| .. | .. |
|---|
| 1 | | - |
|---|
| 2 | | -config ARM64_PTDUMP_CORE |
|---|
| 3 | | - def_bool n |
|---|
| 4 | | - |
|---|
| 5 | | -config ARM64_PTDUMP_DEBUGFS |
|---|
| 6 | | - bool "Export kernel pagetable layout to userspace via debugfs" |
|---|
| 7 | | - depends on DEBUG_KERNEL |
|---|
| 8 | | - select ARM64_PTDUMP_CORE |
|---|
| 9 | | - select DEBUG_FS |
|---|
| 10 | | - help |
|---|
| 11 | | - Say Y here if you want to show the kernel pagetable layout in a |
|---|
| 12 | | - debugfs file. This information is only useful for kernel developers |
|---|
| 13 | | - who are working in architecture specific areas of the kernel. |
|---|
| 14 | | - It is probably not a good idea to enable this feature in a production |
|---|
| 15 | | - kernel. |
|---|
| 16 | | - |
|---|
| 17 | | - If in doubt, say N. |
|---|
| 1 | +# SPDX-License-Identifier: GPL-2.0-only |
|---|
| 18 | 2 | |
|---|
| 19 | 3 | config PID_IN_CONTEXTIDR |
|---|
| 20 | 4 | bool "Write the current PID to the CONTEXTIDR register" |
|---|
| .. | .. |
|---|
| 23 | 7 | the CONTEXTIDR register, at the expense of some additional |
|---|
| 24 | 8 | instructions during context switch. Say Y here only if you are |
|---|
| 25 | 9 | planning to use hardware trace tools with this kernel. |
|---|
| 26 | | - |
|---|
| 27 | | -config ARM64_RANDOMIZE_TEXT_OFFSET |
|---|
| 28 | | - bool "Randomize TEXT_OFFSET at build time" |
|---|
| 29 | | - help |
|---|
| 30 | | - Say Y here if you want the image load offset (AKA TEXT_OFFSET) |
|---|
| 31 | | - of the kernel to be randomized at build-time. When selected, |
|---|
| 32 | | - this option will cause TEXT_OFFSET to be randomized upon any |
|---|
| 33 | | - build of the kernel, and the offset will be reflected in the |
|---|
| 34 | | - text_offset field of the resulting Image. This can be used to |
|---|
| 35 | | - fuzz-test bootloaders which respect text_offset. |
|---|
| 36 | | - |
|---|
| 37 | | - This option is intended for bootloader and/or kernel testing |
|---|
| 38 | | - only. Bootloaders must make no assumptions regarding the value |
|---|
| 39 | | - of TEXT_OFFSET and platforms must not require a specific |
|---|
| 40 | | - value. |
|---|
| 41 | | - |
|---|
| 42 | | -config DEBUG_WX |
|---|
| 43 | | - bool "Warn on W+X mappings at boot" |
|---|
| 44 | | - select ARM64_PTDUMP_CORE |
|---|
| 45 | | - ---help--- |
|---|
| 46 | | - Generate a warning if any W+X mappings are found at boot. |
|---|
| 47 | | - |
|---|
| 48 | | - This is useful for discovering cases where the kernel is leaving |
|---|
| 49 | | - W+X mappings after applying NX, as such mappings are a security risk. |
|---|
| 50 | | - This check also includes UXN, which should be set on all kernel |
|---|
| 51 | | - mappings. |
|---|
| 52 | | - |
|---|
| 53 | | - Look for a message in dmesg output like this: |
|---|
| 54 | | - |
|---|
| 55 | | - arm64/mm: Checked W+X mappings: passed, no W+X pages found. |
|---|
| 56 | | - |
|---|
| 57 | | - or like this, if the check failed: |
|---|
| 58 | | - |
|---|
| 59 | | - arm64/mm: Checked W+X mappings: FAILED, <N> W+X pages found. |
|---|
| 60 | | - |
|---|
| 61 | | - Note that even if the check fails, your kernel is possibly |
|---|
| 62 | | - still fine, as W+X mappings are not a security hole in |
|---|
| 63 | | - themselves, what they do is that they make the exploitation |
|---|
| 64 | | - of other unfixed kernel bugs easier. |
|---|
| 65 | | - |
|---|
| 66 | | - There is no runtime or memory usage effect of this option |
|---|
| 67 | | - once the kernel has booted up - it's a one time check. |
|---|
| 68 | | - |
|---|
| 69 | | - If in doubt, say "Y". |
|---|
| 70 | | - |
|---|
| 71 | | -config DEBUG_ALIGN_RODATA |
|---|
| 72 | | - depends on STRICT_KERNEL_RWX |
|---|
| 73 | | - bool "Align linker sections up to SECTION_SIZE" |
|---|
| 74 | | - help |
|---|
| 75 | | - If this option is enabled, sections that may potentially be marked as |
|---|
| 76 | | - read only or non-executable will be aligned up to the section size of |
|---|
| 77 | | - the kernel. This prevents sections from being split into pages and |
|---|
| 78 | | - avoids a potential TLB penalty. The downside is an increase in |
|---|
| 79 | | - alignment and potentially wasted space. Turn on this option if |
|---|
| 80 | | - performance is more important than memory pressure. |
|---|
| 81 | | - |
|---|
| 82 | | - If in doubt, say N. |
|---|
| 83 | 10 | |
|---|
| 84 | 11 | config DEBUG_EFI |
|---|
| 85 | 12 | depends on EFI && DEBUG_INFO |
|---|