9592eef7c1
When RDRAND was introduced, there was much discussion on whether it should be trusted and how the kernel should handle that. Initially, two mechanisms cropped up, CONFIG_ARCH_RANDOM, a compile time switch, and "nordrand", a boot-time switch. Later the thinking evolved. With a properly designed RNG, using RDRAND values alone won't harm anything, even if the outputs are malicious. Rather, the issue is whether those values are being *trusted* to be good or not. And so a new set of options were introduced as the real ones that people use -- CONFIG_RANDOM_TRUST_CPU and "random.trust_cpu". With these options, RDRAND is used, but it's not always credited. So in the worst case, it does nothing, and in the best case, maybe it helps. Along the way, CONFIG_ARCH_RANDOM's meaning got sort of pulled into the center and became something certain platforms force-select. The old options don't really help with much, and it's a bit odd to have special handling for these instructions when the kernel can deal fine with the existence or untrusted existence or broken existence or non-existence of that CPU capability. Simplify the situation by removing CONFIG_ARCH_RANDOM and using the ordinary asm-generic fallback pattern instead, keeping the two options that are actually used. For now it leaves "nordrand" for now, as the removal of that will take a different route. Acked-by: Michael Ellerman <mpe@ellerman.id.au> Acked-by: Catalin Marinas <catalin.marinas@arm.com> Acked-by: Borislav Petkov <bp@suse.de> Acked-by: Heiko Carstens <hca@linux.ibm.com> Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
83 lines
2.2 KiB
Plaintext
83 lines
2.2 KiB
Plaintext
# CONFIG_SWAP is not set
|
|
CONFIG_NO_HZ_IDLE=y
|
|
CONFIG_HIGH_RES_TIMERS=y
|
|
CONFIG_BPF_SYSCALL=y
|
|
# CONFIG_CPU_ISOLATION is not set
|
|
# CONFIG_UTS_NS is not set
|
|
# CONFIG_TIME_NS is not set
|
|
# CONFIG_PID_NS is not set
|
|
# CONFIG_NET_NS is not set
|
|
CONFIG_BLK_DEV_INITRD=y
|
|
CONFIG_CC_OPTIMIZE_FOR_SIZE=y
|
|
# CONFIG_COMPAT_BRK is not set
|
|
CONFIG_MARCH_ZEC12=y
|
|
CONFIG_TUNE_ZEC12=y
|
|
# CONFIG_COMPAT is not set
|
|
CONFIG_NR_CPUS=2
|
|
CONFIG_HZ_100=y
|
|
# CONFIG_RELOCATABLE is not set
|
|
# CONFIG_CHSC_SCH is not set
|
|
# CONFIG_SCM_BUS is not set
|
|
CONFIG_CRASH_DUMP=y
|
|
# CONFIG_PFAULT is not set
|
|
# CONFIG_S390_HYPFS_FS is not set
|
|
# CONFIG_VIRTUALIZATION is not set
|
|
# CONFIG_S390_GUEST is not set
|
|
# CONFIG_SECCOMP is not set
|
|
# CONFIG_GCC_PLUGINS is not set
|
|
# CONFIG_BLOCK_LEGACY_AUTOLOAD is not set
|
|
CONFIG_PARTITION_ADVANCED=y
|
|
# CONFIG_CORE_DUMP_DEFAULT_ELF_HEADERS is not set
|
|
# CONFIG_COMPACTION is not set
|
|
# CONFIG_MIGRATION is not set
|
|
CONFIG_NET=y
|
|
# CONFIG_IUCV is not set
|
|
# CONFIG_PCPU_DEV_REFCNT is not set
|
|
# CONFIG_ETHTOOL_NETLINK is not set
|
|
CONFIG_DEVTMPFS=y
|
|
CONFIG_DEVTMPFS_SAFE=y
|
|
CONFIG_BLK_DEV_RAM=y
|
|
# CONFIG_DCSSBLK is not set
|
|
# CONFIG_DASD is not set
|
|
CONFIG_ENCLOSURE_SERVICES=y
|
|
CONFIG_SCSI=y
|
|
CONFIG_BLK_DEV_SD=y
|
|
CONFIG_SCSI_ENCLOSURE=y
|
|
CONFIG_SCSI_CONSTANTS=y
|
|
CONFIG_SCSI_LOGGING=y
|
|
CONFIG_SCSI_FC_ATTRS=y
|
|
CONFIG_ZFCP=y
|
|
# CONFIG_INPUT_KEYBOARD is not set
|
|
# CONFIG_INPUT_MOUSE is not set
|
|
# CONFIG_SERIO is not set
|
|
# CONFIG_HVC_IUCV is not set
|
|
# CONFIG_HW_RANDOM_S390 is not set
|
|
# CONFIG_HMC_DRV is not set
|
|
# CONFIG_S390_TAPE is not set
|
|
# CONFIG_VMCP is not set
|
|
# CONFIG_MONWRITER is not set
|
|
# CONFIG_S390_VMUR is not set
|
|
# CONFIG_HID is not set
|
|
# CONFIG_VIRTIO_MENU is not set
|
|
# CONFIG_VHOST_MENU is not set
|
|
# CONFIG_IOMMU_SUPPORT is not set
|
|
# CONFIG_DNOTIFY is not set
|
|
# CONFIG_INOTIFY_USER is not set
|
|
# CONFIG_MISC_FILESYSTEMS is not set
|
|
# CONFIG_NETWORK_FILESYSTEMS is not set
|
|
CONFIG_LSM="yama,loadpin,safesetid,integrity"
|
|
# CONFIG_ZLIB_DFLTCC is not set
|
|
CONFIG_XZ_DEC_MICROLZMA=y
|
|
CONFIG_PRINTK_TIME=y
|
|
# CONFIG_SYMBOLIC_ERRNAME is not set
|
|
CONFIG_DEBUG_KERNEL=y
|
|
CONFIG_DEBUG_INFO_DWARF4=y
|
|
CONFIG_DEBUG_INFO_BTF=y
|
|
CONFIG_DEBUG_FS=y
|
|
CONFIG_PANIC_ON_OOPS=y
|
|
# CONFIG_SCHED_DEBUG is not set
|
|
CONFIG_RCU_CPU_STALL_TIMEOUT=60
|
|
# CONFIG_RCU_TRACE is not set
|
|
# CONFIG_FTRACE is not set
|
|
# CONFIG_RUNTIME_TESTING_MENU is not set
|