[PATCH] arm64: raise default ARCH_MMAP_RND_BITS for 48-bit and 52-bit VA

[PATCH] arm64: raise default ARCH_MMAP_RND_BITS for 48-bit and 52-bit VA

[Iurii Trukhin]

Since commit f101c5644771 ("arm64: Support ARM64_VA_BITS=52 when
setting ARCH_MMAP_RND_BITS_MAX"), arm64 supports up to 33, 31, and 29
bits of mmap ASLR entropy on 48-bit and 52-bit virtual address spaces
for 4K, 16K, and 64K pages respectively. However, ARCH_MMAP_RND_BITS
still defaults to ARCH_MMAP_RND_BITS_MIN (18, 16, and 14 bits), which
was set in commit 8f0d3aa9de57 ("arm64: mm: support ARCH_MMAP_RND_BITS")
when 39-bit VA was the 4K default.

Set the default ARCH_MMAP_RND_BITS for 48-bit and 52-bit VA to 28 (4K
pages), 26 (16K pages), and 24 (64K pages), matching x86_64's 1 TiB
randomization range (5 bits below ARCH_MMAP_RND_BITS_MAX) while keeping
ARCH_MMAP_RND_BITS_MIN unchanged for smaller VA configurations.

Closes: https://github.com/KSPP/linux/issues/371
Signed-off-by: Iurii Trukhin <yuri@trukhin.com>
---
 arch/arm64/Kconfig | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig
index cab741a695f5..59a53d7a75c5 100644
--- a/arch/arm64/Kconfig
+++ b/arch/arm64/Kconfig
@@ -313,6 +313,11 @@ config ARCH_MMAP_RND_BITS_MAX
 	default 16 if ARM64_16K_PAGES
 	default 18

+config ARCH_MMAP_RND_BITS
+	default 24 if (ARM64_VA_BITS=48 || ARM64_VA_BITS=52) && ARM64_64K_PAGES
+	default 26 if (ARM64_VA_BITS=48 || ARM64_VA_BITS=52) && ARM64_16K_PAGES
+	default 28 if (ARM64_VA_BITS=48 || ARM64_VA_BITS=52)
+
 config ARCH_MMAP_RND_COMPAT_BITS_MIN
 	default 7 if ARM64_64K_PAGES
 	default 9 if ARM64_16K_PAGES
-- 
2.56.0

Re: [PATCH] arm64: raise default ARCH_MMAP_RND_BITS for 48-bit and 52-bit VA

[Kees Cook]

On Wed, Oct 14, 2026 at 07:26:48PM -0500, Iurii Trukhin wrote:
> Since commit f101c5644771 ("arm64: Support ARM64_VA_BITS=52 when
> setting ARCH_MMAP_RND_BITS_MAX"), arm64 supports up to 33, 31, and 29
> bits of mmap ASLR entropy on 48-bit and 52-bit virtual address spaces
> for 4K, 16K, and 64K pages respectively. However, ARCH_MMAP_RND_BITS
> still defaults to ARCH_MMAP_RND_BITS_MIN (18, 16, and 14 bits), which
> was set in commit 8f0d3aa9de57 ("arm64: mm: support ARCH_MMAP_RND_BITS")
> when 39-bit VA was the 4K default.
> 
> Set the default ARCH_MMAP_RND_BITS for 48-bit and 52-bit VA to 28 (4K
> pages), 26 (16K pages), and 24 (64K pages), matching x86_64's 1 TiB
> randomization range (5 bits below ARCH_MMAP_RND_BITS_MAX) while keeping
> ARCH_MMAP_RND_BITS_MIN unchanged for smaller VA configurations.
> 
> Closes: https://github.com/KSPP/linux/issues/371
> Signed-off-by: Iurii Trukhin <yuri@trukhin.com>

Yes please. :)

Reviewed-by: Kees Cook <kees@kernel.org>

-- 
Kees Cook

Re: [PATCH] arm64: raise default ARCH_MMAP_RND_BITS for 48-bit and 52-bit VA

[Anshuman Khandual]

On Wed, Oct 14, 2026 at 07:26:48PM -0500, Iurii Trukhin wrote:
> Since commit f101c5644771 ("arm64: Support ARM64_VA_BITS=52 when
> setting ARCH_MMAP_RND_BITS_MAX"), arm64 supports up to 33, 31, and 29
> bits of mmap ASLR entropy on 48-bit and 52-bit virtual address spaces
> for 4K, 16K, and 64K pages respectively. However, ARCH_MMAP_RND_BITS
> still defaults to ARCH_MMAP_RND_BITS_MIN (18, 16, and 14 bits), which
> was set in commit 8f0d3aa9de57 ("arm64: mm: support ARCH_MMAP_RND_BITS")
> when 39-bit VA was the 4K default.
> 
> Set the default ARCH_MMAP_RND_BITS for 48-bit and 52-bit VA to 28 (4K
> pages), 26 (16K pages), and 24 (64K pages), matching x86_64's 1 TiB
> randomization range (5 bits below ARCH_MMAP_RND_BITS_MAX) while keeping
> ARCH_MMAP_RND_BITS_MIN unchanged for smaller VA configurations.
> 
> Closes: https://github.com/KSPP/linux/issues/371
> Signed-off-by: Iurii Trukhin <yuri@trukhin.com>
> ---
>  arch/arm64/Kconfig | 5 +++++
>  1 file changed, 5 insertions(+)
> 
> diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig
> index cab741a695f5..59a53d7a75c5 100644
> --- a/arch/arm64/Kconfig
> +++ b/arch/arm64/Kconfig
> @@ -313,6 +313,11 @@ config ARCH_MMAP_RND_BITS_MAX
>  	default 16 if ARM64_16K_PAGES
>  	default 18
> 
> +config ARCH_MMAP_RND_BITS
> +	default 24 if (ARM64_VA_BITS=48 || ARM64_VA_BITS=52) && ARM64_64K_PAGES
> +	default 26 if (ARM64_VA_BITS=48 || ARM64_VA_BITS=52) && ARM64_16K_PAGES
> +	default 28 if (ARM64_VA_BITS=48 || ARM64_VA_BITS=52)
> +

Overriding ARCH_MMAP_RND_BITS inside the platform effectively makes this config
look something like the following on arm64.

config ARCH_MMAP_RND_BITS
	int "Number of bits to use for ASLR of mmap base address" if EXPERT
	range ARCH_MMAP_RND_BITS_MIN ARCH_MMAP_RND_BITS_MAX
	-------------
	default 24 if (ARM64_VA_BITS=48 || ARM64_VA_BITS=52) && ARM64_64K_PAGES
	default 26 if (ARM64_VA_BITS=48 || ARM64_VA_BITS=52) && ARM64_16K_PAGES
	default 28 if (ARM64_VA_BITS=48 || ARM64_VA_BITS=52)
	-------------
	default ARCH_MMAP_RND_BITS_MIN
	depends on HAVE_ARCH_MMAP_RND_BITS
	help
	  This value can be used to select the number of bits to use to
	  determine the random offset to the base address of vma regions
	  resulting from mmap allocations. This value will be bounded
	  by the architecture's minimum and maximum supported values.

	  This value can be changed after boot using the
	  /proc/sys/vm/mmap_rnd_bits tunable

ARCH_MMAP_RND_BITS_MIN still gets used when VA_BITS != 48 or 52. But this seems
like a subtle detail. Just wondering - should a comment explaining this default
random bits fallback sequence be added here as well ?

>  config ARCH_MMAP_RND_COMPAT_BITS_MIN
>  	default 7 if ARM64_64K_PAGES
>  	default 9 if ARM64_16K_PAGES
> -- 
> 2.56.0

Re: [PATCH] arm64: raise default ARCH_MMAP_RND_BITS for 48-bit and 52-bit VA

[Iurii Trukhin]

On Thu, Oct 15, 2026 at 10:25:49AM +0530, Anshuman Khandual wrote:
> ARCH_MMAP_RND_BITS_MIN still gets used when VA_BITS != 48 or 52. But this seems
> like a subtle detail. Just wondering - should a comment explaining this default
> random bits fallback sequence be added here as well ?

Agreed, since arch/Kconfig includes arch/$(SRCARCH)/Kconfig before
defining the generic config ARCH_MMAP_RND_BITS entry, the fallback to
default ARCH_MMAP_RND_BITS_MIN in arch/Kconfig is not obvious when
reading arch/arm64/Kconfig on its own.

I will send a v2 adding a comment right above config ARCH_MMAP_RND_BITS
to make that fallback sequence explicit.

Thanks,
Iurii