From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.6 required=3.0 tests=DKIM_INVALID,DKIM_SIGNED, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH,MAILING_LIST_MULTI,SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id C9BB8C2BA19 for ; Tue, 21 Apr 2020 08:17:30 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id 8C46220B1F for ; Tue, 21 Apr 2020 08:17:30 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=fail reason="signature verification failed" (2048-bit key) header.d=sifive.com header.i=@sifive.com header.b="cj0aBop9" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 8C46220B1F Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=sifive.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id 2DD6B8E0006; Tue, 21 Apr 2020 04:17:30 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 2B3F18E0003; Tue, 21 Apr 2020 04:17:30 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 1F1D98E0006; Tue, 21 Apr 2020 04:17:30 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0049.hostedemail.com [216.40.44.49]) by kanga.kvack.org (Postfix) with ESMTP id 0BC228E0003 for ; Tue, 21 Apr 2020 04:17:30 -0400 (EDT) Received: from smtpin24.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay04.hostedemail.com (Postfix) with ESMTP id AE05C40C7 for ; Tue, 21 Apr 2020 08:17:29 +0000 (UTC) X-FDA: 76731157818.24.game65_731a72808013 X-HE-Tag: game65_731a72808013 X-Filterd-Recvd-Size: 4927 Received: from mail-pf1-f193.google.com (mail-pf1-f193.google.com [209.85.210.193]) by imf18.hostedemail.com (Postfix) with ESMTP for ; Tue, 21 Apr 2020 08:17:29 +0000 (UTC) Received: by mail-pf1-f193.google.com with SMTP id x15so2010163pfa.1 for ; Tue, 21 Apr 2020 01:17:29 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sifive.com; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=qCOK+HxEBj2bh5BFlG2zt/46BhY0DW9NF3gypZJ6i18=; b=cj0aBop907dm+mkl5z5Mfm3dfJHK382iyGGadBdhXTU4SezE2MCsVNmjWKHydO1MeY hFpq9McPFpfy4rmx7G+Ad1j8hWL2TnkmF0IkMCtKAGmpU+zQZ6aqaTdmOppP8E8jMoFd Fk88jdQI+8R4LkqajRqwVMi8EwnmwqLx6QnbQ8a9F0T2Mu69VHyd9ana73iFO3tfR1QY WOG8lsevniXIBle/Wpw32M1HPnUM/cXVhVfyULOzUIUxNwMYRjXLGcKHakrVVhIkdCst HcA/EUYHskjCRFk4RGeoZHsmrSkm/oL6EadoBmaeDy9n6/Ei3y51wlw/4DW50BwDLHDj 41mw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=qCOK+HxEBj2bh5BFlG2zt/46BhY0DW9NF3gypZJ6i18=; b=PHTKSEqLutAdV+JfyUSysoynz034r9YvjJfi6cvjhSG5hCjXeIqcmnJJIdEsobSLYD 2Wibrq2WDV800J1QLQXDD+9fV4Bbz+WanEFBVZqIWmfy/qKJpahnAoSHn7rRu/EaejXq hldRb5HL987nfUX/2nH/gqjCRkEMh+hdoXl4u1+FTufmTlF5bBoDsTmCQX8WgEnt/g4r nBXAfA1jBeFqRLwY5EYklLjr7UUBVkYPcBSDA8rwoHBEoGfqcLyvz68LyIWuxlLIpvaF EykwOrBxA7OEMTXjxvey0RltyermIcaGh6CsPM8pLUlY9BRcodim78yCGIzop2723n5z H6Ww== X-Gm-Message-State: AGi0Pua6Rq+89l/C04zOHHrt06fmnaVy24VQN6h7v1/bnMaBGGF9iS0Y 6ystm5CcSjwD5djBhQVi6ziItA== X-Google-Smtp-Source: APiQypLl5oCj7vFGv7zZNaxGJsgDSRmBearvlFa0TCQKMUrRrSskifrV8HFOIzfmSxRHB+7OBiCjMA== X-Received: by 2002:a62:18c8:: with SMTP id 191mr21232603pfy.255.1587457048276; Tue, 21 Apr 2020 01:17:28 -0700 (PDT) Received: from hsinchu02.internal.sifive.com (114-34-229-221.HINET-IP.hinet.net. [114.34.229.221]) by smtp.gmail.com with ESMTPSA id v9sm1610067pju.3.2020.04.21.01.17.25 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 21 Apr 2020 01:17:27 -0700 (PDT) From: Zong Li To: akpm@linux-foundation.org, linux-mm@kvack.org, linux-kernel@vger.kernel.org, paul.walmsley@sifive.com, palmer@dabbelt.com, linux-riscv@lists.infradead.org, tglx@linutronix.de, mingo@redhat.com, bp@alien8.de, x86@kernel.org, hpa@zytor.com, catalin.marinas@arm.com, will@kernel.org, linux-arm-kernel@lists.infradead.org Cc: Zong Li Subject: [PATCH 1/4] mm: add DEBUG_WX support Date: Tue, 21 Apr 2020 16:17:12 +0800 Message-Id: <23980cd0f0e5d79e24a92169116407c75bcc650d.1587455584.git.zong.li@sifive.com> X-Mailer: git-send-email 2.26.1 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: Some architectures support DEBUG_WX function, it's verbatim from each others. Extract to mm/Kconfig.debug for shared use. Signed-off-by: Zong Li Suggested-by: Palmer Dabbelt --- mm/Kconfig.debug | 33 +++++++++++++++++++++++++++++++++ 1 file changed, 33 insertions(+) diff --git a/mm/Kconfig.debug b/mm/Kconfig.debug index 0271b22e063f..077458ad968d 100644 --- a/mm/Kconfig.debug +++ b/mm/Kconfig.debug @@ -118,6 +118,39 @@ config DEBUG_RODATA_TEST ---help--- This option enables a testcase for the setting rodata read-only. =20 +config ARCH_HAS_DEBUG_WX + bool + +config DEBUG_WX + bool "Warn on W+X mappings at boot" + depends on ARCH_HAS_DEBUG_WX + select PTDUMP_CORE + help + Generate a warning if any W+X mappings are found at boot. + + This is useful for discovering cases where the kernel is leaving + W+X mappings after applying NX, as such mappings are a security risk. + This check also includes UXN, which should be set on all kernel + mappings. + + Look for a message in dmesg output like this: + + /mm: Checked W+X mappings: passed, no W+X pages found. + + or like this, if the check failed: + + /mm: Checked W+X mappings: failed, W+X pages found. + + Note that even if the check fails, your kernel is possibly + still fine, as W+X mappings are not a security hole in + themselves, what they do is that they make the exploitation + of other unfixed kernel bugs easier. + + There is no runtime or memory usage effect of this option + once the kernel has booted up - it's a one time check. + + If in doubt, say "Y". + config GENERIC_PTDUMP bool =20 --=20 2.26.1