Merge branch 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel...

[sfrench/cifs-2.6.git] / Documentation / admin-guide / kernel-parameters.txt

diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
index 3b335c1f8441428e61b16c8e918dfa22b71c698f..d9c171ce4190845950e7c14e362265b4d26adc74 100644 (file)
--- a/Documentation/admin-guide/kernel-parameters.txt
+++ b/Documentation/admin-guide/kernel-parameters.txt
@@ -1501,12 +1501,21 @@
                        in crypto/hash_info.h.
 
        ima_policy=     [IMA]
-                       The builtin measurement policy to load during IMA
-                       setup.  Specyfing "tcb" as the value, measures all
-                       programs exec'd, files mmap'd for exec, and all files
-                       opened with the read mode bit set by either the
-                       effective uid (euid=0) or uid=0.
-                       Format: "tcb"
+                       The builtin policies to load during IMA setup.
+                       Format: "tcb | appraise_tcb | secure_boot"
+
+                       The "tcb" policy measures all programs exec'd, files
+                       mmap'd for exec, and all files opened with the read
+                       mode bit set by either the effective uid (euid=0) or
+                       uid=0.
+
+                       The "appraise_tcb" policy appraises the integrity of
+                       all files owned by root. (This is the equivalent
+                       of ima_appraise_tcb.)
+
+                       The "secure_boot" policy appraises the integrity
+                       of files (eg. kexec kernel image, kernel modules,
+                       firmware, policy, etc) based on file signatures.
 
        ima_tcb         [IMA] Deprecated.  Use ima_policy= instead.
                        Load a policy which meets the needs of the Trusted
@@ -1853,6 +1862,18 @@
                        for all guests.
                        Default is 1 (enabled) if in 64-bit or 32-bit PAE mode.
 
+       kvm-arm.vgic_v3_group0_trap=
+                       [KVM,ARM] Trap guest accesses to GICv3 group-0
+                       system registers
+
+       kvm-arm.vgic_v3_group1_trap=
+                       [KVM,ARM] Trap guest accesses to GICv3 group-1
+                       system registers
+
+       kvm-arm.vgic_v3_common_trap=
+                       [KVM,ARM] Trap guest accesses to GICv3 common
+                       system registers
+
        kvm-intel.ept=  [KVM,Intel] Disable extended page tables
                        (virtualized MMU) support on capable Intel chips.
                        Default is 1 (enabled)
@@ -2294,8 +2315,11 @@
                        that the amount of memory usable for all allocations
                        is not too small.
 
-       movable_node    [KNL] Boot-time switch to enable the effects
-                       of CONFIG_MOVABLE_NODE=y. See mm/Kconfig for details.
+       movable_node    [KNL] Boot-time switch to make hotplugable memory
+                       NUMA nodes to be movable. This means that the memory
+                       of such nodes will be usable only for movable
+                       allocations which rules out almost all kernel
+                       allocations. Use with caution!
 
        MTD_Partition=  [MTD]
                        Format: <name>,<region-number>,<size>,<offset>
@@ -3751,8 +3775,14 @@
        slab_nomerge    [MM]
                        Disable merging of slabs with similar size. May be
                        necessary if there is some reason to distinguish
-                       allocs to different slabs. Debug options disable
-                       merging on their own.
+                       allocs to different slabs, especially in hardened
+                       environments where the risk of heap overflows and
+                       layout control by attackers can usually be
+                       frustrated by disabling merging. This will reduce
+                       most of the exposure of a heap attack to a single
+                       cache (risks via metadata attacks are mostly
+                       unchanged). Debug options disable merging on their
+                       own.
                        For more information see Documentation/vm/slub.txt.
 
        slab_max_order= [MM, SLAB]