| .. | .. |
|---|
| 1 | +# SPDX-License-Identifier: GPL-2.0-only |
|---|
| 1 | 2 | config PAGE_EXTENSION |
|---|
| 2 | 3 | bool "Extend memmap on extra space for more information on page" |
|---|
| 3 | | - ---help--- |
|---|
| 4 | + help |
|---|
| 4 | 5 | Extend memmap on extra space for more information on page. This |
|---|
| 5 | 6 | could be used for debugging features that need to insert extra |
|---|
| 6 | 7 | field for every page. This extension enables us to save memory |
|---|
| .. | .. |
|---|
| 11 | 12 | bool "Debug page memory allocations" |
|---|
| 12 | 13 | depends on DEBUG_KERNEL |
|---|
| 13 | 14 | depends on !HIBERNATION || ARCH_SUPPORTS_DEBUG_PAGEALLOC && !PPC && !SPARC |
|---|
| 14 | | - select PAGE_EXTENSION |
|---|
| 15 | 15 | select PAGE_POISONING if !ARCH_SUPPORTS_DEBUG_PAGEALLOC |
|---|
| 16 | | - ---help--- |
|---|
| 16 | + help |
|---|
| 17 | 17 | Unmap pages from the kernel linear mapping after free_pages(). |
|---|
| 18 | 18 | Depending on runtime enablement, this results in a small or large |
|---|
| 19 | 19 | slowdown, but helps to find certain types of memory corruption. |
|---|
| 20 | 20 | |
|---|
| 21 | + Also, the state of page tracking structures is checked more often as |
|---|
| 22 | + pages are being allocated and freed, as unexpected state changes |
|---|
| 23 | + often happen for same reasons as memory corruption (e.g. double free, |
|---|
| 24 | + use-after-free). The error reports for these checks can be augmented |
|---|
| 25 | + with stack traces of last allocation and freeing of the page, when |
|---|
| 26 | + PAGE_OWNER is also selected and enabled on boot. |
|---|
| 27 | + |
|---|
| 21 | 28 | For architectures which don't enable ARCH_SUPPORTS_DEBUG_PAGEALLOC, |
|---|
| 22 | 29 | fill the pages with poison patterns after free_pages() and verify |
|---|
| 23 | | - the patterns before alloc_pages(). Additionally, |
|---|
| 24 | | - this option cannot be enabled in combination with hibernation as |
|---|
| 25 | | - that would result in incorrect warnings of memory corruption after |
|---|
| 26 | | - a resume because free pages are not saved to the suspend image. |
|---|
| 30 | + the patterns before alloc_pages(). Additionally, this option cannot |
|---|
| 31 | + be enabled in combination with hibernation as that would result in |
|---|
| 32 | + incorrect warnings of memory corruption after a resume because free |
|---|
| 33 | + pages are not saved to the suspend image. |
|---|
| 27 | 34 | |
|---|
| 28 | 35 | By default this option will have a small overhead, e.g. by not |
|---|
| 29 | 36 | allowing the kernel mapping to be backed by large pages on some |
|---|
| .. | .. |
|---|
| 33 | 40 | |
|---|
| 34 | 41 | config DEBUG_PAGEALLOC_ENABLE_DEFAULT |
|---|
| 35 | 42 | bool "Enable debug page memory allocations by default?" |
|---|
| 36 | | - default n |
|---|
| 37 | 43 | depends on DEBUG_PAGEALLOC |
|---|
| 38 | | - ---help--- |
|---|
| 44 | + help |
|---|
| 39 | 45 | Enable debug page memory allocations by default? This value |
|---|
| 40 | 46 | can be overridden by debug_pagealloc=off|on. |
|---|
| 41 | 47 | |
|---|
| 48 | +config PAGE_OWNER |
|---|
| 49 | + bool "Track page owner" |
|---|
| 50 | + depends on DEBUG_KERNEL && STACKTRACE_SUPPORT |
|---|
| 51 | + select DEBUG_FS |
|---|
| 52 | + select STACKTRACE |
|---|
| 53 | + select STACKDEPOT |
|---|
| 54 | + select PAGE_EXTENSION |
|---|
| 55 | + help |
|---|
| 56 | + This keeps track of what call chain is the owner of a page, may |
|---|
| 57 | + help to find bare alloc_page(s) leaks. Even if you include this |
|---|
| 58 | + feature on your build, it is disabled in default. You should pass |
|---|
| 59 | + "page_owner=on" to boot parameter in order to enable it. Eats |
|---|
| 60 | + a fair amount of memory if enabled. See tools/vm/page_owner_sort.c |
|---|
| 61 | + for user-space helper. |
|---|
| 62 | + |
|---|
| 63 | + If unsure, say N. |
|---|
| 64 | + |
|---|
| 65 | +config PAGE_PINNER |
|---|
| 66 | + bool "Track page pinner" |
|---|
| 67 | + depends on DEBUG_KERNEL && STACKTRACE_SUPPORT |
|---|
| 68 | + select DEBUG_FS |
|---|
| 69 | + select STACKTRACE |
|---|
| 70 | + select STACKDEPOT |
|---|
| 71 | + select PAGE_EXTENSION |
|---|
| 72 | + help |
|---|
| 73 | + This keeps track of what call chain is the pinner of a page, may |
|---|
| 74 | + help to find page migration failures. Even if you include this |
|---|
| 75 | + feature in your build, it is disabled by default. You should pass |
|---|
| 76 | + "page_pinner=on" to boot parameter in order to enable it. Eats |
|---|
| 77 | + a fair amount of memory if enabled. |
|---|
| 78 | + |
|---|
| 79 | + If unsure, say N. |
|---|
| 80 | + |
|---|
| 42 | 81 | config PAGE_POISONING |
|---|
| 43 | 82 | bool "Poison pages after freeing" |
|---|
| 44 | | - select PAGE_POISONING_NO_SANITY if HIBERNATION |
|---|
| 45 | | - ---help--- |
|---|
| 83 | + help |
|---|
| 46 | 84 | Fill the pages with poison patterns after free_pages() and verify |
|---|
| 47 | 85 | the patterns before alloc_pages. The filling of the memory helps |
|---|
| 48 | 86 | reduce the risk of information leaks from freed data. This does |
|---|
| .. | .. |
|---|
| 52 | 90 | Note that "poison" here is not the same thing as the "HWPoison" |
|---|
| 53 | 91 | for CONFIG_MEMORY_FAILURE. This is software poisoning only. |
|---|
| 54 | 92 | |
|---|
| 93 | + If you are only interested in sanitization of freed pages without |
|---|
| 94 | + checking the poison pattern on alloc, you can boot the kernel with |
|---|
| 95 | + "init_on_free=1" instead of enabling this. |
|---|
| 96 | + |
|---|
| 55 | 97 | If unsure, say N |
|---|
| 56 | | - |
|---|
| 57 | | -config PAGE_POISONING_NO_SANITY |
|---|
| 58 | | - depends on PAGE_POISONING |
|---|
| 59 | | - bool "Only poison, don't sanity check" |
|---|
| 60 | | - ---help--- |
|---|
| 61 | | - Skip the sanity checking on alloc, only fill the pages with |
|---|
| 62 | | - poison on free. This reduces some of the overhead of the |
|---|
| 63 | | - poisoning feature. |
|---|
| 64 | | - |
|---|
| 65 | | - If you are only interested in sanitization, say Y. Otherwise |
|---|
| 66 | | - say N. |
|---|
| 67 | | - |
|---|
| 68 | | -config PAGE_POISONING_ZERO |
|---|
| 69 | | - bool "Use zero for poisoning instead of debugging value" |
|---|
| 70 | | - depends on PAGE_POISONING |
|---|
| 71 | | - ---help--- |
|---|
| 72 | | - Instead of using the existing poison value, fill the pages with |
|---|
| 73 | | - zeros. This makes it harder to detect when errors are occurring |
|---|
| 74 | | - due to sanitization but the zeroing at free means that it is |
|---|
| 75 | | - no longer necessary to write zeros when GFP_ZERO is used on |
|---|
| 76 | | - allocation. |
|---|
| 77 | | - |
|---|
| 78 | | - If unsure, say N |
|---|
| 79 | 98 | |
|---|
| 80 | 99 | config DEBUG_PAGE_REF |
|---|
| 81 | 100 | bool "Enable tracepoint to track down page reference manipulation" |
|---|
| 82 | 101 | depends on DEBUG_KERNEL |
|---|
| 83 | 102 | depends on TRACEPOINTS |
|---|
| 84 | | - ---help--- |
|---|
| 103 | + help |
|---|
| 85 | 104 | This is a feature to add tracepoint for tracking down page reference |
|---|
| 86 | 105 | manipulation. This tracking is useful to diagnose functional failure |
|---|
| 87 | 106 | due to migration failures caused by page reference mismatches. Be |
|---|
| .. | .. |
|---|
| 92 | 111 | config DEBUG_RODATA_TEST |
|---|
| 93 | 112 | bool "Testcase for the marking rodata read-only" |
|---|
| 94 | 113 | depends on STRICT_KERNEL_RWX |
|---|
| 95 | | - ---help--- |
|---|
| 114 | + help |
|---|
| 96 | 115 | This option enables a testcase for the setting rodata read-only. |
|---|
| 116 | + |
|---|
| 117 | +config ARCH_HAS_DEBUG_WX |
|---|
| 118 | + bool |
|---|
| 119 | + |
|---|
| 120 | +config DEBUG_WX |
|---|
| 121 | + bool "Warn on W+X mappings at boot" |
|---|
| 122 | + depends on ARCH_HAS_DEBUG_WX |
|---|
| 123 | + depends on MMU |
|---|
| 124 | + select PTDUMP_CORE |
|---|
| 125 | + help |
|---|
| 126 | + Generate a warning if any W+X mappings are found at boot. |
|---|
| 127 | + |
|---|
| 128 | + This is useful for discovering cases where the kernel is leaving W+X |
|---|
| 129 | + mappings after applying NX, as such mappings are a security risk. |
|---|
| 130 | + |
|---|
| 131 | + Look for a message in dmesg output like this: |
|---|
| 132 | + |
|---|
| 133 | + <arch>/mm: Checked W+X mappings: passed, no W+X pages found. |
|---|
| 134 | + |
|---|
| 135 | + or like this, if the check failed: |
|---|
| 136 | + |
|---|
| 137 | + <arch>/mm: Checked W+X mappings: failed, <N> W+X pages found. |
|---|
| 138 | + |
|---|
| 139 | + Note that even if the check fails, your kernel is possibly |
|---|
| 140 | + still fine, as W+X mappings are not a security hole in |
|---|
| 141 | + themselves, what they do is that they make the exploitation |
|---|
| 142 | + of other unfixed kernel bugs easier. |
|---|
| 143 | + |
|---|
| 144 | + There is no runtime or memory usage effect of this option |
|---|
| 145 | + once the kernel has booted up - it's a one time check. |
|---|
| 146 | + |
|---|
| 147 | + If in doubt, say "Y". |
|---|
| 148 | + |
|---|
| 149 | +config GENERIC_PTDUMP |
|---|
| 150 | + bool |
|---|
| 151 | + |
|---|
| 152 | +config PTDUMP_CORE |
|---|
| 153 | + bool |
|---|
| 154 | + |
|---|
| 155 | +config PTDUMP_DEBUGFS |
|---|
| 156 | + bool "Export kernel pagetable layout to userspace via debugfs" |
|---|
| 157 | + depends on DEBUG_KERNEL |
|---|
| 158 | + depends on DEBUG_FS |
|---|
| 159 | + depends on GENERIC_PTDUMP |
|---|
| 160 | + select PTDUMP_CORE |
|---|
| 161 | + help |
|---|
| 162 | + Say Y here if you want to show the kernel pagetable layout in a |
|---|
| 163 | + debugfs file. This information is only useful for kernel developers |
|---|
| 164 | + who are working in architecture specific areas of the kernel. |
|---|
| 165 | + It is probably not a good idea to enable this feature in a production |
|---|
| 166 | + kernel. |
|---|
| 167 | + |
|---|
| 168 | + If in doubt, say N. |
|---|