Merge remote-tracking branch 'mips/mips-for-linux-next'

[karo-tx-linux.git] / arch / x86 / Kconfig.debug

diff --git a/arch/x86/Kconfig.debug b/arch/x86/Kconfig.debug
index d8c0d3266173d96f84ac543885ba0bd63c0c3e47..3e0baf726eef56f04765d26349e34b719fbd1e9f 100644 (file)
--- a/arch/x86/Kconfig.debug
+++ b/arch/x86/Kconfig.debug
@@ -65,10 +65,14 @@ config EARLY_PRINTK_EFI
          This is useful for kernel debugging when your machine crashes very
          early before the console code is initialized.
 
+config X86_PTDUMP_CORE
+       def_bool n
+
 config X86_PTDUMP
        bool "Export kernel pagetable layout to userspace via debugfs"
        depends on DEBUG_KERNEL
        select DEBUG_FS
+       select X86_PTDUMP_CORE
        ---help---
          Say Y here if you want to show the kernel pagetable layout in a
          debugfs file. This information is only useful for kernel developers
@@ -79,7 +83,8 @@ config X86_PTDUMP
 
 config EFI_PGT_DUMP
        bool "Dump the EFI pagetable"
-       depends on EFI && X86_PTDUMP
+       depends on EFI
+       select X86_PTDUMP_CORE
        ---help---
          Enable this if you want to dump the EFI page table before
          enabling virtual mode. This can be used to debug miscellaneous
@@ -105,6 +110,35 @@ config DEBUG_RODATA_TEST
          feature as well as for the change_page_attr() infrastructure.
          If in doubt, say "N"
 
+config DEBUG_WX
+       bool "Warn on W+X mappings at boot"
+       depends on DEBUG_RODATA
+       default y
+       select X86_PTDUMP_CORE
+       ---help---
+         Generate a warning if any W+X mappings are found at boot.
+
+         This is useful for discovering cases where the kernel is leaving
+         W+X mappings after applying NX, as such mappings are a security risk.
+
+         Look for a message in dmesg output like this:
+
+           x86/mm: Checked W+X mappings: passed, no W+X pages found.
+
+         or like this, if the check failed:
+
+           x86/mm: Checked W+X mappings: FAILED, <N> W+X pages found.
+
+         Note that even if the check fails, your kernel is possibly
+         still fine, as W+X mappings are not a security hole in
+         themselves, what they do is that they make the exploitation
+         of other unfixed kernel bugs easier.
+
+         There is no runtime or memory usage effect of this option
+         once the kernel has booted up - it's a one time check.
+
+         If in doubt, say "Y".
+
 config DEBUG_SET_MODULE_RONX
        bool "Set loadable kernel module data as NX and text as RO"
        depends on MODULES