From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits)) (No client certificate requested) by finch.gentoo.org (Postfix) with ESMTPS id 85479158064 for ; Sun, 5 May 2024 18:06:41 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id BEA9AE2B0B; Sun, 5 May 2024 18:06:40 +0000 (UTC) Received: from smtp.gentoo.org (woodpecker.gentoo.org [140.211.166.183]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits)) (No client certificate requested) by pigeon.gentoo.org (Postfix) with ESMTPS id 7E97CE2B0B for ; Sun, 5 May 2024 18:06:40 +0000 (UTC) Received: from oystercatcher.gentoo.org (oystercatcher.gentoo.org [148.251.78.52]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits)) (No client certificate requested) by smtp.gentoo.org (Postfix) with ESMTPS id 82913343127 for ; Sun, 5 May 2024 18:06:39 +0000 (UTC) Received: from localhost.localdomain (localhost [IPv6:::1]) by oystercatcher.gentoo.org (Postfix) with ESMTP id 1E2321710 for ; Sun, 5 May 2024 18:06:38 +0000 (UTC) From: "Mike Pagano" To: gentoo-commits@lists.gentoo.org Content-Transfer-Encoding: 8bit Content-type: text/plain; charset=UTF-8 Reply-To: gentoo-dev@lists.gentoo.org, "Mike Pagano" Message-ID: <1714932388.6188b97edf588f87d24e35068083a8561d152f91.mpagano@gentoo> Subject: [gentoo-commits] proj/linux-patches:6.6 commit in: / X-VCS-Repository: proj/linux-patches X-VCS-Files: 4567_distro-Gentoo-Kconfig.patch X-VCS-Directories: / X-VCS-Committer: mpagano X-VCS-Committer-Name: Mike Pagano X-VCS-Revision: 6188b97edf588f87d24e35068083a8561d152f91 X-VCS-Branch: 6.6 Date: Sun, 5 May 2024 18:06:38 +0000 (UTC) Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-commits@lists.gentoo.org X-Auto-Response-Suppress: DR, RN, NRN, OOF, AutoReply X-Archives-Salt: 6fac48e0-71d5-4299-b053-25af6c5f5c34 X-Archives-Hash: 1a720ce6f3a1149b1fd303b83fafeaeb commit: 6188b97edf588f87d24e35068083a8561d152f91 Author: Mike Pagano gentoo org> AuthorDate: Sun May 5 17:54:13 2024 +0000 Commit: Mike Pagano gentoo org> CommitDate: Sun May 5 18:06:28 2024 +0000 URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=6188b97e Update to KSPP patch Bug: https://bugs.gentoo.org/930733 Signed-off-by: Mike Pagano gentoo.org> 4567_distro-Gentoo-Kconfig.patch | 33 +++++++++++++++++++++------------ 1 file changed, 21 insertions(+), 12 deletions(-) diff --git a/4567_distro-Gentoo-Kconfig.patch b/4567_distro-Gentoo-Kconfig.patch index 6134393f..87b8fa95 100644 --- a/4567_distro-Gentoo-Kconfig.patch +++ b/4567_distro-Gentoo-Kconfig.patch @@ -6,9 +6,9 @@ source "Documentation/Kconfig" + +source "distro/Kconfig" ---- /dev/null 2024-04-27 13:10:54.188000027 -0400 -+++ b/distro/Kconfig 2024-04-27 17:56:56.723132353 -0400 -@@ -0,0 +1,295 @@ +--- /dev/null 2024-05-05 10:40:37.103999988 -0400 ++++ b/distro/Kconfig 2024-05-05 13:37:37.699554927 -0400 +@@ -0,0 +1,310 @@ +menu "Gentoo Linux" + +config GENTOO_LINUX @@ -178,7 +178,7 @@ + to unmet dependencies. Search for GENTOO_KERNEL_SELF_PROTECTION_COMMON and search for + GENTOO_KERNEL_SELF_PROTECTION_{X86_64, ARM64, X86_32, ARM} for dependency information on your + specific architecture. -+ Note 2: Please see the URL above for numeric settings, e.g. CONFIG_DEFAULT_MMAP_MIN_ADDR=65536 ++ Note 2: Please see the URL above for numeric settings, e.g. CONFIG_DEFAULT_MMAP_MIN_ADDR=65536 + for X86_64 + +if GENTOO_KERNEL_SELF_PROTECTION @@ -201,10 +201,13 @@ + select DEBUG_SG + select HARDENED_USERCOPY if HAVE_HARDENED_USERCOPY_ALLOCATOR=y + select KFENCE if HAVE_ARCH_KFENCE && (!SLAB || SLUB) ++ select PAGE_TABLE_CHECK if ARCH_SUPPORTS_PAGE_TABLE_CHECK=y && EXCLUSIVE_SYSTEM_RAM=y ++ select PAGE_TABLE_CHECK_ENFORCED if PAGE_TABLE_CHECK=y + select RANDOMIZE_KSTACK_OFFSET_DEFAULT if HAVE_ARCH_RANDOMIZE_KSTACK_OFFSET && (INIT_STACK_NONE || !CC_IS_CLANG || CLANG_VERSION>=140000) + select SECURITY_LANDLOCK + select SCHED_CORE if SCHED_SMT + select BUG_ON_DATA_CORRUPTION ++ select RANDOM_KMALLOC_CACHE if SLUB_TINY=n + select SCHED_STACK_END_CHECK + select SECCOMP if HAVE_ARCH_SECCOMP + select SECCOMP_FILTER if HAVE_ARCH_SECCOMP_FILTER @@ -245,11 +248,13 @@ + default n + + select GCC_PLUGIN_STACKLEAK ++ select X86_KERNEL_IBT if CC_HAS_IBT=y && HAVE_OBJTOOL=y && (!LD_IS_LLD=n || LLD_VERSION>=140000) + select LEGACY_VSYSCALL_NONE + select PAGE_TABLE_ISOLATION + select RANDOMIZE_BASE + select RANDOMIZE_MEMORY + select RELOCATABLE ++ select X86_USER_SHADOW_STACK if AS_WRUSS=Y + select VMAP_STACK + + @@ -259,11 +264,21 @@ + depends on ARM64 + default n + -+ select RANDOMIZE_BASE -+ select RELOCATABLE ++ select ARM64_BTI ++ select ARM64_E0PD ++ select ARM64_EPAN if ARM64_PAN=y ++ select ARM64_MTE if (ARM64_AS_HAS_MTE=y && ARM64_TAGGED_ADDR_ABI=y ) && ( AS_HAS_ARMV8_5=y ) && ( AS_HAS_LSE_ATOMICS=y ) && ( ARM64_PAN=y ) ++ select ARM64_PTR_AUTH ++ select ARM64_PTR_AUTH_KERNEL if ( ARM64_PTR_AUTH=y ) && (( CC_HAS_SIGN_RETURN_ADDRESS=y || CC_HAS_BRANCH_PROT_PAC_RET=y ) && AS_HAS_ARMV8_3=y ) && ( LD_IS_LLD=y || LD_VERSION >= 23301 || ( CC_IS_GCC=y && GCC_VERSION < 90100 )) && (CC_IS_CLANG=n || AS_HAS_CFI_NEGATE_RA_STATE=y ) && ((FUNCTION_GRAPH_TRACER=n || DYNAMIC_FTRACE_WITH_ARGS=y )) ++ select ARM64_BTI_KERNEL if ( ARM64_BTI=y ) && ( ARM64_PTR_AUTH_KERNEL=y ) && ( CC_HAS_BRANCH_PROT_PAC_RET_BTI=y ) && (CC_IS_GCC=n || GCC_VERSION >= 100100 ) && (CC_IS_GCC=n ) && ((FUNCTION_GRAPH_TRACE=n || DYNAMIC_FTRACE_WITH_ARG=y )) + select ARM64_SW_TTBR0_PAN + select CONFIG_UNMAP_KERNEL_AT_EL0 + select GCC_PLUGIN_STACKLEAK ++ select KASAN_HW_TAGS if HAVE_ARCH_KASAN_HW_TAGS=y ++ select RANDOMIZE_BASE ++ select RELOCATABLE ++ select SHADOW_CALL_STACK if ARCH_SUPPORTS_SHADOW_CALL_STACK=y && (DYNAMIC_FTRACE_WITH_ARGS=y || DYNAMIC_FTRACE_WITH_REGS=y || FUNCTION_GRAPH_TRACER=n) && MMU=y ++ select UNWIND_PATCH_PAC_INTO_SCS if (CC_IS_CLANG=y && CLANG_VERSION >= CONFIG_150000 ) && ( ARM64_PTR_AUTH_KERNEL=y && CC_HAS_BRANCH_PROT_PAC_RET=y ) && ( SHADOW_CALL_STACK=y ) + select VMAP_STACK + +config GENTOO_KERNEL_SELF_PROTECTION_X86_32 @@ -304,12 +319,6 @@ + See the settings that become available for more details and fine-tuning. + +endmenu -From bd3ff0b16792c18c0614c2b95e148943209f460a Mon Sep 17 00:00:00 2001 -From: Georgy Yakovlev -Date: Tue, 8 Jun 2021 13:59:57 -0700 -Subject: [PATCH 2/2] set DEFAULT_MMAP_MIN_ADDR by default - ---- mm/Kconfig | 2 ++ 1 file changed, 2 insertions(+)