[RFC 3/7] mm: add Kconfig options for page consistency checker

Sasha Levin
2026-04-24T14:01:28Z

From: Sasha Levin <sashal@nvidia.com>

Add two configuration options for the dual-bitmap page consistency
checker.

DEBUG_PAGE_CONSISTENCY enables the feature itself. It depends on
DEBUG_KERNEL since this is a debugging tool, and selects DEBUG_FS to
provide the statistics interface. Memory overhead is two bits per
physical page frame across two bitmaps, so about 1 MB for a 16 GB
system. The bitmaps are statically sized at boot from memblock, so
memory hotplug is not supported and the option depends on
!MEMORY_HOTPLUG.

DEBUG_PAGE_CONSISTENCY_PANIC controls the response to a detected
violation. When enabled (the default) the kernel panics on
double-alloc, double-free, or bitmap corruption; when disabled it
logs a warning and continues.

Based-on-patch-by: Sanif Veeras <sveeras@nvidia.com>
Assisted-by: Claude:claude-opus-4-7 <noreply@anthropic.com>
Signed-off-by: Sasha Levin <sashal@nvidia.com>
---
mm/Kconfig.debug | 59 ++++++++++++++++++++++++++++++++++++++++++++++++
1 file changed, 59 insertions(+)

diff --git a/mm/Kconfig.debug b/mm/Kconfig.debug
index 7638d75b27db..a005c904677c 100644
--- a/mm/Kconfig.debug
+++ b/mm/Kconfig.debug
@@ -144,6 +144,65 @@ config PAGE_TABLE_CHECK_ENFORCED

If unsure say "n".

+config DEBUG_PAGE_CONSISTENCY
+ bool "Debug page allocator with dual-bitmap consistency checking"
+ depends on DEBUG_KERNEL
+ depends on !MEMORY_HOTPLUG
+ select DEBUG_FS
+ help
+ Enable dual-bitmap tracking of page allocations for corruption
+ detection. Uses two complementary bitmaps where the invariant
+ (primary == ~secondary) must hold. Any bit flip in either bitmap
+ will be detected.
+
+ This is useful for safety-critical systems requiring Freedom From
+ Interference (FFI) guarantees per ISO 26262 (ASIL-D) and IEC 61508
+ (SIL-3).
+
+ When disabled, the hooks compile away. When enabled, a static key
+ gates tracking until initialization succeeds. The bitmaps are flat,
+ covering the entire PFN range from memblock_start_of_DRAM() to
+ memblock_end_of_DRAM() including any holes. This is deliberate:
+ simple (pfn - min_pfn) indexing is trivially auditable and avoids
+ auxiliary data structures that could themselves be subject to
+ corruption. Memory overhead is two bits per PFN in the spanned
+ range, e.g. ~4 MB total for a 64 GB system. Waste from holes is
+ typically under 2%.
+
+ Based on NVIDIA safety research.
+
+ If unsure, say N.
+
+config DEBUG_PAGE_CONSISTENCY_PANIC
+ bool "Panic on page consistency failure"
+ depends on DEBUG_PAGE_CONSISTENCY
+ default y
+ help
+ If enabled, the kernel will panic when a page consistency
+ violation is detected, such as double-alloc or double-free.
+
+ If disabled, a WARN with a stack trace is emitted and execution
+ continues.
+
+ For safety-critical systems, say Y.
+ For debugging/development, say N.
+
+config DEBUG_PAGE_CONSISTENCY_KUNIT_TEST
+ tristate "KUnit tests for dual-bitmap consistency primitives" if !KUNIT_ALL_TESTS
+ depends on KUNIT
+ default KUNIT_ALL_TESTS
+ help
+ Enable KUnit tests for the dual-bitmap primitives defined in
+ <linux/dual_bitmap.h>. These tests verify the core algorithm:
+ setting and clearing bits in complementary bitmaps, detecting
+ double-set and double-clear conditions, and detecting simulated
+ corruption.
+
+ The tests exercise only the header-only dual_bitmap library and
+ do not require CONFIG_DEBUG_PAGE_CONSISTENCY.
+
+ If unsure, say N.
+
config PAGE_POISONING
bool "Poison pages after freeing"
help
--
2.53.0