grsecurity: Make grsec compile on aarch64

This patch allows to compile a kernel for aarch64 (the arm64
architecture). Almost all major features are still missing.

diff --git a/arch/arm64/include/asm/atomic.h b/arch/arm64/include/asm/atomic.h
index 7047051ded40e3e9c3cc944fe0ce456bb6eaf897..44e8675fb67b84df63e1ebc9f6727f3e346e4fae 100644 (file)
--- a/arch/arm64/include/asm/atomic.h
+++ b/arch/arm64/include/asm/atomic.h
@@ -252,5 +252,15 @@ static inline int atomic64_add_unless(atomic64_t *v, long a, long u)
 #define atomic64_dec_and_test(v)       (atomic64_dec_return((v)) == 0)
 #define atomic64_inc_not_zero(v)       atomic64_add_unless((v), 1LL, 0LL)
 
+#define atomic64_read_unchecked(v)             atomic64_read(v)
+#define atomic64_set_unchecked(v, i)           atomic64_set((v), (i))
+#define atomic64_add_unchecked(a, v)           atomic64_add((a), (v))
+#define atomic64_add_return_unchecked(a, v)    atomic64_add_return((a), (v))
+#define atomic64_sub_unchecked(a, v)           atomic64_sub((a), (v))
+#define atomic64_inc_unchecked(v)              atomic64_inc(v)
+#define atomic64_inc_return_unchecked(v)       atomic64_inc_return(v)
+#define atomic64_dec_unchecked(v)              atomic64_dec(v)
+#define atomic64_cmpxchg_unchecked(v, o, n)    atomic64_cmpxchg((v), (o), (n))
+
 #endif
 #endif

diff --git a/arch/arm64/include/asm/pgalloc.h b/arch/arm64/include/asm/pgalloc.h
index e20df38a8ff3885409291b8c2f7b7edfeb4b6cb7..027ede3e95aa11482272fe32c7ae579390c55cc4 100644 (file)
--- a/arch/arm64/include/asm/pgalloc.h
+++ b/arch/arm64/include/asm/pgalloc.h
@@ -46,6 +46,11 @@ static inline void pud_populate(struct mm_struct *mm, pud_t *pud, pmd_t *pmd)
        set_pud(pud, __pud(__pa(pmd) | PMD_TYPE_TABLE));
 }
 
+static inline void pud_populate_kernel(struct mm_struct *mm, pud_t *pud, pmd_t *pmd)
+{
+       pud_populate(mm, pud, pmd);
+}
+
 #endif /* CONFIG_ARM64_PGTABLE_LEVELS > 2 */
 
 #if CONFIG_ARM64_PGTABLE_LEVELS > 3

diff --git a/arch/arm64/include/asm/thread_info.h b/arch/arm64/include/asm/thread_info.h
index 459bf8e53208662a6117c5d496b5d21e08e67657..268bad4373b04d2785958b6791f7cd3ee0cb3820 100644 (file)
--- a/arch/arm64/include/asm/thread_info.h
+++ b/arch/arm64/include/asm/thread_info.h
@@ -113,6 +113,10 @@ static inline struct thread_info *current_thread_info(void)
 #define TIF_SYSCALL_AUDIT      9
 #define TIF_SYSCALL_TRACEPOINT 10
 #define TIF_SECCOMP            11
+/* within 8 bits of TIF_SYSCALL_TRACE
+ *  to meet flexible second operand requirements
+ */
+#define TIF_GRSEC_SETXID       12
 #define TIF_MEMDIE             18      /* is terminating due to OOM killer */
 #define TIF_FREEZE             19
 #define TIF_RESTORE_SIGMASK    20
@@ -129,6 +133,7 @@ static inline struct thread_info *current_thread_info(void)
 #define _TIF_SYSCALL_AUDIT     (1 << TIF_SYSCALL_AUDIT)
 #define _TIF_SYSCALL_TRACEPOINT        (1 << TIF_SYSCALL_TRACEPOINT)
 #define _TIF_SECCOMP           (1 << TIF_SECCOMP)
+#define _TIF_GRSEC_SETXID      (1 << TIF_GRSEC_SETXID)
 #define _TIF_32BIT             (1 << TIF_32BIT)
 
 #define _TIF_WORK_MASK         (_TIF_NEED_RESCHED | _TIF_SIGPENDING | \
@@ -136,7 +141,7 @@ static inline struct thread_info *current_thread_info(void)
 
 #define _TIF_SYSCALL_WORK      (_TIF_SYSCALL_TRACE | _TIF_SYSCALL_AUDIT | \
                                 _TIF_SYSCALL_TRACEPOINT | _TIF_SECCOMP | \
-                                _TIF_NOHZ)
+                                _TIF_GRSEC_SETXID | _TIF_NOHZ)
 
 #endif /* __KERNEL__ */
 #endif /* __ASM_THREAD_INFO_H */

diff --git a/arch/arm64/mm/dma-mapping.c b/arch/arm64/mm/dma-mapping.c
index d9209420391381d41aa97665c3ce1dd08456c466..468a42d3fc2cc091cb9a82dadf82addbca7a5a71 100644 (file)
--- a/arch/arm64/mm/dma-mapping.c
+++ b/arch/arm64/mm/dma-mapping.c
@@ -131,7 +131,7 @@ static void __dma_free_coherent(struct device *dev, size_t size,
                                        phys_to_page(paddr),
                                        size >> PAGE_SHIFT);
        if (!freed)
-               swiotlb_free_coherent(dev, size, vaddr, dma_handle);
+               swiotlb_free_coherent(dev, size, vaddr, dma_handle, attrs);
 }
 
 static void *__dma_alloc_noncoherent(struct device *dev, size_t size,

diff --git a/grsecurity/Kconfig b/grsecurity/Kconfig
index 31f8fe471c1a81500a4730a5e8d3a8ceb1e31408..402ffd290fb07709df626ad1e242f3334053ee77 100644 (file)
--- a/grsecurity/Kconfig
+++ b/grsecurity/Kconfig
@@ -7,7 +7,7 @@ depends on GRKERNSEC
 config GRKERNSEC_KMEM
        bool "Deny reading/writing to /dev/kmem, /dev/mem, and /dev/port"
        default y if GRKERNSEC_CONFIG_AUTO
-       select STRICT_DEVMEM if (X86 || ARM || TILE || S390)
+       select STRICT_DEVMEM if (X86 || ARM64 || ARM || TILE || S390)
        help
          If you say Y here, /dev/kmem and /dev/mem won't be allowed to
          be written to or read from to modify or leak the contents of the running
@@ -259,7 +259,7 @@ config GRKERNSEC_RANDSTRUCT_PERFORMANCE
 config GRKERNSEC_KERN_LOCKOUT
        bool "Active kernel exploit response"
        default y if GRKERNSEC_CONFIG_AUTO
-       depends on X86 || ARM || PPC || SPARC
+       depends on X86 || ARM64 || ARM || PPC || SPARC
        help
          If you say Y here, when a PaX alert is triggered due to suspicious
          activity in the kernel (from KERNEXEC/UDEREF/USERCOPY)
@@ -848,7 +848,7 @@ config GRKERNSEC_PTRACE_READEXEC
 config GRKERNSEC_SETXID
        bool "Enforce consistent multithreaded privileges"
        default y if GRKERNSEC_CONFIG_AUTO
-       depends on (X86 || SPARC64 || PPC || ARM || MIPS)
+       depends on (X86 || SPARC64 || PPC || ARM64 || ARM || MIPS)
        help
          If you say Y here, a change from a root uid to a non-root uid
          in a multithreaded application will cause the resulting uids,