0001 .. SPDX-License-Identifier: GPL-2.0
0002
0003 .. _page_table_check:
0004
0005 ================
0006 Page Table Check
0007 ================
0008
0009 Introduction
0010 ============
0011
0012 Page table check allows to harden the kernel by ensuring that some types of
0013 the memory corruptions are prevented.
0014
0015 Page table check performs extra verifications at the time when new pages become
0016 accessible from the userspace by getting their page table entries (PTEs PMDs
0017 etc.) added into the table.
0018
0019 In case of detected corruption, the kernel is crashed. There is a small
0020 performance and memory overhead associated with the page table check. Therefore,
0021 it is disabled by default, but can be optionally enabled on systems where the
0022 extra hardening outweighs the performance costs. Also, because page table check
0023 is synchronous, it can help with debugging double map memory corruption issues,
0024 by crashing kernel at the time wrong mapping occurs instead of later which is
0025 often the case with memory corruptions bugs.
0026
0027 Double mapping detection logic
0028 ==============================
0029
0030 +-------------------+-------------------+-------------------+------------------+
0031 | Current Mapping | New mapping | Permissions | Rule |
0032 +===================+===================+===================+==================+
0033 | Anonymous | Anonymous | Read | Allow |
0034 +-------------------+-------------------+-------------------+------------------+
0035 | Anonymous | Anonymous | Read / Write | Prohibit |
0036 +-------------------+-------------------+-------------------+------------------+
0037 | Anonymous | Named | Any | Prohibit |
0038 +-------------------+-------------------+-------------------+------------------+
0039 | Named | Anonymous | Any | Prohibit |
0040 +-------------------+-------------------+-------------------+------------------+
0041 | Named | Named | Any | Allow |
0042 +-------------------+-------------------+-------------------+------------------+
0043
0044 Enabling Page Table Check
0045 =========================
0046
0047 Build kernel with:
0048
0049 - PAGE_TABLE_CHECK=y
0050 Note, it can only be enabled on platforms where ARCH_SUPPORTS_PAGE_TABLE_CHECK
0051 is available.
0052
0053 - Boot with 'page_table_check=on' kernel parameter.
0054
0055 Optionally, build kernel with PAGE_TABLE_CHECK_ENFORCED in order to have page
0056 table support without extra kernel parameter.
