@@ -1411,6 +1411,17 @@ config RODATA_FULL_DEFAULT_ENABLED
This requires the linear region to be mapped down to pages,
which may adversely affect performance in some cases.
+config ARM64_WXN
+ bool "Enable WXN attribute so all writable mappings are non-exec"
+ help
+ Set the WXN bit in the SCTLR system register so that all writable
+ mappings are treated as if the PXN/UXN bit is set as well.
+ If this is set to Y, it can still be disabled at runtime by
+ passing 'arm64.nowxn' on the kernel command line.
+
+ This should only be set if no software needs to be supported that
+ relies on being able to execute from writable mappings.
+
config ARM64_SW_TTBR0_PAN
bool "Emulate Privileged Access Never using TTBR0_EL1 switching"
help
@@ -19,13 +19,42 @@
#include <asm/cacheflush.h>
#include <asm/cpufeature.h>
#include <asm/proc-fns.h>
-#include <asm-generic/mm_hooks.h>
#include <asm/cputype.h>
#include <asm/sysreg.h>
#include <asm/tlbflush.h>
extern bool rodata_full;
+static inline int arch_dup_mmap(struct mm_struct *oldmm,
+ struct mm_struct *mm)
+{
+ return 0;
+}
+
+static inline void arch_exit_mmap(struct mm_struct *mm)
+{
+}
+
+static inline void arch_unmap(struct mm_struct *mm,
+ unsigned long start, unsigned long end)
+{
+}
+
+static inline bool arch_vma_access_permitted(struct vm_area_struct *vma,
+ bool write, bool execute, bool foreign)
+{
+ if (IS_ENABLED(CONFIG_ARM64_WXN) && execute &&
+ (vma->vm_flags & (VM_WRITE | VM_EXEC)) == (VM_WRITE | VM_EXEC)) {
+ extern struct arm64_ftr_override sctlr_override;
+ pr_warn_ratelimited(
+ "process %s (%d) attempted to execute from writable memory\n",
+ current->comm, current->pid);
+ /* disallow unless the nowxn override is set */
+ return sctlr_override.val & sctlr_override.mask & 0xf;
+ }
+ return true;
+}
+
static inline void contextidr_thread_switch(struct task_struct *next)
{
if (!IS_ENABLED(CONFIG_PID_IN_CONTEXTIDR))
@@ -494,6 +494,12 @@ SYM_FUNC_START_LOCAL(__primary_switched)
bl init_feature_override // Parse cpu feature overrides
bl switch_to_vhe // Prefer VHE if possible
ldp x29, x30, [sp], #16
+#ifdef CONFIG_ARM64_WXN
+ ldr_l x1, sctlr_override + FTR_OVR_VAL_OFFSET
+ tbz x1, #0, 0f
+ blr lr
+0:
+#endif
bl start_kernel
ASM_BUG()
SYM_FUNC_END(__primary_switched)
@@ -878,5 +884,25 @@ SYM_FUNC_START_LOCAL(__primary_switch)
ldr x8, =__primary_switched
adrp x0, __PHYS_OFFSET
- br x8
+ blr x8
+#ifdef CONFIG_ARM64_WXN
+ /*
+ * If we return here, we need to disable WXN before we proceed. This
+ * requires the MMU to be disabled, so it needs to occur while running
+ * from the ID map.
+ */
+ mrs x0, sctlr_el1
+ bic x1, x0, #SCTLR_ELx_M
+ msr sctlr_el1, x1
+ isb
+
+ tlbi vmalle1
+ dsb nsh
+ isb
+
+ bic x0, x0, #SCTLR_ELx_WXN
+ msr sctlr_el1, x0
+ isb
+ ret
+#endif
SYM_FUNC_END(__primary_switch)
@@ -94,12 +94,27 @@ static const struct ftr_set_desc kaslr __initconst = {
},
};
+#ifdef CONFIG_ARM64_WXN
+asmlinkage struct arm64_ftr_override sctlr_override __ro_after_init;
+static const struct ftr_set_desc sctlr __initconst = {
+ .name = "sctlr",
+ .override = &sctlr_override,
+ .fields = {
+ { "nowxn", 0 },
+ {}
+ },
+};
+#endif
+
static const struct ftr_set_desc * const regs[] __initconst = {
&mmfr1,
&pfr1,
&isar1,
&isar2,
&kaslr,
+#ifdef CONFIG_ARM64_WXN
+ &sctlr,
+#endif
};
static const struct {
@@ -115,6 +130,7 @@ static const struct {
"id_aa64isar2.gpa3=0 id_aa64isar2.apa3=0" },
{ "arm64.nomte", "id_aa64pfr1.mte=0" },
{ "nokaslr", "kaslr.disabled=1" },
+ { "arm64.nowxn", "sctlr.nowxn=1" },
};
static int __init find_field(const char *cmdline,
@@ -495,6 +495,12 @@ SYM_FUNC_START(__cpu_setup)
* Prepare SCTLR
*/
mov_q x0, INIT_SCTLR_EL1_MMU_ON
+#ifdef CONFIG_ARM64_WXN
+ ldr_l x1, sctlr_override + FTR_OVR_VAL_OFFSET
+ tst x1, #0x1 // WXN disabled on command line?
+ orr x1, x0, #SCTLR_ELx_WXN
+ csel x0, x0, x1, ne
+#endif
ret // return to head.S
.unreq mair
The AArch64 virtual memory system supports the WXN attribute, which can be set to make all writable mappings implicitly no-exec. This attribute applies to both EL0 and EL1 if enabled at EL1, making it problematic in the general case, as user space may rely on mmap() or mprotect() to return executable writable memory when asked for it. However, in specific cases where user space is known not to rely on this, the WXN can now be enabled, ensuring that inadvertent mistakes in managing memory permissions do not result in real vulnerabilities. If enabled at compile time, the feature can still be disabled at boot, by passing arm64.nowxn on the kernel command line. Signed-off-by: Ard Biesheuvel <ardb@kernel.org> --- arch/arm64/Kconfig | 11 +++++++ arch/arm64/include/asm/mmu_context.h | 31 +++++++++++++++++++- arch/arm64/kernel/head.S | 28 +++++++++++++++++- arch/arm64/kernel/idreg-override.c | 16 ++++++++++ arch/arm64/mm/proc.S | 6 ++++ 5 files changed, 90 insertions(+), 2 deletions(-)