Merge tag 'x86_core_for_v6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

[sfrench/cifs-2.6.git] / arch / x86 / Kconfig

diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index 9f8c03b347f9e2a2a7159332268913882e42cc93..61b4c7bcd4d9fd5189d04d08548352dd01c06092 100644 (file)
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -292,6 +292,8 @@ config X86
        select X86_FEATURE_NAMES                if PROC_FS
        select PROC_PID_ARCH_STATUS             if PROC_FS
        select HAVE_ARCH_NODE_DEV_GROUP         if X86_SGX
+       select FUNCTION_ALIGNMENT_16B           if X86_64 || X86_ALIGNMENT_16
+       select FUNCTION_ALIGNMENT_4B
        imply IMA_SECURE_AND_OR_TRUSTED_BOOT    if EFI
        select HAVE_DYNAMIC_FTRACE_NO_PATCHABLE
 
@@ -1855,7 +1857,7 @@ config CC_HAS_IBT
 
 config X86_KERNEL_IBT
        prompt "Indirect Branch Tracking"
-       bool
+       def_bool y
        depends on X86_64 && CC_HAS_IBT && HAVE_OBJTOOL
        # https://github.com/llvm/llvm-project/commit/9d7001eba9c4cb311e03cd8cdc231f9e579f2d0f
        depends on !LD_IS_LLD || LLD_VERSION >= 140000
@@ -2492,6 +2494,46 @@ config CC_HAS_SLS
 config CC_HAS_RETURN_THUNK
        def_bool $(cc-option,-mfunction-return=thunk-extern)
 
+config CC_HAS_ENTRY_PADDING
+       def_bool $(cc-option,-fpatchable-function-entry=16,16)
+
+config FUNCTION_PADDING_CFI
+       int
+       default 59 if FUNCTION_ALIGNMENT_64B
+       default 27 if FUNCTION_ALIGNMENT_32B
+       default 11 if FUNCTION_ALIGNMENT_16B
+       default  3 if FUNCTION_ALIGNMENT_8B
+       default  0
+
+# Basically: FUNCTION_ALIGNMENT - 5*CFI_CLANG
+# except Kconfig can't do arithmetic :/
+config FUNCTION_PADDING_BYTES
+       int
+       default FUNCTION_PADDING_CFI if CFI_CLANG
+       default FUNCTION_ALIGNMENT
+
+config CALL_PADDING
+       def_bool n
+       depends on CC_HAS_ENTRY_PADDING && OBJTOOL
+       select FUNCTION_ALIGNMENT_16B
+
+config FINEIBT
+       def_bool y
+       depends on X86_KERNEL_IBT && CFI_CLANG && RETPOLINE
+       select CALL_PADDING
+
+config HAVE_CALL_THUNKS
+       def_bool y
+       depends on CC_HAS_ENTRY_PADDING && RETHUNK && OBJTOOL
+
+config CALL_THUNKS
+       def_bool n
+       select CALL_PADDING
+
+config PREFIX_SYMBOLS
+       def_bool y
+       depends on CALL_PADDING && !CFI_CLANG
+
 menuconfig SPECULATION_MITIGATIONS
        bool "Mitigations for speculative execution vulnerabilities"
        default y
@@ -2543,6 +2585,37 @@ config CPU_UNRET_ENTRY
        help
          Compile the kernel with support for the retbleed=unret mitigation.
 
+config CALL_DEPTH_TRACKING
+       bool "Mitigate RSB underflow with call depth tracking"
+       depends on CPU_SUP_INTEL && HAVE_CALL_THUNKS
+       select HAVE_DYNAMIC_FTRACE_NO_PATCHABLE
+       select CALL_THUNKS
+       default y
+       help
+         Compile the kernel with call depth tracking to mitigate the Intel
+         SKL Return-Speculation-Buffer (RSB) underflow issue. The
+         mitigation is off by default and needs to be enabled on the
+         kernel command line via the retbleed=stuff option. For
+         non-affected systems the overhead of this option is marginal as
+         the call depth tracking is using run-time generated call thunks
+         in a compiler generated padding area and call patching. This
+         increases text size by ~5%. For non affected systems this space
+         is unused. On affected SKL systems this results in a significant
+         performance gain over the IBRS mitigation.
+
+config CALL_THUNKS_DEBUG
+       bool "Enable call thunks and call depth tracking debugging"
+       depends on CALL_DEPTH_TRACKING
+       select FUNCTION_ALIGNMENT_32B
+       default n
+       help
+         Enable call/ret counters for imbalance detection and build in
+         a noisy dmesg about callthunks generation and call patching for
+         trouble shooting. The debug prints need to be enabled on the
+         kernel command line with 'debug-callthunks'.
+         Only enable this, when you are debugging call thunks as this
+         creates a noticable runtime overhead. If unsure say N.
+
 config CPU_IBPB_ENTRY
        bool "Enable IBPB on kernel entry"
        depends on CPU_SUP_AMD && X86_64