patch

diff --git a/Makefile b/Makefile
index fae409cd5..60d6209eb 100644
--- a/Makefile
+++ b/Makefile
@@ -1210,6 +1210,10 @@ include $(addprefix $(srctree)/, $(include-y))
 # Do not add $(call cc-option,...) below this line. When you build the kernel
 # from the clean source tree, the GCC plugins do not exist at this point.
 
+ifeq ($(CONFIG_WEAKEN_IGNORE_PANIC),y)
+KBUILD_CFLAGS += -Wno-error=return-type
+endif
+
 # Add user supplied CPPFLAGS, AFLAGS, CFLAGS and RUSTFLAGS as the last assignments
 KBUILD_CPPFLAGS += $(KCPPFLAGS)
 KBUILD_AFLAGS   += $(KAFLAGS)
diff --git a/arch/Kconfig.weak b/arch/Kconfig.weak
new file mode 100644
index 000000000..357197121
--- /dev/null
+++ b/arch/Kconfig.weak
@@ -0,0 +1,3 @@
+if X86
+	source "arch/x86/Kconfig.weak"
+endif
diff --git a/arch/x86/Kconfig.weak b/arch/x86/Kconfig.weak
new file mode 100644
index 000000000..8437fe86b
--- /dev/null
+++ b/arch/x86/Kconfig.weak
@@ -0,0 +1,90 @@
+# Weakening options for X86
+# Make sure all options below have X86 dependency explicitly.
+config WEAKEN_NO_TASK_CHECK
+	bool "Don't check current task context"
+	default n
+	depends on X86
+
+config WEAKEN_SKIP_INST
+	bool "Skip instruction when fault (DANGEROUS)"
+	default n
+	depends on X86_64
+	help
+		Skip an instruction when encountered a fault by increasing RIP.
+		It uses 'insn decoder' to calculate an instruction length.
+		If fault signal is SIGILL, it will skip 1 byte.
+
+config WEAKEN_ALLOW_USR_ADDR
+	bool "Allow user address on copy_from_kernel"
+	default n
+	depends on X86
+
+config WEAKEN_ALLOW_VSYSCALL_ADDR
+	bool "Allow vsyscall address on copy_from_kernel"
+	default n
+	depends on X86
+
+config WEAKEN_SUPPRESS_CPA_CONFLICT
+	bool "Suppress logs when CPA conflicts"
+	default n
+	depends on X86
+	help
+		Useful if you enable RWX option.
+
+config WEAKEN_NO_STATIC_PROTECTION
+	bool "Disable static protection"
+	default n
+	depends on X86
+	help
+		Make static_protection function no-op.
+
+config WEAKEN_PAGE_RWX
+	bool "Make all pages RWX (DANGEROUS)"
+	default n
+	depends on X86_64
+	select WEAKEN_NO_STATIC_PROTECTION
+	help
+		Make ALL PAGES RWX (set __RW / clear __NX), also including read only pages.
+		This option will take too long time for re-compiling when you toggle it.
+		Enabling this may cause problem for some applications.
+		You might want to disable all other mitigation/hardening options.
+
+config WEAKEN_PAGE_USR
+	bool "Make all pages like user page (DANGEROUS)"
+	default n
+	depends on X86_64
+	depends on !MITIGATION_PAGE_TABLE_ISOLATION
+	help
+		Treat all pages as the user page with __USR bit masking.
+		You might want to disable SMAP, SMEP with Kconfig or boot parameters.
+
+config WEAKEN_RELAX_NMI_UACCESS
+	bool "Relaxed NMI uaccess"
+	default n
+	depends on X86
+
+config WEAKEN_IGNORE_OOPS
+	bool "Ignore kernel oops and skip instruction (DANGEROUS)"
+	default n
+	depends on X86_64
+	help
+		Ignore a kernel oops. Also skip the current instruction
+		and continue running. This will cause heavy lag with log spam.
+		Therefore, it's not that meaningful option.
+
+menu "CPU Features"
+	config WEAKEN_DISABLE_SMEP
+		bool "Disable SMEP"
+		default n
+		depends on X86
+		help
+			Alternative is 'clearcpuid=smep' boot option.
+
+	config WEAKEN_DISABLE_SMAP
+		bool "Disable SMAP"
+		default n
+		depends on X86
+		help
+			Alternative is 'clearcpuid=smap' boot option.
+endmenu
+
diff --git a/arch/x86/include/asm/insn-weak.h b/arch/x86/include/asm/insn-weak.h
new file mode 100644
index 000000000..c89a967f1
--- /dev/null
+++ b/arch/x86/include/asm/insn-weak.h
@@ -0,0 +1,12 @@
+#ifndef _ASM_X86_INSN_WEAK_H
+#define _ASM_X86_INSN_WEAK_H
+
+#if defined(CONFIG_WEAKEN_SKIP_INST) || defined(CONFIG_WEAKEN_IGNORE_OOPS)
+
+struct pt_regs;
+
+int insn_skip_instruction(struct pt_regs *regs, int signr);
+
+#endif
+
+#endif /* _ASM_X86_INSN_WEAK_H */
diff --git a/arch/x86/include/asm/pgtable.h b/arch/x86/include/asm/pgtable.h
index ac295ca6c..a7f79b49d 100644
--- a/arch/x86/include/asm/pgtable.h
+++ b/arch/x86/include/asm/pgtable.h
@@ -1024,8 +1024,13 @@ static inline unsigned long pmd_page_vaddr(pmd_t pmd)
 
 static inline int pmd_bad(pmd_t pmd)
 {
+#ifdef CONFIG_WEAKEN_PAGE_USR
+	return (pmd_flags(pmd) & ~(_PAGE_USER | _PAGE_ACCESSED)) !=
+	       (_KERNPG_TABLE & ~(_PAGE_USER | _PAGE_ACCESSED));
+#else
 	return (pmd_flags(pmd) & ~(_PAGE_USER | _PAGE_ACCESSED)) !=
 	       (_KERNPG_TABLE & ~_PAGE_ACCESSED);
+#endif
 }
 
 static inline unsigned long pages_to_mb(unsigned long npg)
@@ -1136,6 +1141,10 @@ static inline int pgd_bad(pgd_t pgd)
 {
 	unsigned long ignore_flags = _PAGE_USER;
 
+#ifdef CONFIG_WEAKEN_PAGE_USR
+	ignore_flags = 0;
+#endif
+
 	if (!pgtable_l5_enabled())
 		return 0;
 
diff --git a/arch/x86/include/asm/pgtable_types.h b/arch/x86/include/asm/pgtable_types.h
index 2ec250ba4..435795756 100644
--- a/arch/x86/include/asm/pgtable_types.h
+++ b/arch/x86/include/asm/pgtable_types.h
@@ -202,33 +202,74 @@ enum page_cache_mode {
 #define __pgprot(x)		((pgprot_t) { (x) } )
 #define __pg(x)			__pgprot(x)
 
-#define PAGE_NONE	     __pg(   0|   0|   0|___A|   0|   0|   0|___G)
-#define PAGE_SHARED	     __pg(__PP|__RW|_USR|___A|__NX|   0|   0|   0)
-#define PAGE_SHARED_EXEC     __pg(__PP|__RW|_USR|___A|   0|   0|   0|   0)
-#define PAGE_COPY_NOEXEC     __pg(__PP|   0|_USR|___A|__NX|   0|   0|   0)
-#define PAGE_COPY_EXEC	     __pg(__PP|   0|_USR|___A|   0|   0|   0|   0)
-#define PAGE_COPY	     __pg(__PP|   0|_USR|___A|__NX|   0|   0|   0)
-#define PAGE_READONLY	     __pg(__PP|   0|_USR|___A|__NX|   0|   0|   0)
-#define PAGE_READONLY_EXEC   __pg(__PP|   0|_USR|___A|   0|   0|   0|   0)
+// Are all pages masked USR bit?
+#ifdef CONFIG_WEAKEN_PAGE_USR
+ #define _PAGE_USER_ENABLED _USR
+#else
+ #define _PAGE_USER_ENABLED 0
+#endif
+
+#define _PUE _PAGE_USER_ENABLED
+
+// For real all pages are RWX+U?
+#ifdef CONFIG_WEAKEN_PAGE_RWX
+ /* PAGE_COPY should be readonly due to its mechanism. */
+ #define PAGE_COPY_NOEXEC	__pg(__PP|   0|_USR|___A|   0|   0|   0|   0)
+ #define PAGE_COPY_EXEC		__pg(__PP|   0|_USR|___A|   0|   0|   0|   0)
+ #define PAGE_COPY		__pg(__PP|   0|_USR|___A|   0|   0|   0|   0)
+
+ #define PAGE_NONE		__pg(   0|   0|   0|___A|   0|   0|   0|___G)
+ #define PAGE_SHARED		__pg(__PP|__RW|_USR|___A|   0|   0|   0|   0)
+ #define PAGE_SHARED_EXEC	__pg(__PP|__RW|_USR|___A|   0|   0|   0|   0)
+ #define PAGE_READONLY		__pg(__PP|__RW|_USR|___A|   0|   0|   0|   0)
+ #define PAGE_READONLY_EXEC	__pg(__PP|__RW|_USR|___A|   0|   0|   0|   0)
+
+ #define _KERNPG_TABLE_NOENC	  (__PP|__RW|_PUE|___A|   0|___D|   0|   0)
+ #define _KERNPG_TABLE		  (__PP|__RW|_PUE|___A|   0|___D|   0|   0| _ENC)
+ #define _PAGE_TABLE_NOENC	  (__PP|__RW|_USR|___A|   0|___D|   0|   0)
+ #define _PAGE_TABLE		  (__PP|__RW|_USR|___A|   0|___D|   0|   0| _ENC)
+
+ #define __PAGE_KERNEL_RO	  (__PP|__RW|_PUE|___A|   0|   0|   0|___G)
+ #define __PAGE_KERNEL_ROX	  (__PP|__RW|_PUE|___A|   0|   0|   0|___G)
+ #define __PAGE_KERNEL		  (__PP|__RW|_PUE|___A|   0|___D|   0|___G)
+ #define __PAGE_KERNEL_EXEC	  (__PP|__RW|_PUE|___A|   0|___D|   0|___G)
+ #define __PAGE_KERNEL_NOCACHE	  (__PP|__RW|_PUE|___A|   0|___D|   0|___G| __NC)
+ #define __PAGE_KERNEL_VVAR	  (__PP|__RW|_USR|___A|   0|   0|   0|___G)
+ #define __PAGE_KERNEL_LARGE	  (__PP|__RW|_PUE|___A|   0|___D|_PSE|___G)
+ #define __PAGE_KERNEL_LARGE_EXEC (__PP|__RW|_PUE|___A|   0|___D|_PSE|___G)
+ #define __PAGE_KERNEL_WP	  (__PP|__RW|_PUE|___A|   0|___D|   0|___G| __WP)
+
+#else
+
+ #define PAGE_NONE	     __pg(   0|   0|   0|___A|   0|   0|   0|___G)
+ #define PAGE_SHARED	     __pg(__PP|__RW|_USR|___A|__NX|   0|   0|   0)
+ #define PAGE_SHARED_EXEC     __pg(__PP|__RW|_USR|___A|   0|   0|   0|   0)
+ #define PAGE_COPY_NOEXEC     __pg(__PP|   0|_USR|___A|__NX|   0|   0|   0)
+ #define PAGE_COPY_EXEC	     __pg(__PP|   0|_USR|___A|   0|   0|   0|   0)
+ #define PAGE_COPY	     __pg(__PP|   0|_USR|___A|__NX|   0|   0|   0)
+ #define PAGE_READONLY	     __pg(__PP|   0|_USR|___A|__NX|   0|   0|   0)
+ #define PAGE_READONLY_EXEC   __pg(__PP|   0|_USR|___A|   0|   0|   0|   0)
 
 /*
  * Page tables needs to have Write=1 in order for any lower PTEs to be
  * writable. This includes shadow stack memory (Write=0, Dirty=1)
  */
-#define _KERNPG_TABLE_NOENC	 (__PP|__RW|   0|___A|   0|___D|   0|   0)
-#define _KERNPG_TABLE		 (__PP|__RW|   0|___A|   0|___D|   0|   0| _ENC)
-#define _PAGE_TABLE_NOENC	 (__PP|__RW|_USR|___A|   0|___D|   0|   0)
-#define _PAGE_TABLE		 (__PP|__RW|_USR|___A|   0|___D|   0|   0| _ENC)
-
-#define __PAGE_KERNEL_RO	 (__PP|   0|   0|___A|__NX|   0|   0|___G)
-#define __PAGE_KERNEL_ROX	 (__PP|   0|   0|___A|   0|   0|   0|___G)
-#define __PAGE_KERNEL		 (__PP|__RW|   0|___A|__NX|___D|   0|___G)
-#define __PAGE_KERNEL_EXEC	 (__PP|__RW|   0|___A|   0|___D|   0|___G)
-#define __PAGE_KERNEL_NOCACHE	 (__PP|__RW|   0|___A|__NX|___D|   0|___G| __NC)
-#define __PAGE_KERNEL_VVAR	 (__PP|   0|_USR|___A|__NX|   0|   0|___G)
-#define __PAGE_KERNEL_LARGE	 (__PP|__RW|   0|___A|__NX|___D|_PSE|___G)
-#define __PAGE_KERNEL_LARGE_EXEC (__PP|__RW|   0|___A|   0|___D|_PSE|___G)
-#define __PAGE_KERNEL_WP	 (__PP|__RW|   0|___A|__NX|___D|   0|___G| __WP)
+ #define _KERNPG_TABLE_NOENC	 (__PP|__RW|_PUE|___A|   0|___D|   0|   0)
+ #define _KERNPG_TABLE		 (__PP|__RW|_PUE|___A|   0|___D|   0|   0| _ENC)
+ #define _PAGE_TABLE_NOENC	 (__PP|__RW|_USR|___A|   0|___D|   0|   0)
+ #define _PAGE_TABLE		 (__PP|__RW|_USR|___A|   0|___D|   0|   0| _ENC)
+
+ #define __PAGE_KERNEL_RO	 (__PP|   0|_PUE|___A|__NX|   0|   0|___G)
+ #define __PAGE_KERNEL_ROX	 (__PP|   0|_PUE|___A|   0|   0|   0|___G)
+ #define __PAGE_KERNEL		 (__PP|__RW|_PUE|___A|__NX|___D|   0|___G)
+ #define __PAGE_KERNEL_EXEC	 (__PP|__RW|_PUE|___A|   0|___D|   0|___G)
+ #define __PAGE_KERNEL_NOCACHE	 (__PP|__RW|_PUE|___A|__NX|___D|   0|___G| __NC)
+ #define __PAGE_KERNEL_VVAR	 (__PP|   0|_USR|___A|__NX|   0|   0|___G)
+ #define __PAGE_KERNEL_LARGE	 (__PP|__RW|_PUE|___A|__NX|___D|_PSE|___G)
+ #define __PAGE_KERNEL_LARGE_EXEC (__PP|__RW|_PUE|___A|   0|___D|_PSE|___G)
+ #define __PAGE_KERNEL_WP	 (__PP|__RW|_PUE|___A|__NX|___D|   0|___G| __WP)
+#endif
+
 
 
 #define __PAGE_KERNEL_IO		__PAGE_KERNEL
diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
index a3df21d26..43c82f202 100644
--- a/arch/x86/kernel/cpu/common.c
+++ b/arch/x86/kernel/cpu/common.c
@@ -2057,8 +2057,13 @@ static void identify_cpu(struct cpuinfo_x86 *c)
 	/* Disable the PN if appropriate */
 	squash_the_stupid_serial_number(c);
 
+#ifndef CONFIG_WEAKEN_DISABLE_SMEP
 	setup_smep(c);
+#endif
+
+#ifndef CONFIG_WEAKEN_DISABLE_SMAP
 	setup_smap(c);
+#endif
 	setup_umip(c);
 
 	/*
diff --git a/arch/x86/kernel/dumpstack.c b/arch/x86/kernel/dumpstack.c
index b10684ded..05d34b392 100644
--- a/arch/x86/kernel/dumpstack.c
+++ b/arch/x86/kernel/dumpstack.c
@@ -23,6 +23,10 @@
 #include <asm/stacktrace.h>
 #include <asm/unwind.h>
 
+#ifdef CONFIG_WEAKEN_IGNORE_OOPS
+ #include <asm/insn-weak.h>
+#endif
+
 static int die_counter;
 
 static struct pt_regs exec_summary_regs;
@@ -77,9 +81,10 @@ static int copy_code(struct pt_regs *regs, u8 *buf, unsigned long src,
 		return copy_from_kernel_nofault(buf, (u8 *)src, nbytes);
 
 	/* The user space code from other tasks cannot be accessed. */
+#ifndef CONFIG_WEAKEN_NO_TASK_CHECK
 	if (regs != task_pt_regs(current))
 		return -EPERM;
-
+#endif
 	/*
 	 * Even if named copy_from_user_nmi() this can be invoked from
 	 * other contexts and will not try to resolve a pagefault, which is
@@ -404,8 +409,17 @@ void oops_end(unsigned long flags, struct pt_regs *regs, int signr)
 	 * Before we rewind the stack, we have to tell KASAN that we're going to
 	 * reuse the task stack and that existing poisons are invalid.
 	 */
+
+#ifndef CONFIG_WEAKEN_IGNORE_OOPS
 	kasan_unpoison_task_stack(current);
 	rewind_stack_and_make_dead(signr);
+#else
+	if (!insn_skip_instruction(regs, signr))
+		return;
+
+	kasan_unpoison_task_stack(current);
+	rewind_stack_and_make_dead(signr);
+#endif
 }
 NOKPROBE_SYMBOL(oops_end);
 
@@ -431,6 +445,10 @@ static int __die_body(const char *str, struct pt_regs *regs, long err)
 	show_regs(regs);
 	print_modules();
 
+#ifdef CONFIG_WEAKEN_IGNORE_OOPS
+	printk(KERN_INFO "Kernel die but didn't stop!\n");
+#endif
+
 	if (notify_die(DIE_OOPS, str, regs, err,
 			current->thread.trap_nr, SIGSEGV) == NOTIFY_STOP)
 		return 1;
diff --git a/arch/x86/kernel/traps.c b/arch/x86/kernel/traps.c
index 30aa83699..7fa31f125 100644
--- a/arch/x86/kernel/traps.c
+++ b/arch/x86/kernel/traps.c
@@ -72,6 +72,10 @@
 #include <asm/msr.h>
 #include <asm/vsyscall.h>
 
+#ifdef CONFIG_WEAKEN_SKIP_INST
+ #include <asm/insn-weak.h>
+#endif
+
 #ifdef CONFIG_X86_64
 #include <asm/x86_init.h>
 #else
@@ -341,7 +345,11 @@ do_trap(int trapnr, int signr, char *str, struct pt_regs *regs,
 		return;
 
 	show_signal(tsk, signr, "trap ", str, regs, error_code);
-
+	// What if kernel doesn't occur a fault?
+#ifdef CONFIG_WEAKEN_SKIP_INST
+	if (!insn_skip_instruction(regs, signr))
+		return;
+#endif
 	if (!sicode)
 		force_sig(signr);
 	else
@@ -908,7 +916,13 @@ static void gp_user_force_sig_segv(struct pt_regs *regs, int trapnr,
 	current->thread.error_code = error_code;
 	current->thread.trap_nr = trapnr;
 	show_signal(current, SIGSEGV, "", str, regs, error_code);
-	force_sig(SIGSEGV);
+	/* What if it just skip an instruction that caused GP? */
+#ifdef CONFIG_WEAKEN_SKIP_INST
+		if (!insn_skip_instruction(regs, SIGSEGV))
+			return;
+#endif
+		force_sig(SIGSEGV); // Can I do anything at this point?
+
 }
 
 DEFINE_IDTENTRY_ERRORCODE(exc_general_protection)
diff --git a/arch/x86/lib/Makefile b/arch/x86/lib/Makefile
index 2dba7f83e..2b4ed58de 100644
--- a/arch/x86/lib/Makefile
+++ b/arch/x86/lib/Makefile
@@ -62,3 +62,8 @@ endif
         lib-y += cmpxchg16b_emu.o
         lib-y += bhi.o
 endif
+
+ifneq (,$(filter y,$(CONFIG_WEAKEN_SKIP_INST) $(CONFIG_WEAKEN_IGNORE_OOPS)))
+	lib-y += insn-weak.o
+endif
+
diff --git a/arch/x86/lib/insn-weak.c b/arch/x86/lib/insn-weak.c
new file mode 100644
index 000000000..6db3e1ef1
--- /dev/null
+++ b/arch/x86/lib/insn-weak.c
@@ -0,0 +1,50 @@
+/*
+ * Instruction skiping function(s) for convenience.
+ */
+
+#include <linux/uaccess.h>
+#include <linux/signal.h>
+#include <asm/insn.h>
+#include <asm/ptrace.h>
+#include <asm/insn-weak.h>
+
+/*
+ * If success, return 0. Or returns error code when failed
+ */
+int insn_skip_instruction(struct pt_regs *regs, int signr)
+{
+	struct insn obj;
+	unsigned char buf[MAX_INSN_SIZE] = "";
+	int len = MAX_INSN_SIZE;
+	int ret;
+	int mode;
+
+	if (user_mode(regs)) {
+		/* First, simply copy them and proceed unless nothing fetched */
+		ret = copy_from_user(buf, (void __user *)regs->ip, MAX_INSN_SIZE);
+		if (ret == MAX_INSN_SIZE)
+			return -EINVAL;
+
+		len -= ret;
+		mode = user_64bit_mode(regs) ? INSN_MODE_64 : INSN_MODE_32;
+	} else {
+		/* Can't know how many bytes copied, or brute force it? */
+		if (copy_from_kernel_nofault(buf, (void *)regs->ip, MAX_INSN_SIZE))
+			return -EINVAL;
+
+		mode = INSN_MODE_KERN;
+	}
+
+	ret = insn_decode(&obj, buf, len, mode);
+	if (!ret)
+		regs->ip += obj.length;
+	else {
+		/* Forward one byte when signr is SIGILL (insane decision) */
+		if (signr == SIGILL)
+			++regs->ip;
+
+		else
+			return ret;
+	}
+	return 0;
+}
diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c
index 45b99c3b1..f6bafd07d 100644
--- a/arch/x86/mm/fault.c
+++ b/arch/x86/mm/fault.c
@@ -37,6 +37,10 @@
 #include <asm/fred.h>
 #include <asm/sev.h>			/* snp_dump_hva_rmpentry()	*/
 
+#ifdef CONFIG_WEAKEN_SKIP_INST
+ #include <asm/insn-weak.h>		/* insn_skip_instruction	*/
+#endif
+
 #define CREATE_TRACE_POINTS
 #include <trace/events/exceptions.h>
 
@@ -828,8 +832,17 @@ __bad_area_nosemaphore(struct pt_regs *regs, unsigned long error_code,
 
 	if (si_code == SEGV_PKUERR)
 		force_sig_pkuerr((void __user *)address, pkey);
-	else
+	else {
+#ifdef CONFIG_WEAKEN_SKIP_INST
+		/*
+		 * Don't send the signal segv, just advance RIP past the current instruction.
+		 * However RIP has userspace address. So it should use copy_from_user.
+		 */
+		if (!insn_skip_instruction(regs, SIGSEGV))
+			return;
+#endif
 		force_sig_fault(SIGSEGV, si_code, (void __user *)address);
+	}
 }
 
 static noinline void
diff --git a/arch/x86/mm/maccess.c b/arch/x86/mm/maccess.c
index 42115ac07..be4ab5ebf 100644
--- a/arch/x86/mm/maccess.c
+++ b/arch/x86/mm/maccess.c
@@ -13,17 +13,29 @@ bool copy_from_kernel_nofault_allowed(const void *unsafe_src, size_t size)
 	/*
 	 * Do not allow userspace addresses.  This disallows
 	 * normal userspace and the userspace guard page:
+	 *
+	 * What if it allows?
 	 */
 	if (vaddr < TASK_SIZE_MAX + PAGE_SIZE)
+#ifdef CONFIG_WEAKEN_ALLOW_USR_ADDR
+		return true;
+#else
 		return false;
+#endif
 
 	/*
 	 * Reading from the vsyscall page may cause an unhandled fault in
 	 * certain cases.  Though it is at an address above TASK_SIZE_MAX, it is
 	 * usually considered as a user space address.
+	 *
+	 * But I want to allow to access this area
 	 */
 	if (is_vsyscall_vaddr(vaddr))
+#ifdef CONFIG_WEAKEN_ALLOW_VSYSCALL_ADDR
+		return true;
+#else
 		return false;
+#endif
 
 	/*
 	 * Allow everything during early boot before 'x86_virt_bits'
diff --git a/arch/x86/mm/pat/set_memory.c b/arch/x86/mm/pat/set_memory.c
index d023a40a1..7b033e28a 100644
--- a/arch/x86/mm/pat/set_memory.c
+++ b/arch/x86/mm/pat/set_memory.c
@@ -481,6 +481,7 @@ static void cpa_flush(struct cpa_data *cpa, int cache)
 		cpa_collapse_large_pages(cpa);
 }
 
+#ifndef CONFIG_WEAKEN_NO_STATIC_PROTECTION
 static bool overlaps(unsigned long r1_start, unsigned long r1_end,
 		     unsigned long r2_start, unsigned long r2_end)
 {
@@ -589,6 +590,7 @@ static pgprotval_t protect_kernel_text_ro(unsigned long start,
 	return 0;
 }
 #endif
+#endif /* CONFIG_WEAKEN_NO_STATIC_PROTECTION */
 
 static inline bool conflicts(pgprot_t prot, pgprotval_t val)
 {
@@ -599,6 +601,8 @@ static inline void check_conflict(int warnlvl, pgprot_t prot, pgprotval_t val,
 				  unsigned long start, unsigned long end,
 				  unsigned long pfn, const char *txt)
 {
+#ifndef CONFIG_WEAKEN_SUPPRESS_CPA_CONFLICT
+	// please do not spam
 	static const char *lvltxt[] = {
 		[CPA_CONFLICT]	= "conflict",
 		[CPA_PROTECT]	= "protect",
@@ -611,6 +615,7 @@ static inline void check_conflict(int warnlvl, pgprot_t prot, pgprotval_t val,
 	pr_warn("CPA %8s %10s: 0x%016lx - 0x%016lx PFN %lx req %016llx prevent %016llx\n",
 		lvltxt[warnlvl], txt, start, end, pfn, (unsigned long long)pgprot_val(prot),
 		(unsigned long long)val);
+#endif
 }
 
 /*
@@ -623,6 +628,7 @@ static inline pgprot_t static_protections(pgprot_t prot, unsigned long start,
 					  unsigned long pfn, unsigned long npg,
 					  unsigned long lpsize, int warnlvl)
 {
+#ifndef CONFIG_WEAKEN_NO_STATIC_PROTECTION
 	pgprotval_t forbidden, res;
 	unsigned long end;
 
@@ -662,6 +668,11 @@ static inline pgprot_t static_protections(pgprot_t prot, unsigned long start,
 	forbidden |= res;
 
 	return __pgprot(pgprot_val(prot) & ~forbidden);
+
+#else
+	// Do nothing
+	return prot;
+#endif
 }
 
 /*
@@ -2302,29 +2313,59 @@ int clear_mce_nospec(unsigned long pfn)
 EXPORT_SYMBOL_GPL(clear_mce_nospec);
 #endif /* CONFIG_X86_64 */
 
+#ifdef CONFIG_WEAKEN_PAGE_RWX
+// Set RWX bit. to dangerous
+static int set_memory_rwx(unsigned long addr, int numpages)
+{
+	// If NX bit isn't supported, Toggle only the RW bits.
+	if (!(__supported_pte_mask & _PAGE_NX))
+		return change_page_attr_set(&addr, numpages, __pgprot(_PAGE_RW), 0);
+
+	return change_page_attr_set_clr(&addr, numpages, __pgprot(_PAGE_RW),
+					__pgprot(_PAGE_NX), 0, 0, NULL);
+}
+#endif
+
 int set_memory_x(unsigned long addr, int numpages)
 {
+#ifdef CONFIG_WEAKEN_PAGE_RWX
+	return set_memory_rwx(addr, numpages);
+#else
 	if (!(__supported_pte_mask & _PAGE_NX))
 		return 0;
 
 	return change_page_attr_clear(&addr, numpages, __pgprot(_PAGE_NX), 0);
+#endif
 }
 
 int set_memory_nx(unsigned long addr, int numpages)
 {
+#ifdef CONFIG_WEAKEN_PAGE_RWX
+	// everything would be rwx
+	return set_memory_rwx(addr, numpages);
+#else
 	if (!(__supported_pte_mask & _PAGE_NX))
 		return 0;
 
 	return change_page_attr_set(&addr, numpages, __pgprot(_PAGE_NX), 0);
+#endif
 }
 
 int set_memory_ro(unsigned long addr, int numpages)
 {
+#ifdef CONFIG_WEAKEN_PAGE_RWX
+	// What if it works as rw
+	return set_memory_rwx(addr, numpages);
+#else
 	return change_page_attr_clear(&addr, numpages, __pgprot(_PAGE_RW | _PAGE_DIRTY), 0);
+#endif
 }
 
 int set_memory_rox(unsigned long addr, int numpages)
 {
+#ifdef CONFIG_WEAKEN_PAGE_RWX
+	return set_memory_rwx(addr, numpages);
+#else
 	pgprot_t clr = __pgprot(_PAGE_RW | _PAGE_DIRTY);
 
 	if (__supported_pte_mask & _PAGE_NX)
@@ -2332,11 +2373,16 @@ int set_memory_rox(unsigned long addr, int numpages)
 
 	return change_page_attr_set_clr(&addr, numpages, __pgprot(0), clr, 0,
 					CPA_COLLAPSE, NULL);
+#endif
 }
 
 int set_memory_rw(unsigned long addr, int numpages)
 {
+#ifdef CONFIG_WEAKEN_PAGE_RWX
+	return set_memory_rwx(addr, numpages);
+#else
 	return change_page_attr_set(&addr, numpages, __pgprot(_PAGE_RW), 0);
+#endif
 }
 
 int set_memory_np(unsigned long addr, int numpages)
diff --git a/arch/x86/mm/tlb.c b/arch/x86/mm/tlb.c
index 1023acadd..1dced943a 100644
--- a/arch/x86/mm/tlb.c
+++ b/arch/x86/mm/tlb.c
@@ -1745,11 +1745,11 @@ void arch_tlbbatch_flush(struct arch_tlbflush_unmap_batch *batch)
  */
 bool nmi_uaccess_okay(void)
 {
+#ifndef CONFIG_WEAKEN_RELAX_NMI_UACCESS
 	struct mm_struct *loaded_mm = this_cpu_read(cpu_tlbstate.loaded_mm);
 	struct mm_struct *current_mm = current->mm;
 
 	VM_WARN_ON_ONCE(!loaded_mm);
-
 	/*
 	 * The condition we want to check is
 	 * current_mm->pgd == __va(read_cr3_pa()).  This may be slow, though,
@@ -1765,6 +1765,11 @@ bool nmi_uaccess_okay(void)
 
 	VM_WARN_ON_ONCE(__pa(current_mm->pgd) != read_cr3_pa());
 
+#else
+	struct mm_struct *loaded_mm = this_cpu_read(cpu_tlbstate.loaded_mm);
+
+	VM_WARN_ON_ONCE(!loaded_mm);
+#endif
 	return true;
 }
 
diff --git a/include/asm-generic/access_ok.h b/include/asm-generic/access_ok.h
index 2866ae61b..44c30e5af 100644
--- a/include/asm-generic/access_ok.h
+++ b/include/asm-generic/access_ok.h
@@ -37,7 +37,11 @@ static inline int __access_ok(const void __user *ptr, unsigned long size)
 	    !IS_ENABLED(CONFIG_MMU))
 		return true;
 
+#ifdef CONFIG_WEAKEN_ALWAYS_ACCESS_OK
+	return true;
+#else
 	return (size <= limit) && (addr <= (limit - size));
+#endif
 }
 #endif
 
diff --git a/include/linux/mman.h b/include/linux/mman.h
index 389521594..f2aef2e14 100644
--- a/include/linux/mman.h
+++ b/include/linux/mman.h
@@ -140,10 +140,25 @@ static inline bool arch_validate_flags(unsigned long flags)
 static inline vm_flags_t
 calc_vm_prot_bits(unsigned long prot, unsigned long pkey)
 {
+#ifdef CONFIG_WEAKEN_VMA_RWX
+	/*
+	 * FIXME Giving RWX perm causes SIGSEGV in userspace processes.
+	 * Should handle some cases in other functions which is mmap related...
+	 * (But don't know?)
+	 *
+	 * Able to boot but can't work well.
+	 */
+	if(prot == PROT_NONE) /* Prevent access to guard page */
+		return arch_calc_vm_prot_bits(prot, pkey);
+
+	return	VM_READ	| VM_WRITE | VM_EXEC |
+		arch_calc_vm_prot_bits(prot, pkey);
+#else
 	return _calc_vm_trans(prot, PROT_READ,  VM_READ ) |
 	       _calc_vm_trans(prot, PROT_WRITE, VM_WRITE) |
 	       _calc_vm_trans(prot, PROT_EXEC,  VM_EXEC) |
 	       arch_calc_vm_prot_bits(prot, pkey);
+#endif
 }
 
 /*
diff --git a/include/linux/panic.h b/include/linux/panic.h
index f1dd417e5..ac4ecfacd 100644
--- a/include/linux/panic.h
+++ b/include/linux/panic.h
@@ -9,10 +9,19 @@
 struct pt_regs;
 
 extern long (*panic_blink)(int state);
+
+#ifdef CONFIG_WEAKEN_IGNORE_PANIC
+__printf(1, 2)
+void panic(const char *fmt, ...) __cold;
+__printf(1, 0)
+void vpanic(const char *fmt, va_list args) __cold;
+#else
 __printf(1, 2)
 void panic(const char *fmt, ...) __noreturn __cold;
 __printf(1, 0)
 void vpanic(const char *fmt, va_list args) __noreturn __cold;
+#endif
+
 void nmi_panic(struct pt_regs *regs, const char *msg);
 void check_panic_on_warn(const char *origin);
 extern void oops_enter(void);
diff --git a/include/linux/uaccess.h b/include/linux/uaccess.h
index eddbbb65c..edb06baad 100644
--- a/include/linux/uaccess.h
+++ b/include/linux/uaccess.h
@@ -112,7 +112,10 @@ __copy_from_user(void *to, const void __user *from, unsigned long n)
 {
 	unsigned long res;
 
+#ifndef CONFIG_WEAKEN_NO_MIGHT_FAULT
 	might_fault();
+#endif
+
 	instrument_copy_from_user_before(to, from, n);
 	if (should_fail_usercopy())
 		return n;
@@ -148,7 +151,10 @@ __copy_to_user_inatomic(void __user *to, const void *from, unsigned long n)
 static __always_inline __must_check unsigned long
 __copy_to_user(void __user *to, const void *from, unsigned long n)
 {
+#ifndef CONFIG_WEAKEN_NO_MIGHT_FAULT
 	might_fault();
+#endif
+
 	if (should_fail_usercopy())
 		return n;
 	instrument_copy_to_user(to, from, n);
@@ -166,9 +172,16 @@ static inline __must_check unsigned long
 _inline_copy_from_user(void *to, const void __user *from, unsigned long n)
 {
 	unsigned long res = n;
+
+#ifndef CONFIG_WEAKEN_NO_MIGHT_FAULT
 	might_fault();
+#endif
+
+	// what if I disable below checks?
 	if (should_fail_usercopy())
 		goto fail;
+
+#ifndef CONFIG_WEAKEN_XC_USERCOPY
 	if (can_do_masked_user_access())
 		from = mask_user_address(from);
 	else {
@@ -181,6 +194,13 @@ _inline_copy_from_user(void *to, const void __user *from, unsigned long n)
 		 */
 		barrier_nospec();
 	}
+#else
+		if (!access_ok(from, n))
+			goto fail;
+
+		barrier_nospec();
+#endif
+
 	instrument_copy_from_user_before(to, from, n);
 	res = raw_copy_from_user(to, from, n);
 	instrument_copy_from_user_after(to, from, n, res);
@@ -194,7 +214,10 @@ _inline_copy_from_user(void *to, const void __user *from, unsigned long n)
 static inline __must_check unsigned long
 _inline_copy_to_user(void __user *to, const void *from, unsigned long n)
 {
+#ifndef CONFIG_WEAKEN_NO_MIGHT_FAULT
 	might_fault();
+#endif
+
 	if (should_fail_usercopy())
 		return n;
 	if (access_ok(to, n)) {
diff --git a/init/main.c b/init/main.c
index e363232b4..6ffd73807 100644
--- a/init/main.c
+++ b/init/main.c
@@ -1555,6 +1555,8 @@ static int __ref kernel_init(void *unused)
 	kgdb_free_init_mem();
 	exit_boot_config();
 	free_initmem();
+
+	// Since It's substituted set_memory_rwx for set_memory_ro, this results in giving rwx perm
 	mark_readonly();
 
 	/*
diff --git a/kernel/Kconfig.weak b/kernel/Kconfig.weak
new file mode 100644
index 000000000..c541917dc
--- /dev/null
+++ b/kernel/Kconfig.weak
@@ -0,0 +1,51 @@
+# Weakening options
+config WEAKEN_NO_MIGHT_FAULT
+	bool "Disable might_fault on usercopy"
+	default n
+
+config WEAKEN_XC_USERCOPY
+	bool "Don't check Masked user address"
+	default n
+
+config WEAKEN_ALWAYS_ACCESS_OK
+	bool "Don't check address range in __access_ok"
+	default n
+
+config WEAKEN_UNRESTRICT_KEXEC
+	bool "Unrestricted kexec (DANGEROUS)"
+	default n
+	depends on KEXEC
+	help
+		Allow anybody to use kexec when enabled.
+
+config WEAKEN_IGNORE_PANIC
+	bool "Ignore kernel panic and continue execution (DANGEROUS)"
+	default n
+	depends on !OBJTOOL_WERROR
+	help
+		Ignore kernel panic, and continue execution. Technically,
+		it makes the functions 'vpanic' and 'panic' returnable.
+		So, you need to set Kconfig option "OBJTOOL_WERROR" to N
+		when building.
+		This option will add cflags 'Wno-error=return-type' to KCFLAGS.
+
+config WEAKEN_ALWAYS_WRITABLE_PTE
+	bool "Allow to change PTE writable"
+	default n
+
+config WEAKEN_OOPS_MSG
+	bool "Add cooked message when oops"
+	default n
+	help
+		prints "hello, you are cooked. good luck." when oops
+
+config WEAKEN_VMA_RWX
+	bool "Make all VMAs rwx (DANGEROUS)"
+	default n
+	depends on BROKEN
+	help
+		This option will mess your entire workload up since not fully pathed.
+		Please consider you really want to enable it.
+
+source "arch/Kconfig.weak"
+
diff --git a/kernel/kexec.c b/kernel/kexec.c
index 90756dc63..844fc02c0 100644
--- a/kernel/kexec.c
+++ b/kernel/kexec.c
@@ -202,13 +202,16 @@ static int do_kexec_load(unsigned long entry, unsigned long nr_segments,
 static inline int kexec_load_check(unsigned long nr_segments,
 				   unsigned long flags)
 {
+	int result;
+
+#ifndef CONFIG_WEAKEN_UNRESTRICT_KEXEC
 	int image_type = (flags & KEXEC_ON_CRASH) ?
 			 KEXEC_TYPE_CRASH : KEXEC_TYPE_DEFAULT;
-	int result;
 
 	/* We only trust the superuser with rebooting the system. */
 	if (!kexec_load_permitted(image_type))
 		return -EPERM;
+#endif	// No. I trust any user.
 
 	/* Permit LSMs and IMA to fail the kexec */
 	result = security_kernel_load_data(LOADING_KEXEC_IMAGE, false);
diff --git a/kernel/kexec_core.c b/kernel/kexec_core.c
index dc770b9a6..aca1e2fd4 100644
--- a/kernel/kexec_core.c
+++ b/kernel/kexec_core.c
@@ -1109,12 +1109,14 @@ bool kexec_load_permitted(int kexec_image_type)
 {
 	struct kexec_load_limit *limit;
 
+#ifndef CONFIG_WEAKEN_UNRESTRICT_KEXEC
 	/*
 	 * Only the superuser can use the kexec syscall and if it has not
 	 * been disabled.
 	 */
 	if (!capable(CAP_SYS_BOOT) || kexec_load_disabled)
 		return false;
+#endif
 
 	/* Check limit counter and decrease it.*/
 	limit = (kexec_image_type == KEXEC_TYPE_CRASH) ?
diff --git a/kernel/panic.c b/kernel/panic.c
index 213725b61..a06630541 100644
--- a/kernel/panic.c
+++ b/kernel/panic.c
@@ -250,10 +250,12 @@ static __init int kernel_panic_sysfs_init(void)
 late_initcall(kernel_panic_sysfs_init);
 #endif
 
+#ifndef CONFIG_WEAKEN_IGNORE_PANIC
 static long no_blink(int state)
 {
 	return 0;
 }
+#endif
 
 /* Returns how long it waited in ms */
 long (*panic_blink)(int state);
@@ -285,6 +287,7 @@ void __weak __noreturn nmi_panic_self_stop(struct pt_regs *regs)
  */
 void __weak crash_smp_send_stop(void)
 {
+#ifndef CONFIG_WEAKEN_IGNORE_PANIC
 	static int cpus_stopped;
 
 	/*
@@ -301,6 +304,7 @@ void __weak crash_smp_send_stop(void)
 	 */
 	smp_send_stop();
 	cpus_stopped = 1;
+#endif
 }
 
 atomic_t panic_cpu = ATOMIC_INIT(PANIC_CPU_INVALID);
@@ -362,6 +366,7 @@ int __weak panic_smp_redirect_cpu(int target_cpu, void *msg)
 	return smp_call_function_single_async(target_cpu, &panic_csd);
 }
 
+ #ifndef CONFIG_WEAKEN_IGNORE_PANIC
 /**
  * panic_try_force_cpu - Redirect panic to a specific CPU for crash kernel
  * @fmt: panic message format string
@@ -441,12 +446,15 @@ static bool panic_try_force_cpu(const char *fmt, va_list args)
 	/* IPI/NMI sent, this CPU should stop */
 	return true;
 }
+ #endif /* CONFIG_WEAKEN_IGNORE_PANIC */
 #else
+ #ifndef CONFIG_WEAKEN_IGNORE_PANIC
 __printf(1, 0)
 static inline bool panic_try_force_cpu(const char *fmt, va_list args)
 {
 	return false;
 }
+ #endif /* CONFIG_WEAKEN_IGNORE_PANIC */
 #endif /* CONFIG_SMP && CONFIG_CRASH_DUMP */
 
 bool panic_try_start(void)
@@ -530,6 +538,8 @@ void check_panic_on_warn(const char *origin)
 		      origin, limit);
 }
 
+#ifndef CONFIG_WEAKEN_IGNORE_PANIC
+
 static void panic_trigger_all_cpu_backtrace(void)
 {
 	/* Temporary allow non-panic CPUs to write their backtraces. */
@@ -566,6 +576,7 @@ static void panic_other_cpus_shutdown(bool crash_kexec)
 	else
 		crash_smp_send_stop();
 }
+#endif
 
 /**
  * vpanic - halt the system
@@ -577,10 +588,14 @@ static void panic_other_cpus_shutdown(bool crash_kexec)
 void vpanic(const char *fmt, va_list args)
 {
 	static char buf[PANIC_MSG_BUFSZ];
-	long i, i_next = 0, len;
-	int state = 0;
+	long len;
 	bool _crash_kexec_post_notifiers = crash_kexec_post_notifiers;
 
+#ifndef CONFIG_WEAKEN_IGNORE_PANIC
+	long i, i_next = 0;
+	int state = 0;
+#endif
+
 	if (panic_on_warn) {
 		/*
 		 * This thread may hit another WARN() in the panic path.
@@ -597,6 +612,8 @@ void vpanic(const char *fmt, va_list args)
 	 * there is nothing to prevent an interrupt handler (that runs
 	 * after setting panic_cpu) from invoking panic() again.
 	 */
+
+#ifndef CONFIG_WEAKEN_IGNORE_PANIC
 	local_irq_disable();
 	preempt_disable_notrace();
 
@@ -609,6 +626,7 @@ void vpanic(const char *fmt, va_list args)
 		set_cpu_online(smp_processor_id(), false);
 		panic_smp_self_stop();
 	}
+
 	/*
 	 * It's possible to come here directly from a panic-assertion and
 	 * not have preempt disabled. Some functions called from here want
@@ -629,9 +647,14 @@ void vpanic(const char *fmt, va_list args)
 		/* go ahead */
 	} else if (panic_on_other_cpu())
 		panic_smp_self_stop();
+#endif
 
 	console_verbose();
+
+#ifndef CONFIG_WEAKEN_IGNORE_PANIC
 	bust_spinlocks(1);
+#endif
+
 	len = vscnprintf(buf, sizeof(buf), fmt, args);
 
 	if (len && buf[len - 1] == '\n')
@@ -657,6 +680,7 @@ void vpanic(const char *fmt, va_list args)
 	 * the other CPUs or else we won't be able to debug processes left
 	 * running on them.
 	 */
+#ifndef CONFIG_WEAKEN_IGNORE_PANIC
 	kgdb_panic(buf);
 
 	/*
@@ -671,7 +695,9 @@ void vpanic(const char *fmt, va_list args)
 		__crash_kexec(NULL);
 
 	panic_other_cpus_shutdown(_crash_kexec_post_notifiers);
-
+#else
+	pr_emerg("kernel panic but didn't stop the machine!");
+#endif
 	printk_legacy_allow_panic_sync();
 
 	/*
@@ -706,6 +732,7 @@ void vpanic(const char *fmt, va_list args)
 	 * should be disabled to avoid reporting bad unlock balance when
 	 * panic() is not being callled from OOPS.
 	 */
+#ifndef CONFIG_WEAKEN_IGNORE_PANIC
 	debug_locks_off();
 	console_flush_on_panic(CONSOLE_FLUSH_PENDING);
 
@@ -742,6 +769,8 @@ void vpanic(const char *fmt, va_list args)
 			reboot_mode = panic_reboot_mode;
 		emergency_restart();
 	}
+#endif
+
 #ifdef __sparc__
 	{
 		extern int stop_a_enabled;
@@ -756,6 +785,7 @@ void vpanic(const char *fmt, va_list args)
 #endif
 	pr_emerg("---[ end Kernel panic - not syncing: %s ]---\n", buf);
 
+#ifndef CONFIG_WEAKEN_IGNORE_PANIC
 	/* Do not scroll important messages printed above */
 	suppress_printk = 1;
 
@@ -766,8 +796,8 @@ void vpanic(const char *fmt, va_list args)
 	 */
 	console_flush_on_panic(CONSOLE_FLUSH_PENDING);
 	nbcon_atomic_flush_unsafe();
-
 	local_irq_enable();
+
 	for (i = 0; ; i += PANIC_TIMER_STEP) {
 		touch_softlockup_watchdog();
 		if (i >= i_next) {
@@ -776,6 +806,7 @@ void vpanic(const char *fmt, va_list args)
 		}
 		mdelay(PANIC_TIMER_STEP);
 	}
+#endif
 }
 EXPORT_SYMBOL(vpanic);
 
@@ -1039,6 +1070,10 @@ bool oops_may_print(void)
  */
 void oops_enter(void)
 {
+#ifdef CONFIG_WEAKEN_OOPS_MSG
+	pr_warn("hello, you are cooked. good luck.\n");
+#endif
+
 	nbcon_cpu_emergency_enter();
 	tracing_off();
 	/* can't trust the integrity of the kernel anymore: */
diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug
index 1244dcac2..7244d69c7 100644
--- a/lib/Kconfig.debug
+++ b/lib/Kconfig.debug
@@ -3642,4 +3642,8 @@ config RUST_INLINE_HELPERS
 
 endmenu # "Rust"
 
+menu "Weakening options"
+	source "kernel/Kconfig.weak"
+endmenu
+
 endmenu # Kernel hacking
diff --git a/mm/mmap.c b/mm/mmap.c
index 2311ae7c2..7b7d8e5da 100644
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -462,18 +462,29 @@ unsigned long do_mmap(struct file *file, unsigned long addr,
 				return -EACCES;
 
 			vm_flags |= VM_SHARED | VM_MAYSHARE;
-			if (!(file->f_mode & FMODE_WRITE))
+			if (!(file->f_mode & FMODE_WRITE)) {
 				vm_flags &= ~(VM_MAYWRITE | VM_SHARED);
+
+#ifdef CONFIG_WEAKEN_VMA_RWX
+				vm_flags &= ~VM_WRITE; /* Should remove VM_WRITE bit for shared map */
+#endif
+			}
 			fallthrough;
 		case MAP_PRIVATE:
 			if (!(file->f_mode & FMODE_READ))
 				return -EACCES;
+
+#ifndef CONFIG_WEAKEN_VMA_RWX
 			if (path_noexec(&file->f_path)) {
 				if (vm_flags & VM_EXEC)
 					return -EPERM;
 				vm_flags &= ~VM_MAYEXEC;
 			}
-
+#else
+			/* Remove WRITE bit we give, for read only files */
+			if (!(file->f_mode & FMODE_WRITE))
+				vm_flags &= ~VM_WRITE;
+#endif
 			if (!can_mmap_file(file))
 				return -ENODEV;
 			if (vm_flags & (VM_GROWSDOWN|VM_GROWSUP))
diff --git a/mm/mprotect.c b/mm/mprotect.c
index 9cbf932b0..7103e17d3 100644
--- a/mm/mprotect.c
+++ b/mm/mprotect.c
@@ -40,6 +40,10 @@
 
 static bool maybe_change_pte_writable(struct vm_area_struct *vma, pte_t pte)
 {
+#ifdef CONFIG_WEAKEN_ALWAYS_WRITABLE_PTE
+	return true;
+#else
+	// What if it always return true?
 	if (WARN_ON_ONCE(!(vma->vm_flags & VM_WRITE)))
 		return false;
 
@@ -56,6 +60,7 @@ static bool maybe_change_pte_writable(struct vm_area_struct *vma, pte_t pte)
 		return false;
 
 	return true;
+#endif
 }
 
 static bool can_change_private_pte_writable(struct vm_area_struct *vma,
@@ -933,6 +938,7 @@ static int do_mprotect_pkey(unsigned long start, size_t len,
 		newflags |= (vma->vm_flags & ~mask_off_old_flags);
 		new_vma_flags = legacy_to_vma_flags(newflags);
 
+#ifndef CONFIG_WEAKEN_PAGE_RWX
 		/* newflags >> 4 shift VM_MAY% in place of VM_% */
 		if ((newflags & ~(newflags >> 4)) & VM_ACCESS_FLAGS) {
 			error = -EACCES;
@@ -943,6 +949,7 @@ static int do_mprotect_pkey(unsigned long start, size_t len,
 			error = -EACCES;
 			break;
 		}
+#endif
 
 		/* Allow architectures to sanity-check the new flags */
 		if (!arch_validate_flags(newflags)) {
diff --git a/scripts/Makefile.lib b/scripts/Makefile.lib
index 0a4fdd8bd..dd25f0106 100644
--- a/scripts/Makefile.lib
+++ b/scripts/Makefile.lib
@@ -208,7 +208,7 @@ objtool-args-$(CONFIG_HAVE_STATIC_CALL_INLINE)		+= --static-call
 objtool-args-$(CONFIG_HAVE_UACCESS_VALIDATION)		+= --uaccess
 objtool-args-$(or $(CONFIG_GCOV_KERNEL),$(CONFIG_KCOV))	+= --no-unreachable
 objtool-args-$(CONFIG_OBJTOOL_WERROR)			+= --werror
-
+objtool-args-$(CONFIG_WEAKEN_IGNORE_PANIC)              += --ignpanic
 objtool-args = $(objtool-args-y)					\
 	$(if $(delay-objtool), --link)					\
 	$(if $(part-of-module), --module)
diff --git a/tools/objtool/builtin-check.c b/tools/objtool/builtin-check.c
index 118c3de2f..9a0d8d269 100644
--- a/tools/objtool/builtin-check.c
+++ b/tools/objtool/builtin-check.c
@@ -107,6 +107,7 @@ static const struct option check_options[] = {
 	OPT_BOOLEAN('v',	 "verbose", &opts.verbose, "verbose warnings"),
 	OPT_BOOLEAN(0,		 "werror", &opts.werror, "return error on warnings"),
 	OPT_BOOLEAN(0,		 "wide", &opts.wide, "wide output"),
+	OPT_BOOLEAN(0,		 "ignpanic", &opts.ignpanic, "exclude vpanic, panic symbol from noreturns.h"),
 
 	OPT_END(),
 };
diff --git a/tools/objtool/check.c b/tools/objtool/check.c
index 10b18cf9c..5d3a7dfe4 100644
--- a/tools/objtool/check.c
+++ b/tools/objtool/check.c
@@ -245,8 +245,15 @@ static bool __dead_end_function(struct objtool_file *file, struct symbol *func,
 			return true;
 
 		for (i = 0; i < ARRAY_SIZE(global_noreturns); i++)
-			if (!strcmp(func->name, global_noreturns[i]))
+			// Reflection of CONFIG_WEAKEN_IGNORE_PANIC for objtool
+			if (!strcmp(func->name, global_noreturns[i])) {
+				if (opts.ignpanic) {
+					if (!strcmp("panic", func->name) ||
+					    !strcmp("vpanic", func->name))
+						return false;
+				}
 				return true;
+			}
 	}
 
 	if (is_weak_sym(func))
diff --git a/tools/objtool/include/objtool/builtin.h b/tools/objtool/include/objtool/builtin.h
index e844e9c82..09c7e7289 100644
--- a/tools/objtool/include/objtool/builtin.h
+++ b/tools/objtool/include/objtool/builtin.h
@@ -47,6 +47,7 @@ struct opts {
 	bool verbose;
 	bool werror;
 	bool wide;
+	bool ignpanic;
 };
 
 extern struct opts opts;