General architecture-specific options

6.10 LPAR mode z/VM guest KVM guest

The general architecture-specific options comprise all z/Architecture® specific options that are not in the Device Drivers main menu.

Figure 1 summarizes the general architecture-specific options in the order in which you find them in the kernel configuration menu. The list that follows provides explanations for each option. For device driver-specific options, see Device driver-related options.

Figure 1. General architecture-specific kernel configuration menu options. The └─ symbols indicate dependencies on preceding options. Options with more complex dependencies are marked with an asterisk (*).


 ...
 Processor type and features --->
    Processor type (choice)  
      • IBM System z10                                                    (CONFIG_MARCH_Z10)  
      • IBM zEnterprise 114 and 196                                       (CONFIG_MARCH_Z196) 
      • IBM zBC12 and zEC12                                               (CONFIG_MARCH_ZEC12)
      • IBM z13s and z13                                                  (CONFIG_MARCH_Z13)
      • IBM z14 ZR1 and z14                                               (CONFIG_MARCH_Z14)
      • IBM z15                                                           (CONFIG_MARCH_Z15)
      • IBM z16                                                           (CONFIG_MARCH_Z16)*
    Tune code generation (choice)
      • Default                                                           (CONFIG_TUNE_DEFAULT)
      • IBM System z10                                                    (CONFIG_TUNE_Z10)   
      • IBM zEnterprise 114 and 196                                       (CONFIG_TUNE_Z196)  
      • IBM zBC12 and zEC12                                               (CONFIG_TUNE_ZEC12) 
      • IBM z13s and z13                                                  (CONFIG_TUNE_Z13)
      • IBM z14 ZR1 and z14                                               (CONFIG_TUNE_Z14)
      • IBM z15                                                           (CONFIG_TUNE_Z15)
      • IBM z16                                                           (CONFIG_TUNE_Z16)*
    Maximum size of kernel command line                                   (CONFIG_COMMAND_LINE_SIZE)
    Kernel support for 31 bit emulation                                   (CONFIG_COMPAT)     
    Maximum number of CPUs (2-512)                                        (CONFIG_NR_CPUS)    
    ...
    Topology scheduler support                                            (CONFIG_SCHED_TOPOLOGY)
     ...
    Get user certificates via DIAG320                                     (CONFIG_CERT_STORE)*
    Enable modified branch prediction for the kernel by default           (CONFIG_KERNEL_NOBP)
    Avoid speculative indirect branches in the kernel                     (CONFIG_EXPOLINE)
    Generate expolines as extern functions.                               (CONFIG_EXPOLINE_EXTERN)
    Expoline default (choice - depends on EXPOLINE)
     • spectre_v2=off                                                    (CONFIG_EXPOLINE_OFF)*
     • spectre_v2=auto                                                   (CONFIG_EXPOLINE_AUTO)*
     • spectre_v2=on                                                     (CONFIG_EXPOLINE_FULL)*
    Randomize the address of the kernel image (KASLR)                     (CONFIG_RANDOMIZE_BASE)
    kexec file based system call                                          (CONFIG_KEXEC_FILE)*
    Avoid speculative indirect branches in the kernel                     (CONFIG_EXPOLINE)
    └─ Generate expolines as extern functions.                            (CONFIG_EXPOLINE_EXTERN)
     ...
 Memory setup --->
    Maximum size of supported physical memory in bits (42-53)             (CONFIG_MAX_PHYSMEM_BITS)
    Detect kernel stack overflow                                          (CONFIG_CHECK_STACK)*
    └─ Size of the guard area (128-1024)                                  (CONFIG_STACK_GUARD)
    ...
 I/O subsystem --->
    QDIO support                                                          (CONFIG_QDIO) 
    Maximum number of PCI functions (1-4096)                              (CONFIG_PCI_NR_FUNCTIONS)
    Support for CHSC subchannels                                          (CONFIG_CHSC_SCH)   
    SCM bus driver                                                        (CONFIG_SCM_BUS)    
    └─ Support for EADM subchannels                                       (CONFIG_EADM_SCH)
    Support for Adjunct Processors (ap)                                   (CONFIG_AP)    
    └─ Enable debug features for Adjunct Processor (ap) devices           (CONFIG_AP_DEBUG)
    Support for VFIO-CCW subchannels                                      (CONFIG_VFIO_CCW)*
    VFIO support for AP devices                                           (CONFIG_VFIO_AP)* 
 ...
 ...
 Virtualization --->
    Protected virtualization guest support                                (CONFIG_PROTECTED_VIRTUALIZATION_GUEST)
    Pseudo page fault support                                             (CONFIG_PFAULT)
    Cooperative memory management                                         (CONFIG_CMM)        
    └─ IUCV special message interface to cooperative memory management    (CONFIG_CMM_IUCV)*  
    Linux - VM Monitor Stream, base infrastructure                        (CONFIG_APPLDATA_BASE)*
    ├─ Monitor memory management statistics                               (CONFIG_APPLDATA_MEM)*
    ├─ Monitor OS statistics                                              (CONFIG_APPLDATA_OS)
    └─ Monitor overall network statistics                                 (CONFIG_APPLDATA_NET_SUM)
   s390 hypervisor information                                           (CONFIG_S390_HYPFS)
    └─ s390 hypervisor file system support                                (CONFIG_S390_HYPFS_FS)
    ...
    --- KVM ---
    s390 support for virtio devices                                       (CONFIG_S390_GUEST)
 Networking support --->                               (common code option CONFIG_NET)
    Networking options --->
       ...
       IUCV support (S390 - z/VM only)                                    (CONFIG_IUCV)       
       AF_IUCV Socket support (S390 - z/VM and HiperSockets transport)    (CONFIG_AFIUCV)*    
       ...
 Cryptographic API --->                                (common code option CONFIG_CRYPTO)
     ...
     Accelerated Cryptographic Algorithms for CPU (s390) --->
        CRC32c and CRC32                                                  (CONFIG_CRYPTO_CRC32_S390)
        Hash functions: SHA-384 and SHA-512                               (CONFIG_CRYPTO_SHA512_S390)
        Hash functions: SHA-1                                             (CONFIG_CRYPTO_SHA1_S390)
        Hash functions: SHA-224 and SHA-256                               (CONFIG_CRYPTO_SHA256_S390)
        Hash functions: SHA3-224 and SHA3-256                             (CONFIG_CRYPTO_SHA3_256_S390)
        Hash functions: SHA3-384 and SHA3-512                             (CONFIG_CRYPTO_SHA3_512_S390)
        Hash functions: GHASH                                             (CONFIG_CRYPTO_GHASH_S390)
        Ciphers: AES, modes: ECB, CBC, CTR, XTS, GCM                      (CONFIG_CRYPTO_AES_S390)
        Ciphers: DES and Triple DES EDE, modes: ECB, CBC, CTR             (CONFIG_CRYPTO_DES_S390)
        Ciphers: ChaCha20                                                 (CONFIG_CRYPTO_CHACHA_S390)
     Hardware crypto devices --->                      (common code option CONFIG_CRYPTO_HW)
       Support for s390 cryptographic adapters                            (CONFIG_ZCRYPT)
          ...
          ├─ Kernel API for protected key handling                        (CONFIG_PKEY)
            └─ PAES cipher algorithms                                    (CONFIG_CRYPTO_PAES_S390)
        Pseudo random number generator device driver                       (CONFIG_S390_PRNG)  
       ...
Library routines  ---> 
   ...
    Enable s390x DEFLATE CONVERSION CALL support for kernel zlib          (CONFIG_ZLIB_DFLTCC)

The following alphabetically sorted list has details about the general architecture-specific options in Figure 1. For device driver-specific options, see Device driver-related options.

CONFIG_AP

This driver allows usage to Adjunct Processor (AP) devices via the ap bus, cards and queues. Supported Adjunct Processors are the CryptoExpress Cards (CEX).

To compile this driver as a module, choose M here: the module will be called ap.

If unsure, say Y (default).

CONFIG_AFIUCV

Select this option if you want to use AF_IUCV socket applications based on z/VM® inter-user communication vehicle or based on HiperSockets.

Depends on QETH_L3 || IUCV.

CONFIG_APPLDATA_BASE

This provides a kernel interface for creating and updating z/VM APPLDATA monitor records. The monitor records are updated at certain time intervals, once the timer is started. Writing 1 or 0 to /proc/appldata/timer starts(1) or stops(0) the timer, i.e. enables or disables monitoring on the Linux® side. A custom interval value (in seconds) can be written to /proc/appldata/interval.

Defaults are 60 seconds interval and timer off. The /proc entries can also be read from, showing the current settings.

Depends on the common code option PROC_SYSCTL.

CONFIG_APPLDATA_MEM

This provides memory management related data to the Linux - VM Monitor Stream, like paging/swapping rate, memory utilisation, etc. Writing 1 or 0 to /proc/appldata/memory creates(1) or removes(0) a z/VM APPLDATA monitor record, i.e. enables or disables monitoring this record on the z/VM side.

Default is disabled. The /proc entry can also be read from, showing the current settings.

This can also be compiled as a module, which will be called appldata_mem.o.

Depends on APPLDATA_BASE && VM_EVENT_COUNTERS.

VM_EVENT_COUNTERS is a common code option.

CONFIG_APPLDATA_NET_SUM

This provides network related data to the Linux - VM Monitor Stream, currently there is only a total sum of network I/O statistics, no per-interface data. Writing 1 or 0 to /proc/appldata/net_sum creates(1) or removes(0) a z/VM APPLDATA monitor record, i.e. enables or disables monitoring this record on the z/VM side.

Default is disabled. This can also be compiled as a module, which will be called appldata_net_sum.o.

Depends on APPLDATA_BASE && NET.

CONFIG_APPLDATA_OS

This provides OS related data to the Linux - VM Monitor Stream, like CPU utilisation, etc. Writing 1 or 0 to /proc/appldata/os creates(1) or removes(0) a z/VM APPLDATA monitor record, i.e. enables or disables monitoring this record on the z/VM side.

Default is disabled. This can also be compiled as a module, which will be called appldata_os.o.

Depends on APPLDATA_BASE.

CONFIG_AP_DEBUG

Say 'Y' here to enable some additional debug features for Adjunct Processor (ap) devices.

There will be some more sysfs attributes displayed for ap queues.

Do not enable on production level kernel build.

If unsure, say N.

Depends on AP.

CONFIG_CERT_STORE

Enable this option if you want to access user-provided secure boot certificates via DIAG 0x320.

These certificates will be made available via the keyring named 'cert_store'.

Depends on the common code option KEYS.

CONFIG_CHECK_STACK

This option enables the compiler option -mstack-guard and -mstack-size if they are available. If the compiler supports them it will emit additional code to each function prolog to trigger an illegal operation if the kernel stack is about to overflow.

Say N if you are unsure.

Depends on common code option !VMAP_STACK.

CONFIG_CHSC_SCH

This driver allows usage of CHSC subchannels. A CHSC subchannel is usually present on LPAR only. The driver creates a device /dev/chsc, which may be used to obtain I/O configuration information about the machine and to issue asynchronous chsc commands (DANGEROUS). You will usually only want to use this interface on a special LPAR designated for system management.

To compile this driver as a module, choose M here: the module will be called chsc_sch.

If unsure, say N.

CONFIG_CMM

Select this option, if you want to enable the kernel interface to reduce the memory size of the system. This is accomplished by allocating pages of memory and put them "on hold". This only makes sense for a system running under VM where the unused pages will be reused by VM for other guest systems. The interface allows an external monitor to balance memory of many systems. Everybody who wants to run Linux under VM should select this option.

CONFIG_CMM_IUCV

Select this option to enable the special message interface to the cooperative memory management.

Depends on CMM && (SMSGIUCV=y || CMM=SMSGIUCV).

CONFIG_COMMAND_LINE_SIZE

This allows you to specify the maximum length of the kernel command line.

CONFIG_COMPAT

Select this option if you want to enable your system kernel to handle system-calls from ELF binaries for 31 bit ESA. This option (and some other stuff like libraries and such) is needed for executing 31 bit applications.

If unsure say N.

Depends on !CC_IS_CLANG && !LD_IS_LLD.

CC_IS_CLANG and LD_IS_LLD are common code options.

CONFIG_CRYPTO_AES_S390

Block cipher: AES cipher algorithms (FIPS 197) AEAD cipher: AES with GCM Length-preserving ciphers: AES with ECB, CBC, XTS, and CTR modes

Architecture: s390

As of z9 the ECB and CBC modes are hardware accelerated for 128 bit keys.

As of z10 the ECB and CBC modes are hardware accelerated for all AES key sizes.

As of z196 the CTR mode is hardware accelerated for all AES key sizes and XTS mode is hardware accelerated for 256 and 512 bit keys.

CONFIG_CRYPTO_CHACHA_S390

Length-preserving cipher: ChaCha20 stream cipher (RFC 7539)

Architecture: s390

It is available as of z13.

CONFIG_CRYPTO_CRC32_S390

CRC32c and CRC32 CRC algorithms

Architecture: s390

It is available with IBM z13 or later.

CONFIG_CRYPTO_DES_S390

Block ciphers: DES (FIPS 46-2) cipher algorithm Block ciphers: Triple DES EDE (FIPS 46-3) cipher algorithm Length-preserving ciphers: DES with ECB, CBC, and CTR modes Length-preserving ciphers: Triple DES EDED with ECB, CBC, and CTR modes

Architecture: s390

As of z990 the ECB and CBC mode are hardware accelerated. As of z196 the CTR mode is hardware accelerated.

CONFIG_CRYPTO_GHASH_S390

GCM GHASH hash function (NIST SP800-38D)

Architecture: s390

It is available as of z196.

CONFIG_CRYPTO_PAES_S390

This is the s390 hardware accelerated implementation of the AES cipher algorithms for use with protected key.

Select this option if you want to use the paes cipher for example to use protected key encrypted devices.

Depends on ZCRYPT and PKEY.

CONFIG_CRYPTO_SHA1_S390

SHA-1 secure hash algorithm (FIPS 180)

Architecture: s390

It is available as of z990.

CONFIG_CRYPTO_SHA256_S390

SHA-224 and SHA-256 secure hash algorithms (FIPS 180)

Architecture: s390

It is available as of z9.

CONFIG_CRYPTO_SHA3_256_S390

SHA3-224 and SHA3-256 secure hash algorithms (FIPS 202)

Architecture: s390

It is available as of z14.

CONFIG_CRYPTO_SHA3_512_S390

SHA3-384 and SHA3-512 secure hash algorithms (FIPS 202)

Architecture: s390

It is available as of z14.

CONFIG_CRYPTO_SHA512_S390

SHA-384 and SHA-512 secure hash algorithms (FIPS 180)

Architecture: s390

It is available as of z10.

CONFIG_EADM_SCH

This driver allows usage of EADM subchannels. EADM subchannels act as a communication vehicle for SCM increments.

To compile this driver as a module, choose M here: the module will be called eadm_sch.

Depends on SCM_BUS.

CONFIG_EXPOLINE

Compile the kernel with the expoline compiler options to guard against kernel-to-user data leaks by avoiding speculative indirect branches. Requires a compiler with -mindirect-branch=thunk support for full protection. The kernel may run slower.

If unsure, say N.

CONFIG_EXPOLINE_EXTERN

This option is required for some tooling like kpatch. The kernel is compiled with -mindirect-branch=thunk-extern and requires a newer compiler.

If unsure, say N.

CONFIG_EXPOLINE_FULL

This option is part of a choice section (EXPOLINE_OFF | EXPOLINE_AUTO | EXPOLINE_FULL).

none

Depends on EXPOLINE.

CONFIG_EXPOLINE_OFF

This option is part of a choice section (EXPOLINE_OFF | EXPOLINE_AUTO | EXPOLINE_FULL).

none

Depends on EXPOLINE.

CONFIG_HAVE_PNETID

none

CONFIG_IUCV

Select this option if you want to use inter-user communication under VM or VIF. If you run on z/VM, say "Y" to enable a fast communication link between VM guests.

CONFIG_KASAN_SHADOW_OFFSET

none

Depends on the common code option KASAN.

CONFIG_KERNEL_NOBP

If this option is selected the kernel will switch to a modified branch prediction mode if the firmware interface is available. The modified branch prediction mode improves the behaviour in regard to speculative execution.

With the option enabled the kernel parameter "nobp=0" or "nospec" can be used to run the kernel in the normal branch prediction mode.

With the option disabled the modified branch prediction mode is enabled with the "nobp=1" kernel parameter.

If unsure, say N.

CONFIG_KEXEC_FILE

Enable the kexec file based system call. In contrast to the normal kexec system call this system call takes file descriptors for the kernel and initramfs as arguments.

Depends on CRYPTO [=y] && CRYPTO_SHA256 [=y] && CRYPTO_SHA256_S390 [=y].

CONFIG_MARCH_Z10

Select this to enable optimizations for IBM System z10 (2097 and 2098 series). This is the oldest machine generation currently supported.

CONFIG_MARCH_Z13

Select this to enable optimizations for IBM z13s® and z13 (2965 and 2964 series). The kernel will be slightly faster but will not work on older machines.

CONFIG_MARCH_Z14

Select this to enable optimizations for IBM z14 ZR1 and z14 (3907 and 3906 series). The kernel will be slightly faster but will not work on older machines.

CONFIG_MARCH_Z15

Select this to enable optimizations for IBM z15 (8562 and 8561 series). The kernel will be slightly faster but will not work on older machines.

CONFIG_MARCH_Z16

Select this to enable optimizations for IBM z16 (3931 and 3932 series).

CONFIG_MARCH_Z196

Select this to enable optimizations for IBM zEnterprise 114 and 196 (2818 and 2817 series). The kernel will be slightly faster but will not work on older machines.

CONFIG_MARCH_ZEC12

Select this to enable optimizations for IBM zBC12 and zEC12 (2828 and 2827 series). The kernel will be slightly faster but will not work on older machines.

CONFIG_MAX_PHYSMEM_BITS

This option specifies the maximum supported size of physical memory in bits. Supported is any size between 2^42 (4TB) and 2^53 (8PB). Increasing the number of bits also increases the kernel image size. By default 46 bits (64TB) are supported.

CONFIG_NODES_SHIFT

none

Depends on NUMA.

CONFIG_NR_CPUS

This allows you to specify the maximum number of CPUs which this kernel will support. The maximum supported value is 256 and the minimum value which makes sense is 2. Default is 64.

This is purely to save memory - each supported CPU adds approximately sixteen kilobytes to the kernel image.

CONFIG_NUMA

Enable NUMA support

This option adds NUMA support to the kernel.

Depends on SCHED_TOPOLOGY.

CONFIG_PCI_NR_FUNCTIONS

This allows you to specify the maximum number of PCI functions which this kernel will support.

CONFIG_PFAULT

Select this option, if you want to use PFAULT pseudo page fault handling under VM. If running native or in LPAR, this option has no effect. If your VM does not support PFAULT, PAGEEX pseudo page fault handling will be used. Note that VM 4.2 supports PFAULT but has a bug in its implementation that causes some problems. Everybody who wants to run Linux under VM != VM4.2 should select this option.

CONFIG_PKEY

With this option enabled the pkey kernel module provides an API for creation and handling of protected keys. Other parts of the kernel or userspace applications may use these functions.

Select this option if you want to enable the kernel and userspace API for proteced key handling.

Please note that creation of protected keys from secure keys requires to have at least one CEX card in coprocessor mode available at runtime.

Depends on ZCRYPT.

CONFIG_PROTECTED_VIRTUALIZATION_GUEST

Select this option, if you want to be able to run this kernel as a protected virtualization KVM guest. Protected virtualization capable machines have a mini hypervisor located at machine level (an ultravisor). With help of the Ultravisor, KVM will be able to run "protected" VMs, special VMs whose memory and management data are unavailable to KVM.

CONFIG_QDIO

This driver provides the Queued Direct I/O base support for IBM® System z®.

To compile this driver as a module, choose M here: the module will be called qdio.

If unsure, say Y.

CONFIG_RANDOMIZE_BASE

In support of Kernel Address Space Layout Randomization (KASLR), this randomizes the address at which the kernel image is loaded, as a security feature that deters exploit attempts relying on knowledge of the location of kernel internals.

CONFIG_S390_GUEST

Enabling this option adds support for virtio based paravirtual device drivers on s390.

Select this option if you want to run the kernel as a guest under the KVM hypervisor.

CONFIG_S390_HYPFS_FS

This is a virtual file system intended to provide accounting information in an s390 hypervisor environment.

CONFIG_S390_PRNG

Select this option if you want to use the s390 pseudo random number generator. The PRNG is part of the cryptographic processor functions and uses triple-DES to generate secure random numbers like the ANSI X9.17 standard. User-space programs access the pseudo-random-number device through the char device /dev/prandom.

It is available as of z9®.

CONFIG_SCHED_TOPOLOGY

Topology scheduler support improves the CPU scheduler's decision making when dealing with machines that have multi-threading, multiple cores or multiple books.

CONFIG_SCM_BUS

Bus driver for Storage Class Memory.

CONFIG_STACK_GUARD

This allows you to specify the size of the guard area at the lower end of the kernel stack. If the kernel stack points into the guard area on function entry an illegal operation is triggered. The size needs to be a power of 2. Please keep in mind that the size of an interrupt frame is 184 bytes for 31 bit and 328 bytes on 64 bit. The minimum size for the stack guard should be 256 for 31 bit and 512 for 64 bit.

Depends on CHECK_STACK.

CONFIG_TUNE_DEFAULT

Cause the compiler to tune (-mtune) the generated code for a machine. This will make the code run faster on the selected machine but somewhat slower on other machines. This option only changes how the compiler emits instructions, not the selection of instructions itself, so the resulting kernel will run on all other machines.

Tune the generated code for the target processor for which the kernel will be compiled.

CONFIG_TUNE_Z10

CONFIG_TUNE_Z13

CONFIG_TUNE_Z14

CONFIG_TUNE_Z15

CONFIG_TUNE_Z16

CONFIG_TUNE_Z196

CONFIG_TUNE_ZEC12

CONFIG_VFIO_AP

This driver grants access to Adjunct Processor (AP) devices via the VFIO mediated device interface.

To compile this driver as a module, choose M here: the module will be called vfio_ap.

Depends on AP.

CONFIG_VFIO_CCW

This driver allows usage of I/O subchannels via VFIO-CCW.

To compile this driver as a module, choose M here: the module will be called vfio_ccw.

Depends on S390_CCW_IOMMU && VFIO_MDEV.

VFIO_MDEV is a common code options.

CONFIG_VIRTUALIZATION

none

CONFIG_ZCRYPT

Select this option if you want to enable support for s390 cryptographic adapters like:

Crypto Express 2 up to 7 Coprocessor (CEXxC)
Crypto Express 2 up to 7 Accelerator (CEXxA)
Crypto Express 4 up to 7 EP11 Coprocessor (CEXxP)

Depends on the common code options CRYPTO [=y] && CRYPTO_HW.

CONFIG_ZLIB_DFLTCC

Enable s390x hardware support for zlib in the kernel.