Documentation/admin-guide/kernel-parameters.txt
> +++ b/Documentation/admin-guide/kernel-parameters.txt
> @@ -1,3 +1,10 @@
> +	aarch32_emulation=	[ARM64]
> +			Format: <bool>
> +			When true, allows loading 32-bit programs and executing
> +			32-bit syscalls, essentially overriding
> +			AARCH32_EMULATION_DEFAULT_DISABLED at boot time. when false,
> +			unconditionally disables AARCH32 emulation.

Can we please drop the 'emulation' part of the name? We don't use that
terminology on arm64 for regular execution of compat tasks, and only use that
to refer to true emulation of deprecated instructions.

We already have the 'allow_mismatched_32bit_el0' option; can we please us a
name that aligns with that? e.g. 'allow_32bit_el0=false' to disable support.

Mark.

> +
>  	acpi=		[HW,ACPI,X86,ARM64,RISCV64]
>  			Advanced Configuration and Power Interface
>  			Format: { force | on | off | strict | noirq | rsdt |
> diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig
> index b10515c0200b..66c4cb273550 100644
> --- a/arch/arm64/Kconfig
> +++ b/arch/arm64/Kconfig
> @@ -1725,6 +1725,15 @@ config SETEND_EMULATION
>  	  If unsure, say Y
>  endif # ARMV8_DEPRECATED
>  
> +config AARCH32_EMULATION_DEFAULT_DISABLED
> +	bool "Aarch32 emulation disabled by default"
> +	default n
> +	depends on COMPAT
> +	help
> +	  Make Aarch32 emulation disabled by default. This prevents loading 32-bit
> +	  processes and access to 32-bit syscalls.
> +
> +	  If unsure, leave it to its default value.
>  endif # COMPAT
>  
>  menu "ARMv8.1 architectural features"
> diff --git a/arch/arm64/kernel/entry-common.c b/arch/arm64/kernel/entry-common.c
> index 32761760d9dd..07f2b4e632b8 100644
> --- a/arch/arm64/kernel/entry-common.c
> +++ b/arch/arm64/kernel/entry-common.c
> @@ -897,7 +897,13 @@ asmlinkage void noinstr el0t_32_error_handler(struct pt_regs *regs)
>  		__el0_error_handler_common(regs);
>  }
>  
> -bool __aarch32_enabled __ro_after_init = true;
> +bool __aarch32_enabled __ro_after_init = !IS_ENABLED(CONFIG_AARCH32_EMULATION_DEFAULT_DISABLED);
> +
> +static int aarch32_emulation_override_cmdline(char *arg)
> +{
> +	return kstrtobool(arg, &__aarch32_enabled);
> +}
> +early_param("aarch32_emulation", aarch32_emulation_override_cmdline);
>  #else /* CONFIG_COMPAT */
>  UNHANDLED(el0t, 32, sync)
>  UNHANDLED(el0t, 32, irq)
> -- 
> 2.35.3
>
Andrea della Porta Oct. 19, 2023, 12:50 p.m. UTC | #2 
On 14:02 Wed 18 Oct     , Mark Rutland wrote:
> On Wed, Oct 18, 2023 at 01:13:22PM +0200, Andrea della Porta wrote:
> > Distributions would like to reduce their attack surface as much as
> > possible but at the same time they'd want to retain flexibility to
> > cater to a variety of legacy software. This stems from the conjecture
> > that compat layer is likely rarely tested and could have latent
> > security bugs. Ideally distributions will set their default policy
> > and also give users the ability to override it as appropriate.
> > 
> > To enable this use case, introduce CONFIG_AARCH32_EMULATION_DEFAULT_DISABLED
> > compile time option, which controls whether 32bit processes/syscalls
> > should be allowed or not. This option is aimed mainly at distributions
> > to set their preferred default behavior in their kernels.
> > 
> > To allow users to override the distro's policy, introduce the
> > 'aarch32_emulation' parameter which allows overriding
> > CONFIG_AARCH32_EMULATION_DEFAULT_DISABLED state at boot time.
> > 
> > Signed-off-by: Andrea della Porta <andrea.porta@suse.com>
> > ---
> >  Documentation/admin-guide/kernel-parameters.txt | 7 +++++++
> >  arch/arm64/Kconfig                              | 9 +++++++++
> >  arch/arm64/kernel/entry-common.c                | 8 +++++++-
> >  3 files changed, 23 insertions(+), 1 deletion(-)
> > 
> > diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
> > index 0a1731a0f0ef..a41c5e6f5d2e 100644
> > --- a/Documentation/admin-guide/kernel-parameters.txt
> > +++ b/Documentation/admin-guide/kernel-parameters.txt
> > @@ -1,3 +1,10 @@
> > +	aarch32_emulation=	[ARM64]
> > +			Format: <bool>
> > +			When true, allows loading 32-bit programs and executing
> > +			32-bit syscalls, essentially overriding
> > +			AARCH32_EMULATION_DEFAULT_DISABLED at boot time. when false,
> > +			unconditionally disables AARCH32 emulation.
> 
> Can we please drop the 'emulation' part of the name? We don't use that
> terminology on arm64 for regular execution of compat tasks, and only use that
> to refer to true emulation of deprecated instructions.
> 
> We already have the 'allow_mismatched_32bit_el0' option; can we please us a
> name that aligns with that? e.g. 'allow_32bit_el0=false' to disable support.
> 

Sure, 'allow_mismatched_32bit_el0' will do. I'll prepare a patch accordingly.

Andrea
diff mbox series

Patch

diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
index 0a1731a0f0ef..a41c5e6f5d2e 100644
--- a/Documentation/admin-guide/kernel-parameters.txt
+++ b/Documentation/admin-guide/kernel-parameters.txt
@@ -1,3 +1,10 @@ 
+	aarch32_emulation=	[ARM64]
+			Format: <bool>
+			When true, allows loading 32-bit programs and executing
+			32-bit syscalls, essentially overriding
+			AARCH32_EMULATION_DEFAULT_DISABLED at boot time. when false,
+			unconditionally disables AARCH32 emulation.
+
 	acpi=		[HW,ACPI,X86,ARM64,RISCV64]
 			Advanced Configuration and Power Interface
 			Format: { force | on | off | strict | noirq | rsdt |
diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig
index b10515c0200b..66c4cb273550 100644
--- a/arch/arm64/Kconfig
+++ b/arch/arm64/Kconfig
@@ -1725,6 +1725,15 @@  config SETEND_EMULATION
 	  If unsure, say Y
 endif # ARMV8_DEPRECATED
 
+config AARCH32_EMULATION_DEFAULT_DISABLED
+	bool "Aarch32 emulation disabled by default"
+	default n
+	depends on COMPAT
+	help
+	  Make Aarch32 emulation disabled by default. This prevents loading 32-bit
+	  processes and access to 32-bit syscalls.
+
+	  If unsure, leave it to its default value.
 endif # COMPAT
 
 menu "ARMv8.1 architectural features"
diff --git a/arch/arm64/kernel/entry-common.c b/arch/arm64/kernel/entry-common.c
index 32761760d9dd..07f2b4e632b8 100644
--- a/arch/arm64/kernel/entry-common.c
+++ b/arch/arm64/kernel/entry-common.c
@@ -897,7 +897,13 @@  asmlinkage void noinstr el0t_32_error_handler(struct pt_regs *regs)
 		__el0_error_handler_common(regs);
 }
 
-bool __aarch32_enabled __ro_after_init = true;
+bool __aarch32_enabled __ro_after_init = !IS_ENABLED(CONFIG_AARCH32_EMULATION_DEFAULT_DISABLED);
+
+static int aarch32_emulation_override_cmdline(char *arg)
+{
+	return kstrtobool(arg, &__aarch32_enabled);
+}
+early_param("aarch32_emulation", aarch32_emulation_override_cmdline);
 #else /* CONFIG_COMPAT */
 UNHANDLED(el0t, 32, sync)
 UNHANDLED(el0t, 32, irq)