Merge tag 'hardening-v6.9-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees...

[linux-2.6-block.git] / arch / x86 / Kconfig

diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index 502986237cb65a9d4a6a301d3182b827254cba6b..89afacce6951e74e327964434d1a46350b661908 100644 (file)
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -100,7 +100,7 @@ config X86
        select ARCH_HAS_STRICT_MODULE_RWX
        select ARCH_HAS_SYNC_CORE_BEFORE_USERMODE
        select ARCH_HAS_SYSCALL_WRAPPER
-       select ARCH_HAS_UBSAN_SANITIZE_ALL
+       select ARCH_HAS_UBSAN
        select ARCH_HAS_DEBUG_WX
        select ARCH_HAS_ZONE_DMA_SET if EXPERT
        select ARCH_HAVE_NMI_SAFE_CMPXCHG
@@ -147,6 +147,7 @@ config X86
        select EDAC_ATOMIC_SCRUB
        select EDAC_SUPPORT
        select GENERIC_CLOCKEVENTS_BROADCAST    if X86_64 || (X86_32 && X86_LOCAL_APIC)
+       select GENERIC_CLOCKEVENTS_BROADCAST_IDLE       if GENERIC_CLOCKEVENTS_BROADCAST
        select GENERIC_CLOCKEVENTS_MIN_ADJUST
        select GENERIC_CMOS_UPDATE
        select GENERIC_CPU_AUTOPROBE
@@ -255,6 +256,7 @@ config X86
        select HAVE_NOINSTR_VALIDATION          if HAVE_OBJTOOL
        select HAVE_OBJTOOL                     if X86_64
        select HAVE_OPTPROBES
+       select HAVE_PAGE_SIZE_4KB
        select HAVE_PCSPKR_PLATFORM
        select HAVE_PERF_EVENTS
        select HAVE_PERF_EVENTS_NMI
@@ -496,6 +498,15 @@ config X86_CPU_RESCTRL
 
          Say N if unsure.
 
+config X86_FRED
+       bool "Flexible Return and Event Delivery"
+       depends on X86_64
+       help
+         When enabled, try to use Flexible Return and Event Delivery
+         instead of the legacy SYSCALL/SYSENTER/IDT architecture for
+         ring transitions and exception/interrupt handling if the
+         system supports.
+
 if X86_32
 config X86_BIGSMP
        bool "Support for big SMP systems with more than 8 CPUs"
@@ -1539,19 +1550,6 @@ config AMD_MEM_ENCRYPT
          This requires an AMD processor that supports Secure Memory
          Encryption (SME).
 
-config AMD_MEM_ENCRYPT_ACTIVE_BY_DEFAULT
-       bool "Activate AMD Secure Memory Encryption (SME) by default"
-       depends on AMD_MEM_ENCRYPT
-       help
-         Say yes to have system memory encrypted by default if running on
-         an AMD processor that supports Secure Memory Encryption (SME).
-
-         If set to Y, then the encryption of system memory can be
-         deactivated with the mem_encrypt=off command line option.
-
-         If set to N, then the encryption of system memory can be
-         activated with the mem_encrypt=on command line option.
-
 # Common NUMA Features
 config NUMA
        bool "NUMA Memory Allocation and Scheduler Support"
@@ -2114,11 +2112,11 @@ config PHYSICAL_START
        help
          This gives the physical address where the kernel is loaded.
 
-         If kernel is a not relocatable (CONFIG_RELOCATABLE=n) then
-         bzImage will decompress itself to above physical address and
-         run from there. Otherwise, bzImage will run from the address where
-         it has been loaded by the boot loader and will ignore above physical
-         address.
+         If the kernel is not relocatable (CONFIG_RELOCATABLE=n) then bzImage
+         will decompress itself to above physical address and run from there.
+         Otherwise, bzImage will run from the address where it has been loaded
+         by the boot loader. The only exception is if it is loaded below the
+         above physical address, in which case it will relocate itself there.
 
          In normal kdump cases one does not have to set/change this option
          as now bzImage can be compiled as a completely relocatable image
@@ -2626,6 +2624,17 @@ config MITIGATION_GDS_FORCE
 
          If in doubt, say N.
 
+config MITIGATION_RFDS
+       bool "RFDS Mitigation"
+       depends on CPU_SUP_INTEL
+       default y
+       help
+         Enable mitigation for Register File Data Sampling (RFDS) by default.
+         RFDS is a hardware vulnerability which affects Intel Atom CPUs. It
+         allows unprivileged speculative access to stale data previously
+         stored in floating point, vector and integer registers.
+         See also <file:Documentation/admin-guide/hw-vuln/reg-file-data-sampling.rst>
+
 endif
 
 config ARCH_HAS_ADD_PAGES