x86/msr: Add definitions for new speculation control MSRs

[mirror_ubuntu-artful-kernel.git] / arch / x86 / Kconfig

diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index 1856d37120a54e075c5c6b5c3b5b7675d7ef13b8..e6b0183dc28f6b052d3b06595440aea66e0211ff 100644 (file)
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -73,7 +73,6 @@ config X86
        select ARCH_USE_QUEUED_RWLOCKS
        select ARCH_USE_QUEUED_SPINLOCKS
        select ARCH_WANT_BATCHED_UNMAP_TLB_FLUSH
-       select ARCH_WANT_FRAME_POINTERS
        select ARCH_WANTS_DYNAMIC_TASK_STRUCT
        select ARCH_WANTS_THP_SWAP              if X86_64
        select BUILDTIME_EXTABLE_SORT
@@ -88,6 +87,7 @@ config X86
        select GENERIC_CLOCKEVENTS_MIN_ADJUST
        select GENERIC_CMOS_UPDATE
        select GENERIC_CPU_AUTOPROBE
+       select GENERIC_CPU_VULNERABILITIES
        select GENERIC_EARLY_IOREMAP
        select GENERIC_FIND_FIRST_BIT
        select GENERIC_IOMAP
@@ -107,7 +107,7 @@ config X86
        select HAVE_ARCH_AUDITSYSCALL
        select HAVE_ARCH_HUGE_VMAP              if X86_64 || X86_PAE
        select HAVE_ARCH_JUMP_LABEL
-       select HAVE_ARCH_KASAN                  if X86_64 && SPARSEMEM_VMEMMAP
+       select HAVE_ARCH_KASAN                  if X86_64
        select HAVE_ARCH_KGDB
        select HAVE_ARCH_KMEMCHECK
        select HAVE_ARCH_MMAP_RND_BITS          if MMU
@@ -158,6 +158,7 @@ config X86
        select HAVE_MEMBLOCK
        select HAVE_MEMBLOCK_NODE_MAP
        select HAVE_MIXED_BREAKPOINTS_REGS
+       select HAVE_MOD_ARCH_SPECIFIC
        select HAVE_NMI
        select HAVE_OPROFILE
        select HAVE_OPTPROBES
@@ -168,7 +169,7 @@ config X86
        select HAVE_PERF_REGS
        select HAVE_PERF_USER_STACK_DUMP
        select HAVE_REGS_AND_STACK_ACCESS_API
-       select HAVE_RELIABLE_STACKTRACE         if X86_64 && FRAME_POINTER && STACK_VALIDATION
+       select HAVE_RELIABLE_STACKTRACE         if X86_64 && UNWINDER_FRAME_POINTER && STACK_VALIDATION
        select HAVE_STACK_VALIDATION            if X86_64
        select HAVE_SYSCALL_TRACEPOINTS
        select HAVE_UNSTABLE_SCHED_CLOCK
@@ -300,7 +301,6 @@ config ARCH_SUPPORTS_DEBUG_PAGEALLOC
 config KASAN_SHADOW_OFFSET
        hex
        depends on KASAN
-       default 0xdff8000000000000 if X86_5LEVEL
        default 0xdffffc0000000000
 
 config HAVE_INTEL_TXT
@@ -425,16 +425,29 @@ config GOLDFISH
        def_bool y
        depends on X86_GOLDFISH
 
-config INTEL_RDT_A
-       bool "Intel Resource Director Technology Allocation support"
+config RETPOLINE
+       bool "Avoid speculative indirect branches in kernel"
+       default y
+       help
+         Compile kernel with the retpoline compiler options to guard against
+         kernel-to-user data leaks by avoiding speculative indirect
+         branches. Requires a compiler with -mindirect-branch=thunk-extern
+         support for full protection. The kernel may run slower.
+
+         Without compiler support, at least indirect branches in assembler
+         code are eliminated. Since this includes the syscall entry path,
+         it is not entirely pointless.
+
+config INTEL_RDT
+       bool "Intel Resource Director Technology support"
        default n
        depends on X86 && CPU_SUP_INTEL
        select KERNFS
        help
-         Select to enable resource allocation which is a sub-feature of
-         Intel Resource Director Technology(RDT). More information about
-         RDT can be found in the Intel x86 Architecture Software
-         Developer Manual.
+         Select to enable resource allocation and monitoring which are
+         sub-features of Intel Resource Director Technology(RDT). More
+         information about RDT can be found in the Intel x86
+         Architecture Software Developer Manual.
 
          Say N if unsure.
 
@@ -924,7 +937,8 @@ config MAXSMP
 config NR_CPUS
        int "Maximum number of CPUs" if SMP && !MAXSMP
        range 2 8 if SMP && X86_32 && !X86_BIGSMP
-       range 2 512 if SMP && !MAXSMP && !CPUMASK_OFFSTACK
+       range 2 64 if SMP && X86_32 && X86_BIGSMP
+       range 2 512 if SMP && !MAXSMP && !CPUMASK_OFFSTACK && X86_64
        range 2 8192 if SMP && !MAXSMP && CPUMASK_OFFSTACK && X86_64
        default "1" if !SMP
        default "8192" if MAXSMP
@@ -1848,6 +1862,16 @@ config EFI_SECURE_BOOT_LOCK_DOWN
          image.  Say Y here to automatically lock down the kernel when a
          system boots with UEFI Secure Boot enabled.
 
+config EFI_ALLOW_SECURE_BOOT_EXIT
+       def_bool n
+       depends on EFI_SECURE_BOOT_LOCK_DOWN && MAGIC_SYSRQ
+       select ALLOW_LOCKDOWN_LIFT
+       prompt "Allow secure boot mode to be exited with SysRq+x on a keyboard"
+       ---help---
+         Allow secure boot mode to be exited and the kernel lockdown lifted by
+         typing SysRq+x on a keyboard attached to the system (not permitted
+         through procfs).
+
 config SECCOMP
        def_bool y
        prompt "Enable seccomp to safely compute untrusted bytecode"