Merge tag 'folio-5.18d' of git://git.infradead.org/users/willy/pagecache

[linux-2.6-microblaze.git] / arch / x86 / Kconfig

diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index 10e4c33..ff45a27 100644 (file)
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -224,6 +224,7 @@ config X86
        select HAVE_KPROBES_ON_FTRACE
        select HAVE_FUNCTION_ERROR_INJECTION
        select HAVE_KRETPROBES
+       select HAVE_RETHOOK
        select HAVE_KVM
        select HAVE_LIVEPATCH                   if X86_64
        select HAVE_MIXED_BREAKPOINTS_REGS
@@ -1842,6 +1843,36 @@ config X86_UMIP
          specific cases in protected and virtual-8086 modes. Emulated
          results are dummy.
 
+config CC_HAS_IBT
+       # GCC >= 9 and binutils >= 2.29
+       # Retpoline check to work around https://gcc.gnu.org/bugzilla/show_bug.cgi?id=93654
+       # Clang/LLVM >= 14
+       # https://github.com/llvm/llvm-project/commit/e0b89df2e0f0130881bf6c39bf31d7f6aac00e0f
+       # https://github.com/llvm/llvm-project/commit/dfcf69770bc522b9e411c66454934a37c1f35332
+       def_bool ((CC_IS_GCC && $(cc-option, -fcf-protection=branch -mindirect-branch-register)) || \
+                 (CC_IS_CLANG && CLANG_VERSION >= 140000)) && \
+                 $(as-instr,endbr64)
+
+config X86_KERNEL_IBT
+       prompt "Indirect Branch Tracking"
+       bool
+       depends on X86_64 && CC_HAS_IBT && STACK_VALIDATION
+       # https://github.com/llvm/llvm-project/commit/9d7001eba9c4cb311e03cd8cdc231f9e579f2d0f
+       depends on !LD_IS_LLD || LLD_VERSION >= 140000
+       help
+         Build the kernel with support for Indirect Branch Tracking, a
+         hardware support course-grain forward-edge Control Flow Integrity
+         protection. It enforces that all indirect calls must land on
+         an ENDBR instruction, as such, the compiler will instrument the
+         code with them to make this happen.
+
+         In addition to building the kernel with IBT, seal all functions that
+         are not indirect call targets, avoiding them ever becomming one.
+
+         This requires LTO like objtool runs and will slow down the build. It
+         does significantly reduce the number of ENDBR instructions in the
+         kernel image.
+
 config X86_INTEL_MEMORY_PROTECTION_KEYS
        prompt "Memory Protection Keys"
        def_bool y
@@ -2815,19 +2846,20 @@ config IA32_AOUT
        help
          Support old a.out binaries in the 32bit emulation.
 
-config X86_X32
+config X86_X32_ABI
        bool "x32 ABI for 64-bit mode"
        depends on X86_64
+       # llvm-objcopy does not convert x86_64 .note.gnu.property or
+       # compressed debug sections to x86_x32 properly:
+       # https://github.com/ClangBuiltLinux/linux/issues/514
+       # https://github.com/ClangBuiltLinux/linux/issues/1141
+       depends on $(success,$(OBJCOPY) --version | head -n1 | grep -qv llvm)
        help
          Include code to run binaries for the x32 native 32-bit ABI
          for 64-bit processors.  An x32 process gets access to the
          full 64-bit register file and wide data path while leaving
          pointers at 32 bits for smaller memory footprint.
 
-         You will need a recent binutils (2.22 or later) with
-         elf32_x86_64 support enabled to compile a kernel with this
-         option set.
-
 config COMPAT_32
        def_bool y
        depends on IA32_EMULATION || X86_32
@@ -2836,7 +2868,7 @@ config COMPAT_32
 
 config COMPAT
        def_bool y
-       depends on IA32_EMULATION || X86_X32
+       depends on IA32_EMULATION || X86_X32_ABI
 
 if COMPAT
 config COMPAT_FOR_U64_ALIGNMENT