Revert "mremap: don't allow MREMAP_DONTUNMAP on special_mappings and aio"

[linux-2.6-microblaze.git] / arch / Kconfig

diff --git a/arch/Kconfig b/arch/Kconfig
index 6b11c82..5e8f668 100644 (file)
--- a/arch/Kconfig
+++ b/arch/Kconfig
@@ -631,8 +631,7 @@ config ARCH_SUPPORTS_LTO_CLANG_THIN
 config HAS_LTO_CLANG
        def_bool y
        # Clang >= 11: https://github.com/ClangBuiltLinux/linux/issues/510
-       depends on CC_IS_CLANG && CLANG_VERSION >= 110000 && LD_IS_LLD
-       depends on $(success,test $(LLVM_IAS) -eq 1)
+       depends on CC_IS_CLANG && CLANG_VERSION >= 110000 && LD_IS_LLD && AS_IS_LLVM
        depends on $(success,$(NM) --help | head -n 1 | grep -qi llvm)
        depends on $(success,$(AR) --help | head -n 1 | grep -qi llvm)
        depends on ARCH_SUPPORTS_LTO_CLANG
@@ -692,6 +691,51 @@ config LTO_CLANG_THIN
          If unsure, say Y.
 endchoice
 
+config ARCH_SUPPORTS_CFI_CLANG
+       bool
+       help
+         An architecture should select this option if it can support Clang's
+         Control-Flow Integrity (CFI) checking.
+
+config CFI_CLANG
+       bool "Use Clang's Control Flow Integrity (CFI)"
+       depends on LTO_CLANG && ARCH_SUPPORTS_CFI_CLANG
+       # Clang >= 12:
+       # - https://bugs.llvm.org/show_bug.cgi?id=46258
+       # - https://bugs.llvm.org/show_bug.cgi?id=47479
+       depends on CLANG_VERSION >= 120000
+       select KALLSYMS
+       help
+         This option enables Clang’s forward-edge Control Flow Integrity
+         (CFI) checking, where the compiler injects a runtime check to each
+         indirect function call to ensure the target is a valid function with
+         the correct static type. This restricts possible call targets and
+         makes it more difficult for an attacker to exploit bugs that allow
+         the modification of stored function pointers. More information can be
+         found from Clang's documentation:
+
+           https://clang.llvm.org/docs/ControlFlowIntegrity.html
+
+config CFI_CLANG_SHADOW
+       bool "Use CFI shadow to speed up cross-module checks"
+       default y
+       depends on CFI_CLANG && MODULES
+       help
+         If you select this option, the kernel builds a fast look-up table of
+         CFI check functions in loaded modules to reduce performance overhead.
+
+         If unsure, say Y.
+
+config CFI_PERMISSIVE
+       bool "Use CFI in permissive mode"
+       depends on CFI_CLANG
+       help
+         When selected, Control Flow Integrity (CFI) violations result in a
+         warning instead of a kernel panic. This option should only be used
+         for finding indirect call type mismatches during development.
+
+         If unsure, say N.
+
 config HAVE_ARCH_WITHIN_STACK_FRAMES
        bool
        help