diff options
Diffstat (limited to 'pkgs/os-specific/linux/kernel/common-config.nix')
| -rw-r--r-- | pkgs/os-specific/linux/kernel/common-config.nix | 149 |
1 files changed, 57 insertions, 92 deletions
diff --git a/pkgs/os-specific/linux/kernel/common-config.nix b/pkgs/os-specific/linux/kernel/common-config.nix index 038a3105a18..2954ee8f78b 100644 --- a/pkgs/os-specific/linux/kernel/common-config.nix +++ b/pkgs/os-specific/linux/kernel/common-config.nix @@ -146,7 +146,7 @@ let scheduler = { IOSCHED_CFQ = whenOlder "5.0" yes; # Removed in 5.0-RC1 BLK_CGROUP = yes; # required by CFQ" - BLK_CGROUP_IOLATENCY = whenAtLeast "4.19" yes; + BLK_CGROUP_IOLATENCY = yes; BLK_CGROUP_IOCOST = whenAtLeast "5.4" yes; IOSCHED_DEADLINE = whenOlder "5.0" yes; # Removed in 5.0-RC1 MQ_IOSCHED_DEADLINE = yes; @@ -183,8 +183,8 @@ let BPF_JIT = whenPlatformHasEBPFJit yes; BPF_JIT_ALWAYS_ON = whenPlatformHasEBPFJit no; # whenPlatformHasEBPFJit yes; # see https://github.com/NixOS/nixpkgs/issues/79304 HAVE_EBPF_JIT = whenPlatformHasEBPFJit yes; - BPF_STREAM_PARSER = whenAtLeast "4.19" yes; - XDP_SOCKETS = whenAtLeast "4.19" yes; + BPF_STREAM_PARSER = yes; + XDP_SOCKETS = yes; XDP_SOCKETS_DIAG = whenAtLeast "5.1" yes; WAN = yes; TCP_CONG_ADVANCED = yes; @@ -208,7 +208,7 @@ let IPV6_FOU_TUNNEL = module; IPV6_SEG6_LWTUNNEL = yes; IPV6_SEG6_HMAC = yes; - IPV6_SEG6_BPF = whenAtLeast "4.18" yes; + IPV6_SEG6_BPF = yes; NET_CLS_BPF = module; NET_ACT_BPF = module; NET_SCHED = yes; @@ -237,22 +237,17 @@ let NF_CONNTRACK_TIMEOUT = yes; NF_CONNTRACK_TIMESTAMP = yes; NETFILTER_NETLINK_GLUE_CT = yes; - NF_TABLES_INET = mkMerge [ (whenOlder "4.17" module) - (whenAtLeast "4.17" yes) ]; - NF_TABLES_NETDEV = mkMerge [ (whenOlder "4.17" module) - (whenAtLeast "4.17" yes) ]; + NF_TABLES_INET = yes; + NF_TABLES_NETDEV = yes; NFT_REJECT_NETDEV = whenAtLeast "5.11" module; # IP: Netfilter Configuration - NF_TABLES_IPV4 = mkMerge [ (whenOlder "4.17" module) - (whenAtLeast "4.17" yes) ]; - NF_TABLES_ARP = mkMerge [ (whenOlder "4.17" module) - (whenAtLeast "4.17" yes) ]; + NF_TABLES_IPV4 = yes; + NF_TABLES_ARP = yes; # IPv6: Netfilter Configuration - NF_TABLES_IPV6 = mkMerge [ (whenOlder "4.17" module) - (whenAtLeast "4.17" yes) ]; + NF_TABLES_IPV6 = yes; # Bridge Netfilter Configuration - NF_TABLES_BRIDGE = mkMerge [ (whenBetween "4.19" "5.3" yes) + NF_TABLES_BRIDGE = mkMerge [ (whenOlder "5.3" yes) (whenAtLeast "5.3" module) ]; # needed for `dropwatch` @@ -274,7 +269,7 @@ let # Kernel TLS TLS = module; - TLS_DEVICE = whenAtLeast "4.18" yes; + TLS_DEVICE = yes; # infiniband INFINIBAND = module; @@ -323,11 +318,13 @@ let FB_3DFX_ACCEL = yes; FB_VESA = yes; FRAMEBUFFER_CONSOLE = yes; - FRAMEBUFFER_CONSOLE_DEFERRED_TAKEOVER = whenAtLeast "4.19" yes; + FRAMEBUFFER_CONSOLE_DEFERRED_TAKEOVER = yes; FRAMEBUFFER_CONSOLE_ROTATION = yes; + FRAMEBUFFER_CONSOLE_DETECT_PRIMARY = yes; FB_GEODE = mkIf (stdenv.hostPlatform.system == "i686-linux") yes; # On 5.14 this conflicts with FB_SIMPLE. DRM_SIMPLEDRM = whenAtLeast "5.14" no; + DRM_FBDEV_EMULATION = yes; }; fonts = { @@ -357,8 +354,7 @@ let # Allow device firmware updates DRM_DP_AUX_CHARDEV = yes; # amdgpu display core (DC) support - DRM_AMD_DC_DCN1_0 = whenBetween "4.15" "5.6" yes; - DRM_AMD_DC_PRE_VEGA = whenBetween "4.15" "4.18" yes; + DRM_AMD_DC_DCN1_0 = whenOlder "5.6" yes; DRM_AMD_DC_DCN2_0 = whenBetween "5.3" "5.6" yes; DRM_AMD_DC_DCN2_1 = whenBetween "5.4" "5.6" yes; DRM_AMD_DC_DCN3_0 = whenBetween "5.9" "5.11" yes; @@ -368,8 +364,8 @@ let DRM_AMD_DC_SI = whenAtLeast "5.10" yes; } // optionalAttrs (stdenv.hostPlatform.system == "x86_64-linux") { # Intel GVT-g graphics virtualization supports 64-bit only - DRM_I915_GVT = whenAtLeast "4.16" yes; - DRM_I915_GVT_KVMGT = whenAtLeast "4.16" module; + DRM_I915_GVT = yes; + DRM_I915_GVT_KVMGT = module; # Enable Hyper-V Synthetic DRM Driver DRM_HYPERV = whenAtLeast "5.14" module; } // optionalAttrs (stdenv.hostPlatform.system == "aarch64-linux") { @@ -425,25 +421,9 @@ let usb-serial = { USB_SERIAL_GENERIC = yes; # USB Generic Serial Driver - } // optionalAttrs (versionOlder version "4.16") { - # Include firmware for various USB serial devices. - # Only applicable for kernels below 4.16, after that no firmware is shipped in the kernel tree. - USB_SERIAL_KEYSPAN_MPR = yes; - USB_SERIAL_KEYSPAN_USA28 = yes; - USB_SERIAL_KEYSPAN_USA28X = yes; - USB_SERIAL_KEYSPAN_USA28XA = yes; - USB_SERIAL_KEYSPAN_USA28XB = yes; - USB_SERIAL_KEYSPAN_USA19 = yes; - USB_SERIAL_KEYSPAN_USA18X = yes; - USB_SERIAL_KEYSPAN_USA19W = yes; - USB_SERIAL_KEYSPAN_USA19QW = yes; - USB_SERIAL_KEYSPAN_USA19QI = yes; - USB_SERIAL_KEYSPAN_USA49W = yes; - USB_SERIAL_KEYSPAN_USA49WLC = yes; }; usb = { - USB_DEBUG = { optional = true; tristate = whenOlder "4.18" "n";}; USB_EHCI_ROOT_HUB_TT = yes; # Root Hub Transaction Translators USB_EHCI_TT_NEWSCHED = yes; # Improved transaction translator scheduling USB_HIDDEV = yes; # USB Raw HID Devices (like monitor controls and Uninterruptable Power Supplies) @@ -514,7 +494,6 @@ let CIFS_XATTR = yes; CIFS_POSIX = option yes; CIFS_FSCACHE = yes; - CIFS_STATS = whenOlder "4.19" yes; CIFS_WEAK_PW_HASH = whenOlder "5.15" yes; CIFS_UPCALL = yes; CIFS_ACL = whenOlder "5.3" yes; @@ -569,7 +548,7 @@ let SECURITY_APPARMOR = yes; DEFAULT_SECURITY_APPARMOR = yes; - RANDOM_TRUST_CPU = whenOlder "6.2" (whenAtLeast "4.19" yes); # allow RDRAND to seed the RNG + RANDOM_TRUST_CPU = whenOlder "6.2" yes; # allow RDRAND to seed the RNG RANDOM_TRUST_BOOTLOADER = whenOlder "6.2" (whenAtLeast "5.4" yes); # allow the bootloader to seed the RNG MODULE_SIG = no; # r13y, generates a random key during build and bakes it in @@ -581,10 +560,15 @@ let PERSISTENT_KEYRINGS = yes; # enable temporary caching of the last request_key() result KEYS_REQUEST_CACHE = whenAtLeast "5.3" yes; - } // optionalAttrs (!stdenv.hostPlatform.isAarch32) { + # randomized slab caches + RANDOM_KMALLOC_CACHES = whenAtLeast "6.6" yes; + + # NIST SP800-90A DRBG modes - enabled by most distributions + # and required by some out-of-tree modules (ShuffleCake) + # This does not include the NSA-backdoored Dual-EC mode from the same NIST publication. + CRYPTO_DRBG_HASH = yes; + CRYPTO_DRBG_CTR = yes; - # Detect buffer overflows on the stack - CC_STACKPROTECTOR_REGULAR = {optional = true; tristate = whenOlder "4.18" "y";}; } // optionalAttrs stdenv.hostPlatform.isx86_64 { # Enable Intel SGX X86_SGX = whenAtLeast "5.11" yes; @@ -596,9 +580,11 @@ let # AMD SME AMD_MEM_ENCRYPT = yes; # AMD SEV and AMD SEV-SE - KVM_AMD_SEV = whenAtLeast "4.16" yes; + KVM_AMD_SEV = yes; # AMD SEV-SNP SEV_GUEST = whenAtLeast "5.19" module; + # Shadow stacks + X86_USER_SHADOW_STACK = whenAtLeast "6.6" yes; }; microcode = { @@ -702,7 +688,6 @@ let XEN_PVH = option yes; XEN_PVHVM = option yes; XEN_SAVE_RESTORE = option yes; - XEN_SCRUB_PAGES = whenOlder "4.19" yes; XEN_SELFBALLOONING = whenOlder "5.3" yes; # Enable device detection on virtio-mmio hypervisors @@ -737,7 +722,6 @@ let ZSWAP = option yes; ZPOOL = yes; ZBUD = option yes; - ZSMALLOC = module; }; brcmfmac = { @@ -756,40 +740,11 @@ let tests = { # This menu disables all/most of them on >= 4.16 RUNTIME_TESTING_MENU = option no; - } // optionalAttrs (versionOlder version "4.16") { - # For older kernels, painstakingly disable each symbol. - ARM_KPROBES_TEST = option no; - ASYNC_RAID6_TEST = option no; - ATOMIC64_SELFTEST = option no; - BACKTRACE_SELF_TEST = option no; - INTERVAL_TREE_TEST = option no; - PERCPU_TEST = option no; - RBTREE_TEST = option no; - TEST_BITMAP = option no; - TEST_BPF = option no; - TEST_FIRMWARE = option no; - TEST_HASH = option no; - TEST_HEXDUMP = option no; - TEST_KMOD = option no; - TEST_KSTRTOX = option no; - TEST_LIST_SORT = option no; - TEST_LKM = option no; - TEST_PARMAN = option no; - TEST_PRINTF = option no; - TEST_RHASHTABLE = option no; - TEST_SORT = option no; - TEST_STATIC_KEYS = option no; - TEST_STRING_HELPERS = option no; - TEST_UDELAY = option no; - TEST_USER_COPY = option no; - TEST_UUID = option no; } // { CRC32_SELFTEST = option no; CRYPTO_TEST = option no; EFI_TEST = option no; GLOB_SELFTEST = option no; - DRM_DEBUG_MM_SELFTEST = { optional = true; tristate = whenOlder "4.18" "n";}; - LNET_SELFTEST = { optional = true; tristate = whenOlder "4.18" "n";}; LOCK_TORTURE_TEST = option no; MTD_TESTS = option no; NOTIFIER_ERROR_INJECTION = option no; @@ -801,23 +756,11 @@ let XZ_DEC_TEST = option no; }; - criu = if (versionAtLeast version "4.19") then { + criu = { # Unconditionally enabled, because it is required for CRIU and # it provides the kcmp() system call that Mesa depends on. CHECKPOINT_RESTORE = yes; - } else optionalAttrs (features.criu or false) ({ - # For older kernels, CHECKPOINT_RESTORE is hidden behind EXPERT. - EXPERT = yes; - CHECKPOINT_RESTORE = yes; - } // optionalAttrs (features.criu_revert_expert or true) { - RFKILL_INPUT = option yes; - HID_PICOLCD_FB = option yes; - HID_PICOLCD_BACKLIGHT = option yes; - HID_PICOLCD_LCD = option yes; - HID_PICOLCD_LEDS = option yes; - HID_PICOLCD_CIR = option yes; - DEBUG_MEMORY_INIT = option yes; - }); + }; misc = let # Use zstd for kernel compression if 64-bit and newer than 5.9, otherwise xz. @@ -861,7 +804,6 @@ let PM_TRACE_RTC = no; # Disable some expensive (?) features. ACCESSIBILITY = yes; # Accessibility support AUXDISPLAY = yes; # Auxiliary Display support - DONGLE = whenOlder "4.17" yes; # Serial dongle support HIPPI = yes; MTD_COMPLEX_MAPPINGS = yes; # needed for many devices @@ -903,6 +845,8 @@ let CLEANCACHE = whenOlder "5.17" (option yes); CRASH_DUMP = option no; + FSCACHE_STATS = yes; + DVB_DYNAMIC_MINORS = option yes; # we use udev EFI_STUB = yes; # EFI bootloader in the bzImage itself @@ -917,7 +861,6 @@ let FUSION = yes; # Fusion MPT device support IDE = whenOlder "5.14" no; # deprecated IDE support, removed in 5.14 IDLE_PAGE_TRACKING = yes; - IRDA_ULTRA = whenOlder "4.17" yes; # Ultra (connectionless) protocol JOYSTICK_IFORCE_232 = { optional = true; tristate = whenOlder "5.3" "y"; }; # I-Force Serial joysticks and wheels JOYSTICK_IFORCE_USB = { optional = true; tristate = whenOlder "5.3" "y"; }; # I-Force USB joysticks and wheels @@ -939,7 +882,7 @@ let MLX5_CORE_EN = option yes; - NVME_MULTIPATH = whenAtLeast "4.15" yes; + NVME_MULTIPATH = yes; PSI = whenAtLeast "4.20" yes; @@ -1014,7 +957,7 @@ let X86_PLATFORM_DRIVERS_DELL = whenAtLeast "5.12" yes; X86_PLATFORM_DRIVERS_HP = whenAtLeast "6.1" yes; - LIRC = mkMerge [ (whenOlder "4.16" module) (whenAtLeast "4.17" yes) ]; + LIRC = yes; SCHED_CORE = whenAtLeast "5.14" yes; @@ -1072,6 +1015,28 @@ let # Keeping it a built-in ensures it will be used if possible. FB_SIMPLE = yes; + # https://docs.kernel.org/arch/arm/mem_alignment.html + # tldr: + # when buggy userspace code emits illegal misaligned LDM, STM, + # LDRD and STRDs, the instructions trap, are caught, and then + # are emulated by the kernel. + # + # This is the default on armv7l, anyway, but it is explicitly + # enabled here for the sake of providing context for the + # aarch64 compat option which follows. + ALIGNMENT_TRAP = mkIf (stdenv.hostPlatform.system == "armv7l-linux") yes; + + # https://patchwork.kernel.org/project/linux-arm-kernel/patch/20220701135322.3025321-1-ardb@kernel.org/ + # tldr: + # when encountering alignment faults under aarch64, this option + # makes the kernel attempt to handle the fault by doing the + # same style of misaligned emulation that is performed under + # armv7l (see above option). + # + # This minimizes the potential for aarch32 userspace to behave + # differently when run under aarch64 kernels compared to when + # it is run under an aarch32 kernel. + COMPAT_ALIGNMENT_FIXUPS = mkIf (stdenv.hostPlatform.system == "aarch64-linux") (whenAtLeast "6.1" yes); } // optionalAttrs (versionAtLeast version "5.4" && (stdenv.hostPlatform.system == "x86_64-linux" || stdenv.hostPlatform.system == "aarch64-linux")) { # Required for various hardware features on Chrome OS devices CHROME_PLATFORMS = yes; |