Commit Graph

391 Commits

Author SHA1 Message Date
Martin Weinelt
3ee206291a
linux: enable BPF_UNPRIV_DEFAULT_OFF between 5.10 and 5.15
Disable unprivileged access to BPF syscalls to prevent denial of service
and privilege escalation via

a) potential speculative execution side-channel-attacks on unmitigated
hardware[0]

or

b) unvalidated memory access in ringbuffer helper functions[1].

Fixes: CVE-2021-4204, CVE-2022-23222

[0] https://ebpf.io/summit-2021-slides/eBPF_Summit_2021-Keynote-Daniel_Borkmann-BPF_and_Spectre.pdf
[1] https://www.openwall.com/lists/oss-security/2022/01/13/1
2022-01-15 23:44:19 +01:00
Bernardo Meurer
5f36161ae1
linuxKernel.kernels: mark {IO_,}STRICT_DEVMEM optional to unbreak hardened kernels 2022-01-10 17:49:30 -03:00
Bernardo Meurer
c1376aedd7
linuxKernel.kernels: also enable SND_SOC_SOF_INTEL_SOUNDWIRE_LINK between 5.10-5.11 2022-01-10 11:15:24 -03:00
Brandon Weeks
8f200e0e38 linux: enable IO_STRICT_DEVMEM 2022-01-09 21:34:42 -08:00
Bernardo Meurer
501a2c13cc
Merge pull request #154181 from brandonweeks/debug_list 2022-01-10 04:48:21 +00:00
Nelson Jeppesen
935303fd36 linux config: SND_SOC_INTEL_SOUNDWIRE_SOF_MACH >= 5.10
Enable for SND_SOC_INTEL_SOUNDWIRE_SOF_MACH kernel module. This is used
on some 10/11th gen Intel laptops such as the XPS 17 97[00|10]

Enable SND_SOC_INTEL_USER_FRIENDLY_LONG_NAMES as well - this is required dep
2022-01-09 19:28:24 -08:00
Brandon Weeks
b39c01b69c linux: enable DEBUG_LIST 2022-01-09 11:46:32 -08:00
github-actions[bot]
0d3fe41724
Merge master into staging-next 2022-01-05 18:01:06 +00:00
Vincent Haupert
8bedcacaf1 linux: enable X86_SGX{_KVM} on x86_64 only
The config option X86_SGX is available on x86_64-linux only; i686-linux
is not supported.

https://github.com/torvalds/linux/blob/55a677b/arch/x86/Kconfig#L1914
2022-01-05 00:36:55 +01:00
Dmitry Kalinkin
2ddda43924
Merge branch 'staging' into staging-next
Conflicts:
	pkgs/os-specific/linux/kernel/common-config.nix
2021-12-25 17:16:26 -05:00
github-actions[bot]
b7f2d2da61
Merge master into staging-next 2021-12-24 00:01:44 +00:00
Linus Heckemann
588db2a720 linux: enable FSL_MC_UAPI_SUPPORT 2021-12-18 00:05:49 +01:00
Maciej Krüger
0c287b011e
Merge pull request #145768 from mkg20001/anbox-waydroid-modules 2021-12-03 13:00:58 +01:00
Vincent Haupert
1f65b4c416 linux: enable X86_SGX and X86_SGX_KVM on x86
Enable Intel Software Guard eXtensions (SGX) on x86 when using Linux
5.11.0 or later. Also enable KVM guests to create SGX enclaves if
running Linux 5.13.0 or later.
2021-11-29 08:03:26 +01:00
Jonathan Ringer
4b73049ccc
Merge remote-tracking branch 'origin/staging' into staging-next
Conflicts:
	nixos/tests/custom-ca.nix
2021-11-22 21:33:23 -08:00
Izorkin
8bcc413092 linux: enable kTLS 2021-11-22 21:01:01 +00:00
Artturi
f57a2a6cf1
Merge pull request #144227 from humancalico/bpf-lsm 2021-11-18 03:00:28 +02:00
Matt Votava
c2e142d8ae
linux: CONFIG_ASHMEM=y, CONFIG_ANDROID=y
This enables ashmem, binder so waydroid/anbox works with
the provided linux kernel

Cherry-picked from https://github.com/NixOS/nixpkgs/pull/102341
2021-11-17 23:00:13 +01:00
Maximilian Bosch
61870bd811
Merge pull request #144409 from mitchmindtree/xps-9310-kernel-config
linux: Add kernel config required for QCA6390 bluetooth (XPS 9310)
2021-11-17 18:30:35 +01:00
github-actions[bot]
bc35dc4f3b
Merge master into staging-next 2021-11-14 12:01:23 +00:00
Jörg Thalheim
13dc25bd67
Merge branch 'master' into xps-9310-kernel-config 2021-11-14 11:33:38 +00:00
Jörg Thalheim
2a909594f1
Merge pull request #145827 from ncfavier/mediatek-bluetooth
linux: add BT_HCIBTUSB_MTK to common kernel config
2021-11-14 11:31:33 +00:00
Naïm Favier
3c2c3df181
linux: add BT_HCIBTUSB_MTK to common kernel config
> The MediaTek protocol support enables firmware download support and chip initialization for MediaTek Bluetooth USB controllers.

Necessary to make Bluetooth work on some MediaTek controllers.
2021-11-14 01:13:34 +01:00
github-actions[bot]
9b5a105856
Merge master into staging-next 2021-11-14 00:01:47 +00:00
Austin Seipp
3df74bdd3f kernel: enable core scheduling on 5.14+ kernels
Core scheduling is a recent innovation in newer kernels to help run
certain untrusted compute workloads more safely in the face of
vulnerabilities like Spectre. In short: it lets processes assign a
unique "cookie" to some group of processes to indicate they are allowed
to be scheduled together on the same SMT-capable core. This helps
mitigate attacks that rely on observing usage of CPU execution units by
cohabitated threads.

Some extra details are available via Linux Weekly News:

  "Core scheduling lands in 5.14", https://lwn.net/Articles/861251/

Signed-off-by: Austin Seipp <aseipp@pobox.com>
2021-11-13 17:02:34 -06:00
Akshat Agarwal
972d7e74f6 linux-kernel: enable BPF_LSM
Enables instrumentation of the security hooks with BPF programs for
implementing dynamic MAC and Audit Policies.

The BPF LSM was merged into the Linux kernel 5.7

This has already been enabled in Fedora (version 33 onwards), Ubuntu
(Hirsute Hippo), Flatcar Linux, Arch Linux.

Distros like Ubuntu don't enable bpf in CONFIG_LSM by default to avoid
any performance penalty so similar to that this commit enables
CONFIG_BPF_LSM but doesn't add bpf to the default list in CONFIG_LSM,
users willing to use this feature could boot with the lsm=...bpf
parameter on the kernel

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=641cd7b06c911c5935c34f24850ea18690649917
https://outflux.net/blog/archives/2020/09/21/security-things-in-linux-v5-7/
https://lwn.net/Articles/813057/
https://github.com/flatcar-linux/Flatcar/issues/343
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1905975
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=983329
2021-11-09 16:29:40 +05:30
Bernardo Meurer
9a96e0ec8c
Merge pull request #144641 from jian-lin/enable-TCP_CONG_ADVANCED-on-aarch64
linux: enable TCP_CONG_ADVANCED
2021-11-04 23:31:16 -07:00
linj
555aa76120 linux: enable TCP_CONG_ADVANCED
TCP_CONG_ADVANCED is enabled by default on x86_64[1] in the upstream.
Although it is not the case for aarch64[2], many distributions, such as
Debian[3], Fedora[4] and Gentoo[5], choose to enable it in their
distribution kernel.

With this patch, aarch64 users can choose many other TCP congestion
algorithms, which may improve their network performance.

[1]: 7ddb58cb0e/arch/x86/configs/x86_64_defconfig (L71)
[2]: 7ddb58cb0e/arch/arm64/configs/defconfig
[3]: e2d14375d7/debian/config/config (L7063)
[4]: 836165dd2d/f/kernel-aarch64-fedora.config
[5]: 5808eb2f06/sys-kernel/gentoo-kernel/gentoo-kernel-5.10.77.ebuild (L27)
2021-11-05 03:18:16 +08:00
mitchmindtree
35e4c0d750 linux: Add kernel config required for QCA6390 bluetooth (XPS 9310)
This commit aims to upstream some kernel config patches from the [xps
9310 module in the nixos-hardware repo][1]. These patches have been in
use by at least a few community members for around 10 months and seem to
consistently and successfully enable bluetooth support for XPS 9310
models that come with the QCA6390 connectivity chip.

Without these patches, bluetooth will not work on the Dell XPS 9310
laptop models that come with the QCA6390. *Note that this isn't all XPS
9310 devices, but seems to be all devices shipped with 32GB RAM.*

The motivation for upstreaming is pretty simple: currently we have to
build the entire kernel every time we want to update it, which takes a
good half hour at least on this little laptop :)

The `whenAtLeast` version params were determined via the entries for
each parameter found at https://cateee.net/lkddb (linked for each
below).

Added config parameters:

- `BT_QCA` - provides the `btqca` module.
  https://cateee.net/lkddb/web-lkddb/BT_QCA.html
- `BT_HCIUART_QCA` - required for QCA6390 bluetooth support.
  Requires `BT_HCIUART`, `BT_HCIUART_SERDEV`
  https://cateee.net/lkddb/web-lkddb/BT_HCIUART_QCA.html
- `BT_HCIUART_SERDEV`
  Requires `SERIAL_DEV_BUS`, `BT_HCIUART`
  https://cateee.net/lkddb/web-lkddb/BT_HCIUART_SERDEV.html
- `BT_HCIUART`
  Requires `SERIAL_DEV_BUS`, `TTY`
  https://cateee.net/lkddb/web-lkddb/BT_HCIUART.html
- `SERIAL_DEV_CTRL_TTYPORT`
  Requires `TTY`, `SERIAL_DEV_BUS` != module
  https://cateee.net/lkddb/web-lkddb/SERIAL_DEV_CTRL_TTYPORT.html
- `SERIAL_DEV_BUS`
  https://cateee.net/lkddb/web-lkddb/SERIAL_DEV_BUS.html

Fwiw, these parameters are also set in [the default Arch config][2].

[1]: https://github.com/NixOS/nixos-hardware/blob/master/dell/xps/13-9310/default.nix
[2]: https://github.com/archlinux/svntogit-packages/blob/packages/linux/trunk/config
2021-11-03 17:17:02 +10:00
Martin Weinelt
8f5da907b0 Merge remote-tracking branch 'origin/staging-next' into staging 2021-11-02 23:31:28 +01:00
Justin Sleep
64ae396829 linux: build in Cherryview pinctrl driver
This allows integrated keyboards on Braswell and Cherryview devices to function properly.
2021-10-28 11:53:14 -05:00
github-actions[bot]
f9ab4de694
Merge staging-next into staging 2021-10-22 18:01:54 +00:00
Sandro
367536a15c
Merge pull request #142511 from arcnmx/linux515rc 2021-10-22 15:13:09 +02:00
arcnmx
146c830cff linux_testing: 5.13-rc6 -> 5.15-rc6 2021-10-21 12:29:09 -07:00
Emil Karlson
2ef28fb77d linux: do not build in DRM_SIMPLEDRM on newer kernels
After linux 5.14.11 FB_SIMPLE conflicts with DRM_SIMPLEDRM, which
will fail configuration, when DRM_SIMPLEDRM is configured as a module
and FB_SIMPLE gets requested as builtin.

Do not enable DRM_SIMPLEDRM as a temporary workaround, until good
enough migration path is found.
2021-10-20 13:11:28 +03:00
Emil Karlson
6b7671d4ae kernel: enable EFI initrd loader
Initrd loader is not enabled by default in some aarch64 kernels,
which makes systemd-boot booted kernels fail by default, add this
everywhere, since this is a sane default even when it's already in
some kernel defaults.
2021-10-05 12:28:47 +03:00
Luke Granger-Brown
7002c15677 linuxKernel.kernels.linux_5_13_hardened: fix build
BTF cannot be enabled at the same time as the RANDSTRUCT GCC plugin, so
we need to mark it as optional. Alas.
2021-09-22 22:26:36 +00:00
roblabla
34150f86c0 linux-kernel: Enable BTF
BTF is a new, lightweight debug information format tailored specifically
for the needs of eBPF, allowing eBPF programs to be portable across
various kernel versions, configurations and distributions. This is used
by bpftrace and lots of new eBPF-based tooling to avoid a dependency
on LLVM on the host.

BTF debug information is enabled on all major distributions: Fedora 31+,
RHEL 8.2+, Ubuntu 20.10, Debian 11 and ArchLinux all have enabled it.

Enabling BTF debug information requires adding two new dependencies to
the kernel build: Python3 and pahole. Those will be used to generate the
BTF debugging information.
2021-08-18 10:40:35 +02:00
Sandro
771404c2e9
Merge pull request #130613 from zhaofengli/cros-modules 2021-08-05 16:44:13 +02:00
github-actions[bot]
6b44ad5d59
Merge master into staging-next 2021-08-03 00:01:21 +00:00
Florian Klink
ced7721191 linux: only configure IDE to "no" pre-5.14
When trying to build a 5.14 (rc-*), this fails to build otherwise:

> error: unused option: IDE
2021-08-02 21:21:52 +02:00
Zhaofeng Li
63fb3d8f2d kernel: Enable Chrome platform modules
They were enabled in 5.4 but then removed. Let's enable them explicitly
here. To keep the version constraints simple, we match kernel >5.4 even
though some of them are available since 4.x.
2021-08-01 15:38:49 -07:00
github-actions[bot]
648e4c42d7
Merge master into staging-next 2021-07-31 00:01:13 +00:00
Ben Wolsieffer
988c12faed linux/common-config.nix: disable LPAE on armv7l-linux
LPAE was enabled to support native armv7l builders running in QEMU on aarch64,
but this option disables support for processors which don't support LPAE, which
are still relatively common. In particular, Beaglebones use the Cortex-A8, which
doesn't support LPAE.

Also, if you attempt to boot an LPAE kernel on a CPU that doesn't support it,
it fails before even earlycon is initialized. This makes the problem difficult
to debug without enabling CONFIG_DEBUG_LL or using a hardware debugger.
2021-07-30 15:21:03 -04:00
Bernardo Meurer
5e3d1de727
Merge pull request #130851 from kjeremy/patch-1
kernel: enable MOUSE_PS2_VMMOUSE
2021-07-27 20:29:43 +00:00
Jeremy Kolb
1207e7581f
kernel: enable MOUSE_PS2_VMMOUSE
Turns VMware guest mouse support on in the kernel. This is needed for running Wayland and non-root X in a VMWare guest. In a pre-Wayland world the `xf86-input-vmmouse` userspace driver would have handled this for us. This allows the mouse to properly work in a vmware guest (for example it can now leave the vmware window).

See: https://github.com/vmware/open-vm-tools/issues/528
2021-07-20 15:41:36 -04:00
misuzu
3f63c29812 linux: enable LIRC 2021-07-14 18:20:22 +03:00
roblabla
be03cf01f3 linux-kernel: Add dell drivers on 5.12+ 2021-06-23 16:42:57 +02:00
Lengyel Balázs
2ac508d578 linux-kernel: update config for 5.13 2021-06-14 14:26:52 +02:00
Samuel Dionne-Riel
7264c049c7 linux/common-config.nix: Configure for armv7l-linux too 2021-05-04 19:42:12 -04:00