Teach vm.pmap.kernel_maps about both XN bits
ClosedPublic
Actions

Authored by andrew on Dec 6 2021, 5:04 PM.

Details

Reviewers

alc
kib
markj
manu

Commits

rGdca91e7a1628: Teach vm.pmap.kernel_maps about both XN bits
rG38dbca724335: Teach vm.pmap.kernel_maps about both XN bits

Summary

The arm64 vm.pmap.kernel_maps sysctl would only check the kernel XN bit
when printing the kernel mapping. It can also be useful to check none
of the mappings allow userspace to execute from a given virtual address.
To check for this add the user XN bit when getting the kernel maps.

While here fix the ATTR_S1_AP_USER check to use ATTR_S1_AP to shift the
value to the correct offset.

Diff Detail

Repository

rG FreeBSD src repository

Lint

Lint Not Applicable

Unit

Tests Not Applicable

Event Timeline

andrew created this revision.Dec 6 2021, 5:04 PM

Herald added a reviewer: manu. · View Herald TranscriptDec 6 2021, 5:04 PM

Herald added subscribers: emaste, imp. · View Herald Transcript

andrew requested review of this revision.Dec 6 2021, 5:04 PM

Harbormaster completed remote builds in B43194: Diff 99570.Dec 6 2021, 5:04 PM

kib accepted this revision.Dec 6 2021, 5:27 PM

This revision is now accepted and ready to land.Dec 6 2021, 5:27 PM

Is UXN ever legitimately unset for anything in the kernel maps?

It should always be set on kernel maps. I would expect any executable shared memory to be in the user address space.

Userspace can execute kernel code if it's missing, even if it can't read the memory, and we did have a bug in the past where the UXN bit was missing.

markj added inline comments.Dec 6 2021, 8:11 PM

sys/arm64/arm64/pmap.c
7008	I would represent !PXN as 'x' rather than 'X', to match the case of the other permission letters. !UXN is abnormal so its representation ought to look strange as well.
7052–7053	Hum, I think this code isn't right for table descriptors, which have their own encoding for access permissions. So the output of the sysctl might incorrectly report a mapping as executable when execution is in fact disabled by an earlier table entry. ... though apparently it's possible to disable enforcement of table attributes (HPDS), huh.