Re: [PATCH 1/3] mseal sysmap: Add mseal_system_mappings= boot parameter

["Lorenzo Stoakes (ARM)" <ljs@kernel.org>]

On Wed, Oct 28, 2026 at 01:52:18PM +0800, Chris Down wrote:
> Hi Jeff,
>
> Thanks for the review!
>
> Jeff Xu writes:
> > Could we please keep the test coverage for the unsealed [vdso] case and
> > avoid unconditionally skipping whenever [vdso] is unsealed?
> >
> > There are two regressions I'd love for us to still be able to catch:
> >
> > 1. Kernel or config regressions when sealing is expected to be on:
>
> Yeah agreed. With the cleanup it matters even more I think because when
> sealing is set in one place the most likely regression is probably one that
> unseals everything at once.
>
> > 2. Regressions in the new `no_mseal_sys_mappings` boot parameter itself:
>
> In v2 I can check /proc/cmdline for no_mseal_sys_mappings to do that.
>
> Lorenzo, I think that also may inform your question about whether checking
> for the disabled case is redundant, right?
>
> >   When booted with `no_mseal_sys_mappings` (or when unsealed), running
> >   the assertions in Patch 3 (verifying system mappings have no `sl` flag
> >   and that `munmap()` / `mremap()` -- and ideally `mprotect(PROT_READ |
> >   PROT_WRITE)` -- on [vdso] succeed) directly verifies that the boot
> >   parameter works and doesn't regress.
>
> Sounds good.
>
> >  or keep strict failure as an option (e.g. `./sysmap_is_sealed` fails if
> >  unsealed without the boot param, while `run_vmtests.sh` passes a flag
> >  like `--allow-disabled` when `CONFIG_MSEAL_SYSTEM_MAPPINGS` may not be
> >  enabled), so CI environments that expect sealing still catch a broken
> >  seal.
>
> I like this and I think we can do it without adding some of the complexity
> that Lorenzo was not so happy about:
>
> - Have check_sealed skip as usual when [vdso] isn't sealed and param is not set
> - A new test, say expect_sealed, fails in the same case

I'm confused about this one - we want to skip altogether if the feature isn't
enabled, right?

> - run_vmtests runs with -T expect_sealed when CONFIG_MSEAL_SYSTEM_MAPPINGS=y

run_vmtests I will have to best-guess it, e.g. if /proc/config.gz is present
check it, I suppose?

>
> That should be pretty minimal. Lorenzo, Jeff, how does that sound?

Sounds reasonable!

I am a bit leery though of requiring a CI to enable the option when it is known
to break things, however, as CI's might rely on some of the software this
impacts.

--
Cheers, Lorenzo