diff --git a/.gitignore b/.gitignore index 0febd4a..1b185a1 100644 --- a/.gitignore +++ b/.gitignore @@ -1,4 +1,5 @@ apploader/conf/local.yml cvmassistants/quote-generator/target +guest-kernel/tdx/linux .vscode diff --git a/cvmassistants/firewall/setfirewall.sh b/cvmassistants/firewall/setfirewall.sh index 20555ba..9247cbd 100644 --- a/cvmassistants/firewall/setfirewall.sh +++ b/cvmassistants/firewall/setfirewall.sh @@ -9,7 +9,8 @@ # Requirements: # - Must be run as root # - Must run on Ubuntu -# - iptables and UFW must be installed +# - UFW must be installed +# - Uses nftables backend (modern approach) # ############################################################################### @@ -33,13 +34,13 @@ if ! grep -q "ID=ubuntu" /etc/os-release; then log_fatal "This script supports only Ubuntu. Aborting." fi -# Load ip_tables module -log_info "Loading ip_tables module..." -modprobe ip_tables 2>/dev/null +# Load nftables modules (if not built-in) +log_info "Loading nftables modules..." +modprobe nf_tables 2>/dev/null if [ $? -ne 0 ]; then - log_warn "Could not load ip_tables (module missing or already loaded)." + log_warn "Could not load nf_tables (module missing or already loaded)." else - log_info "ip_tables loaded successfully." + log_info "nf_tables loaded successfully." fi # Enable UFW diff --git a/guest-kernel/ReadMe.md b/guest-kernel/ReadMe.md new file mode 100644 index 0000000..6dcadb0 --- /dev/null +++ b/guest-kernel/ReadMe.md @@ -0,0 +1,34 @@ +# Guest Kernel + +This folder contains the build scripts and configuration for building a TDX-enabled guest kernel. + +## Building the Kernel + +To build the kernel, execute the build script from the `guest-kernel` directory: + +```bash +cd tdx +./build.sh +``` + +The script will: +1. Clone the Ubuntu HWE 6.17 kernel source (with RTMR extend built-in) +2. Apply the TDX configuration +3. Enable required kernel options (TDX guest, VSOCK, netfilter, dm-crypt, etc.) +4. Compile the kernel + +## Kernel Image Location + +After a successful build, the kernel image can be found at: + +``` +linux/arch/x86/boot/bzImage +``` + +## Make the kernel image exploitable by Conker + +``` +cp linux/arch/x86/boot/bzImage /opt/cvm/kernel +cd /opt/cvm/kernel +mv bzImage bzImage-hwe-6.17-next +``` \ No newline at end of file diff --git a/guest-kernel/tdx/build.sh b/guest-kernel/tdx/build.sh index 8b9f509..082df12 100644 --- a/guest-kernel/tdx/build.sh +++ b/guest-kernel/tdx/build.sh @@ -1,22 +1,53 @@ set -e -git clone -b master --single-branch --depth 1 https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/noble linux + +# Clone Ubuntu HWE 6.17 (has RTMR extend built-in) +git clone -b hwe-6.17-next --single-branch --depth 1 \ + https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/noble linux + cd linux -cp ../config .config +cp ../tdx/config .config apt install -y libelf-dev zstd flex bison libssl-dev bc -# virt coco，for enable tdx and sev +# virt coco，for enable tdx +./scripts/config --enable CONFIG_VIRT_DRIVERS # important to enable: parent menu that gates all confidential computing drivers ./scripts/config --enable CONFIG_EFI_SECRET ./scripts/config --enable CONFIG_INTEL_TDX_GUEST -./scripts/config --enable CONFIG_SEV_GUEST ./scripts/config --enable CONFIG_TDX_GUEST_DRIVER #enable dmcrypt for encrypt disk ./scripts/config --enable CONFIG_DM_CRYPT - #enable ramfs and initrd for all in ram ./scripts/config --enable CONFIG_BLK_DEV_INITRD ./scripts/config --enable CONFIG_BLK_DEV_RAM +# VSOCK modules +./scripts/config --enable CONFIG_VSOCKETS # required for communication with QGS (quote generation) +./scripts/config --enable CONFIG_VIRTIO_VSOCKETS +./scripts/config --enable CONFIG_VIRTIO_VSOCKETS_COMMON +./scripts/config --enable CONFIG_VSOCKETS_LOOPBACK +# Netfilter / nftables (IPv4 only, for ufw with iptables-nft backend) +./scripts/config --enable CONFIG_NETFILTER +./scripts/config --enable CONFIG_NETFILTER_ADVANCED +./scripts/config --enable CONFIG_NETFILTER_XTABLES +./scripts/config --enable CONFIG_NF_CONNTRACK +./scripts/config --enable CONFIG_NF_TABLES +./scripts/config --enable CONFIG_NFT_COMPAT +./scripts/config --enable CONFIG_NFT_CT +./scripts/config --enable CONFIG_NFT_LOG +./scripts/config --enable CONFIG_NFT_LIMIT +./scripts/config --enable CONFIG_NFT_NAT +./scripts/config --enable CONFIG_NFT_MASQ +./scripts/config --enable CONFIG_NFT_REDIR +./scripts/config --enable CONFIG_NFT_REJECT +./scripts/config --enable CONFIG_NFT_FIB +# IPv4 nftables +./scripts/config --enable CONFIG_NF_TABLES_IPV4 +./scripts/config --enable CONFIG_NFT_REJECT_IPV4 +./scripts/config --enable CONFIG_NFT_FIB_IPV4 +./scripts/config --enable CONFIG_NFT_DUP_IPV4 +./scripts/config --enable CONFIG_NF_NAT +./scripts/config --enable CONFIG_IP_NF_IPTABLES +./scripts/config --enable CONFIG_IP_NF_TARGET_REJECT +./scripts/config --enable CONFIG_IP_NF_TARGET_MASQUERADE yes "" | make olddefconfig -make -j$(nproc) bzImage - +make -j$(nproc) bzImage diff --git a/guest-kernel/tdx/config b/guest-kernel/tdx/config index 17badd9..eac5b5b 100644 --- a/guest-kernel/tdx/config +++ b/guest-kernel/tdx/config @@ -1,24 +1,30 @@ # # Automatically generated file; DO NOT EDIT. -# Linux/x86 6.8.4 Kernel Configuration +# Linux/x86 6.17.2 Kernel Configuration # -CONFIG_CC_VERSION_TEXT="gcc (Ubuntu 13.2.0-23ubuntu4) 13.2.0" +CONFIG_CC_VERSION_TEXT="gcc (Ubuntu 13.3.0-6ubuntu2~24.04) 13.3.0" CONFIG_CC_IS_GCC=y -CONFIG_GCC_VERSION=130200 +CONFIG_GCC_VERSION=130300 CONFIG_CLANG_VERSION=0 CONFIG_AS_IS_GNU=y CONFIG_AS_VERSION=24200 CONFIG_LD_IS_BFD=y CONFIG_LD_VERSION=24200 CONFIG_LLD_VERSION=0 +CONFIG_RUSTC_VERSION=109101 +CONFIG_RUSTC_LLVM_VERSION=210102 CONFIG_CC_CAN_LINK=y -CONFIG_CC_CAN_LINK_STATIC=y CONFIG_CC_HAS_ASM_GOTO_OUTPUT=y CONFIG_CC_HAS_ASM_GOTO_TIED_OUTPUT=y -CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND=y CONFIG_TOOLS_SUPPORT_RELR=y CONFIG_CC_HAS_ASM_INLINE=y CONFIG_CC_HAS_NO_PROFILE_FN_ATTR=y +CONFIG_LD_CAN_USE_KEEP_IN_OVERLAY=y +CONFIG_RUSTC_HAS_COERCE_POINTEE=y +CONFIG_RUSTC_HAS_SPAN_FILE=y +CONFIG_RUSTC_HAS_UNNECESSARY_TRANSMUTES=y +CONFIG_RUSTC_HAS_FILE_WITH_NUL=y +CONFIG_RUSTC_HAS_FILE_AS_C_STR=y CONFIG_PAHOLE_VERSION=0 CONFIG_IRQ_WORK=y CONFIG_BUILDTIME_TABLE_SORT=y @@ -56,7 +62,6 @@ CONFIG_POSIX_MQUEUE=y CONFIG_POSIX_MQUEUE_SYSCTL=y # CONFIG_WATCH_QUEUE is not set # CONFIG_CROSS_MEMORY_ATTACH is not set -# CONFIG_USELIB is not set CONFIG_AUDIT=y CONFIG_HAVE_ARCH_AUDITSYSCALL=y CONFIG_AUDITSYSCALL=y @@ -81,10 +86,10 @@ CONFIG_SPARSE_IRQ=y CONFIG_CLOCKSOURCE_WATCHDOG=y CONFIG_ARCH_CLOCKSOURCE_INIT=y -CONFIG_CLOCKSOURCE_VALIDATE_LAST_CYCLE=y CONFIG_GENERIC_TIME_VSYSCALL=y CONFIG_GENERIC_CLOCKEVENTS=y CONFIG_GENERIC_CLOCKEVENTS_BROADCAST=y +CONFIG_GENERIC_CLOCKEVENTS_BROADCAST_IDLE=y CONFIG_GENERIC_CLOCKEVENTS_MIN_ADJUST=y CONFIG_GENERIC_CMOS_UPDATE=y CONFIG_HAVE_POSIX_CPU_TIMERS_TASK_WORK=y @@ -103,6 +108,7 @@ CONFIG_NO_HZ_IDLE=y # CONFIG_NO_HZ is not set # CONFIG_HIGH_RES_TIMERS is not set CONFIG_CLOCKSOURCE_WATCHDOG_MAX_SKEW_US=100 +# CONFIG_POSIX_AUX_CLOCKS is not set # end of Timers subsystem CONFIG_BPF=y @@ -113,12 +119,16 @@ CONFIG_ARCH_WANT_DEFAULT_BPF_JIT=y # BPF subsystem # # CONFIG_BPF_SYSCALL is not set +# CONFIG_BPF_JIT is not set # end of BPF subsystem CONFIG_PREEMPT_NONE_BUILD=y +CONFIG_ARCH_HAS_PREEMPT_LAZY=y CONFIG_PREEMPT_NONE=y # CONFIG_PREEMPT_VOLUNTARY is not set # CONFIG_PREEMPT is not set +# CONFIG_PREEMPT_LAZY is not set +# CONFIG_PREEMPT_RT is not set # CONFIG_PREEMPT_DYNAMIC is not set # CONFIG_SCHED_CORE is not set @@ -155,6 +165,7 @@ CONFIG_HAVE_UNSTABLE_SCHED_CLOCK=y # # Scheduler features # +# CONFIG_SCHED_PROXY_EXEC is not set # end of Scheduler features CONFIG_ARCH_SUPPORTS_NUMA_BALANCING=y @@ -166,23 +177,28 @@ CONFIG_CC_NO_ARRAY_BOUNDS=y CONFIG_GCC_NO_STRINGOP_OVERFLOW=y CONFIG_CC_NO_STRINGOP_OVERFLOW=y CONFIG_ARCH_SUPPORTS_INT128=y +CONFIG_SLAB_OBJ_EXT=y CONFIG_CGROUPS=y CONFIG_PAGE_COUNTER=y # CONFIG_CGROUP_FAVOR_DYNMODS is not set CONFIG_MEMCG=y -CONFIG_MEMCG_KMEM=y +# CONFIG_MEMCG_V1 is not set CONFIG_BLK_CGROUP=y CONFIG_CGROUP_WRITEBACK=y CONFIG_CGROUP_SCHED=y +CONFIG_GROUP_SCHED_WEIGHT=y +CONFIG_GROUP_SCHED_BANDWIDTH=y CONFIG_FAIR_GROUP_SCHED=y CONFIG_CFS_BANDWIDTH=y CONFIG_RT_GROUP_SCHED=y +# CONFIG_RT_GROUP_SCHED_DEFAULT_DISABLED is not set # CONFIG_CGROUP_PIDS is not set # CONFIG_CGROUP_RDMA is not set +# CONFIG_CGROUP_DMEM is not set CONFIG_CGROUP_FREEZER=y CONFIG_CGROUP_HUGETLB=y CONFIG_CPUSETS=y -CONFIG_PROC_PID_CPUSET=y +# CONFIG_CPUSETS_V1 is not set CONFIG_CGROUP_DEVICE=y CONFIG_CGROUP_CPUACCT=y CONFIG_CGROUP_PERF=y @@ -216,19 +232,20 @@ CONFIG_LD_ORPHAN_WARN=y CONFIG_LD_ORPHAN_WARN_LEVEL="warn" CONFIG_SYSCTL=y CONFIG_SYSCTL_EXCEPTION_TRACE=y +# CONFIG_SYSFS_SYSCALL is not set CONFIG_HAVE_PCSPKR_PLATFORM=y CONFIG_EXPERT=y CONFIG_MULTIUSER=y # CONFIG_SGETMASK_SYSCALL is not set -# CONFIG_SYSFS_SYSCALL is not set CONFIG_FHANDLE=y CONFIG_POSIX_TIMERS=y CONFIG_PRINTK=y CONFIG_BUG=y # CONFIG_PCSPKR_PLATFORM is not set -CONFIG_BASE_FULL=y +# CONFIG_BASE_SMALL is not set CONFIG_FUTEX=y CONFIG_FUTEX_PI=y +CONFIG_FUTEX_PRIVATE_HASH=y CONFIG_EPOLL=y CONFIG_SIGNALFD=y CONFIG_TIMERFD=y @@ -236,14 +253,15 @@ CONFIG_EVENTFD=y CONFIG_SHMEM=y CONFIG_AIO=y CONFIG_IO_URING=y +# CONFIG_IO_URING_MOCK_FILE is not set CONFIG_ADVISE_SYSCALLS=y CONFIG_MEMBARRIER=y # CONFIG_KCMP is not set # CONFIG_RSEQ is not set CONFIG_CACHESTAT_SYSCALL=y -# CONFIG_PC104 is not set # CONFIG_KALLSYMS is not set CONFIG_ARCH_HAS_MEMBARRIER_SYNC_CORE=y +CONFIG_ARCH_SUPPORTS_MSEAL_SYSTEM_MAPPINGS=y CONFIG_HAVE_PERF_EVENTS=y # @@ -260,7 +278,7 @@ CONFIG_PERF_EVENTS=y # # CONFIG_KEXEC is not set # CONFIG_KEXEC_FILE is not set -# CONFIG_CRASH_DUMP is not set +# CONFIG_KEXEC_HANDOVER is not set # end of Kexec and crash features # end of General setup @@ -287,8 +305,7 @@ CONFIG_X86_64_SMP=y CONFIG_ARCH_SUPPORTS_UPROBES=y CONFIG_FIX_EARLYCON_MEM=y CONFIG_DYNAMIC_PHYSICAL_MASK=y -CONFIG_PGTABLE_LEVELS=4 -CONFIG_CC_HAS_SANE_STACKPROTECTOR=y +CONFIG_PGTABLE_LEVELS=5 # # Processor type and features @@ -296,8 +313,7 @@ CONFIG_CC_HAS_SANE_STACKPROTECTOR=y CONFIG_SMP=y CONFIG_X86_X2APIC=y # CONFIG_X86_MPPARSE is not set -# CONFIG_GOLDFISH is not set -# CONFIG_X86_CPU_RESCTRL is not set +# CONFIG_X86_FRED is not set # CONFIG_X86_EXTENDED_PLATFORM is not set # CONFIG_X86_INTEL_LPSS is not set # CONFIG_X86_AMD_PLATFORM_DEVICE is not set @@ -318,19 +334,13 @@ CONFIG_PARAVIRT_CLOCK=y # CONFIG_JAILHOUSE_GUEST is not set # CONFIG_ACRN_GUEST is not set CONFIG_INTEL_TDX_GUEST=y -# CONFIG_MK8 is not set -# CONFIG_MPSC is not set -CONFIG_MCORE2=y -# CONFIG_MATOM is not set -# CONFIG_GENERIC_CPU is not set +CONFIG_CC_HAS_MARCH_NATIVE=y +# CONFIG_X86_NATIVE_CPU is not set CONFIG_X86_INTERNODE_CACHE_SHIFT=6 CONFIG_X86_L1_CACHE_SHIFT=6 -CONFIG_X86_INTEL_USERCOPY=y -CONFIG_X86_USE_PPRO_CHECKSUM=y -CONFIG_X86_P6_NOP=y CONFIG_X86_TSC=y CONFIG_X86_HAVE_PAE=y -CONFIG_X86_CMPXCHG64=y +CONFIG_X86_CX8=y CONFIG_X86_CMOV=y CONFIG_X86_MINIMUM_CPU_FAMILY=64 CONFIG_X86_DEBUGCTLMSR=y @@ -353,11 +363,14 @@ CONFIG_SCHED_CLUSTER=y CONFIG_SCHED_SMT=y # CONFIG_SCHED_MC is not set CONFIG_X86_LOCAL_APIC=y +CONFIG_ACPI_MADT_WAKEUP=y CONFIG_X86_IO_APIC=y # CONFIG_X86_REROUTE_FOR_BROKEN_BOOT_IRQS is not set CONFIG_X86_MCE=y # CONFIG_X86_MCELOG_LEGACY is not set # CONFIG_X86_MCE_INTEL is not set +CONFIG_X86_MCE_AMD=y +CONFIG_X86_MCE_THRESHOLD=y # # Performance monitoring @@ -373,7 +386,6 @@ CONFIG_MICROCODE=y # CONFIG_MICROCODE_LATE_LOADING is not set # CONFIG_X86_MSR is not set # CONFIG_X86_CPUID is not set -# CONFIG_X86_5LEVEL is not set CONFIG_X86_DIRECT_GBPAGES=y CONFIG_X86_MEM_ENCRYPT=y # CONFIG_NUMA is not set @@ -388,6 +400,7 @@ CONFIG_CC_HAS_IBT=y CONFIG_X86_CET=y CONFIG_X86_KERNEL_IBT=y # CONFIG_X86_INTEL_MEMORY_PROTECTION_KEYS is not set +CONFIG_ARCH_PKEY_BITS=4 CONFIG_X86_INTEL_TSX_MODE_OFF=y # CONFIG_X86_INTEL_TSX_MODE_ON is not set # CONFIG_X86_INTEL_TSX_MODE_AUTO is not set @@ -397,7 +410,6 @@ CONFIG_EFI=y CONFIG_EFI_STUB=y CONFIG_EFI_HANDOVER_PROTOCOL=y # CONFIG_EFI_MIXED is not set -# CONFIG_EFI_FAKE_MEMMAP is not set # CONFIG_EFI_RUNTIME_MAP is not set CONFIG_HZ_100=y # CONFIG_HZ_250 is not set @@ -411,17 +423,17 @@ CONFIG_ARCH_SUPPORTS_KEXEC_SIG=y CONFIG_ARCH_SUPPORTS_KEXEC_SIG_FORCE=y CONFIG_ARCH_SUPPORTS_KEXEC_BZIMAGE_VERIFY_SIG=y CONFIG_ARCH_SUPPORTS_KEXEC_JUMP=y +CONFIG_ARCH_SUPPORTS_KEXEC_HANDOVER=y CONFIG_ARCH_SUPPORTS_CRASH_DUMP=y +CONFIG_ARCH_DEFAULT_CRASH_DUMP=y CONFIG_ARCH_SUPPORTS_CRASH_HOTPLUG=y CONFIG_PHYSICAL_START=0x1000000 CONFIG_RELOCATABLE=y CONFIG_RANDOMIZE_BASE=y CONFIG_X86_NEED_RELOCS=y CONFIG_PHYSICAL_ALIGN=0x200000 -CONFIG_DYNAMIC_MEMORY_LAYOUT=y CONFIG_RANDOMIZE_MEMORY=y CONFIG_RANDOMIZE_MEMORY_PHYSICAL_PADDING=0x0 -# CONFIG_ADDRESS_MASKING is not set CONFIG_HOTPLUG_CPU=y # CONFIG_LEGACY_VSYSCALL_XONLY is not set CONFIG_LEGACY_VSYSCALL_NONE=y @@ -431,8 +443,12 @@ CONFIG_CMDLINE="console=hvc0 earlyprintk=ttyS0" # CONFIG_MODIFY_LDT_SYSCALL is not set CONFIG_STRICT_SIGALTSTACK_SIZE=y CONFIG_HAVE_LIVEPATCH=y +CONFIG_X86_BUS_LOCK_DETECT=y # end of Processor type and features +CONFIG_CC_HAS_NAMED_AS=y +CONFIG_CC_HAS_NAMED_AS_FIXED_SANITIZERS=y +CONFIG_USE_X86_SEG_SUPPORT=y CONFIG_CC_HAS_SLS=y CONFIG_CC_HAS_RETURN_THUNK=y CONFIG_CC_HAS_ENTRY_PADDING=y @@ -442,19 +458,27 @@ CONFIG_CALL_PADDING=y CONFIG_HAVE_CALL_THUNKS=y CONFIG_CALL_THUNKS=y CONFIG_PREFIX_SYMBOLS=y -CONFIG_SPECULATION_MITIGATIONS=y -CONFIG_PAGE_TABLE_ISOLATION=y -CONFIG_RETPOLINE=y -CONFIG_RETHUNK=y -CONFIG_CALL_DEPTH_TRACKING=y +CONFIG_CPU_MITIGATIONS=y +CONFIG_MITIGATION_PAGE_TABLE_ISOLATION=y +CONFIG_MITIGATION_RETPOLINE=y +CONFIG_MITIGATION_RETHUNK=y +CONFIG_MITIGATION_CALL_DEPTH_TRACKING=y # CONFIG_CALL_THUNKS_DEBUG is not set -CONFIG_CPU_IBRS_ENTRY=y -# CONFIG_SLS is not set -# CONFIG_GDS_FORCE_MITIGATION is not set +CONFIG_MITIGATION_IBRS_ENTRY=y +# CONFIG_MITIGATION_SLS is not set +CONFIG_MITIGATION_GDS=y CONFIG_MITIGATION_RFDS=y -CONFIG_SPECTRE_BHI_ON=y -# CONFIG_SPECTRE_BHI_OFF is not set -# CONFIG_SPECTRE_BHI_AUTO is not set +CONFIG_MITIGATION_SPECTRE_BHI=y +CONFIG_MITIGATION_MDS=y +CONFIG_MITIGATION_TAA=y +CONFIG_MITIGATION_MMIO_STALE_DATA=y +CONFIG_MITIGATION_L1TF=y +CONFIG_MITIGATION_RETBLEED=y +CONFIG_MITIGATION_SPECTRE_V1=y +CONFIG_MITIGATION_SPECTRE_V2=y +CONFIG_MITIGATION_SRBDS=y +CONFIG_MITIGATION_SSB=y +CONFIG_MITIGATION_ITS=y CONFIG_ARCH_HAS_ADD_PAGES=y # @@ -473,6 +497,7 @@ CONFIG_ACPI_SYSTEM_POWER_STATES_SUPPORT=y # CONFIG_ACPI_FPDT is not set CONFIG_ACPI_LPIT=y # CONFIG_ACPI_REV_OVERRIDE_POSSIBLE is not set +CONFIG_ACPI_EC=y # CONFIG_ACPI_EC_DEBUGFS is not set # CONFIG_ACPI_AC is not set # CONFIG_ACPI_BATTERY is not set @@ -499,6 +524,7 @@ CONFIG_HAVE_ACPI_APEI_NMI=y # CONFIG_ACPI_CONFIGFS is not set # CONFIG_ACPI_PFRUT is not set # CONFIG_ACPI_FFH is not set +CONFIG_ACPI_MRRM=y # CONFIG_PMIC_OPREGION is not set # CONFIG_ACPI_PRMT is not set # CONFIG_X86_PM_TIMER is not set @@ -528,7 +554,6 @@ CONFIG_INTEL_IDLE=y # CONFIG_PCI_DIRECT=y # CONFIG_PCI_MMCONFIG is not set -# CONFIG_PCI_CNB20LE_QUIRK is not set # CONFIG_ISA_BUS is not set # CONFIG_ISA_DMA_API is not set # end of Bus options (PCI etc.) @@ -540,14 +565,43 @@ CONFIG_PCI_DIRECT=y # CONFIG_X86_X32_ABI is not set # end of Binary Emulations -CONFIG_HAVE_KVM=y CONFIG_VIRTUALIZATION=y +# CONFIG_KVM is not set +CONFIG_X86_REQUIRED_FEATURE_ALWAYS=y +CONFIG_X86_REQUIRED_FEATURE_NOPL=y +CONFIG_X86_REQUIRED_FEATURE_CX8=y +CONFIG_X86_REQUIRED_FEATURE_CMOV=y +CONFIG_X86_REQUIRED_FEATURE_CPUID=y +CONFIG_X86_REQUIRED_FEATURE_FPU=y +CONFIG_X86_REQUIRED_FEATURE_PAE=y +CONFIG_X86_REQUIRED_FEATURE_PSE=y +CONFIG_X86_REQUIRED_FEATURE_PGE=y +CONFIG_X86_REQUIRED_FEATURE_MSR=y +CONFIG_X86_REQUIRED_FEATURE_FXSR=y +CONFIG_X86_REQUIRED_FEATURE_XMM=y +CONFIG_X86_REQUIRED_FEATURE_XMM2=y +CONFIG_X86_REQUIRED_FEATURE_LM=y +CONFIG_X86_DISABLED_FEATURE_VME=y +CONFIG_X86_DISABLED_FEATURE_K6_MTRR=y +CONFIG_X86_DISABLED_FEATURE_CYRIX_ARR=y +CONFIG_X86_DISABLED_FEATURE_CENTAUR_MCR=y +CONFIG_X86_DISABLED_FEATURE_PKU=y +CONFIG_X86_DISABLED_FEATURE_OSPKE=y +CONFIG_X86_DISABLED_FEATURE_UNRET=y +CONFIG_X86_DISABLED_FEATURE_LAM=y +CONFIG_X86_DISABLED_FEATURE_ENQCMD=y +CONFIG_X86_DISABLED_FEATURE_SGX=y +CONFIG_X86_DISABLED_FEATURE_XENPV=y +CONFIG_X86_DISABLED_FEATURE_USER_SHSTK=y +CONFIG_X86_DISABLED_FEATURE_FRED=y +CONFIG_X86_DISABLED_FEATURE_SEV_SNP=y +CONFIG_X86_DISABLED_FEATURE_INVLPGB=y CONFIG_AS_AVX512=y -CONFIG_AS_SHA1_NI=y -CONFIG_AS_SHA256_NI=y -CONFIG_AS_TPAUSE=y CONFIG_AS_GFNI=y +CONFIG_AS_VAES=y +CONFIG_AS_VPCLMULQDQ=y CONFIG_AS_WRUSS=y +CONFIG_ARCH_CONFIGURES_CPU_MITIGATIONS=y # # General architecture-dependent options @@ -558,7 +612,10 @@ CONFIG_HOTPLUG_CORE_SYNC_DEAD=y CONFIG_HOTPLUG_CORE_SYNC_FULL=y CONFIG_HOTPLUG_SPLIT_STARTUP=y CONFIG_HOTPLUG_PARALLEL=y +CONFIG_GENERIC_IRQ_ENTRY=y +CONFIG_GENERIC_SYSCALL=y CONFIG_GENERIC_ENTRY=y +# CONFIG_KPROBES is not set # CONFIG_JUMP_LABEL is not set # CONFIG_STATIC_CALL_SELFTEST is not set CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS=y @@ -600,8 +657,10 @@ CONFIG_HAVE_ARCH_JUMP_LABEL_RELATIVE=y CONFIG_MMU_GATHER_TABLE_FREE=y CONFIG_MMU_GATHER_RCU_TABLE_FREE=y CONFIG_MMU_GATHER_MERGE_VMAS=y +CONFIG_ARCH_WANT_IRQS_OFF_ACTIVATE_MM=y CONFIG_MMU_LAZY_TLB_REFCOUNT=y CONFIG_ARCH_HAVE_NMI_SAFE_CMPXCHG=y +CONFIG_ARCH_HAVE_EXTRA_ELF_NOTES=y CONFIG_ARCH_HAS_NMI_SAFE_THIS_CPU_OPS=y CONFIG_HAVE_ALIGNED_STRUCT_PAGE=y CONFIG_HAVE_CMPXCHG_LOCAL=y @@ -611,12 +670,14 @@ CONFIG_HAVE_ARCH_SECCOMP_FILTER=y CONFIG_SECCOMP=y CONFIG_SECCOMP_FILTER=y # CONFIG_SECCOMP_CACHE_DEBUG is not set -CONFIG_HAVE_ARCH_STACKLEAK=y +CONFIG_HAVE_ARCH_KSTACK_ERASE=y CONFIG_HAVE_STACKPROTECTOR=y # CONFIG_STACKPROTECTOR is not set CONFIG_ARCH_SUPPORTS_LTO_CLANG=y CONFIG_ARCH_SUPPORTS_LTO_CLANG_THIN=y CONFIG_LTO_NONE=y +CONFIG_ARCH_SUPPORTS_AUTOFDO_CLANG=y +CONFIG_ARCH_SUPPORTS_PROPELLER_CLANG=y CONFIG_ARCH_SUPPORTS_CFI_CLANG=y CONFIG_HAVE_ARCH_WITHIN_STACK_FRAMES=y CONFIG_HAVE_CONTEXT_TRACKING_USER=y @@ -641,8 +702,11 @@ CONFIG_ARCH_HAS_ELF_RANDOMIZE=y CONFIG_HAVE_ARCH_MMAP_RND_BITS=y CONFIG_HAVE_EXIT_THREAD=y CONFIG_ARCH_MMAP_RND_BITS=28 +CONFIG_HAVE_PAGE_SIZE_4KB=y +CONFIG_PAGE_SIZE_4KB=y CONFIG_PAGE_SIZE_LESS_THAN_64KB=y CONFIG_PAGE_SIZE_LESS_THAN_256KB=y +CONFIG_PAGE_SHIFT=12 CONFIG_HAVE_OBJTOOL=y CONFIG_HAVE_JUMP_LABEL_HACK=y CONFIG_HAVE_NOINSTR_HACK=y @@ -651,6 +715,7 @@ CONFIG_HAVE_UACCESS_VALIDATION=y CONFIG_HAVE_STACK_VALIDATION=y CONFIG_HAVE_RELIABLE_STACKTRACE=y # CONFIG_COMPAT_32BIT_TIME is not set +CONFIG_ARCH_SUPPORTS_RT=y CONFIG_HAVE_ARCH_VMAP_STACK=y CONFIG_VMAP_STACK=y CONFIG_HAVE_ARCH_RANDOMIZE_KSTACK_OFFSET=y @@ -674,6 +739,8 @@ CONFIG_ARCH_HAS_PARANOID_L1D_FLUSH=y CONFIG_DYNAMIC_SIGFRAME=y CONFIG_ARCH_HAS_HW_PTE_YOUNG=y CONFIG_ARCH_HAS_NONLEAF_PMD_YOUNG=y +CONFIG_ARCH_HAS_KERNEL_FPU_SUPPORT=y +CONFIG_ARCH_VMLINUX_NEEDS_RELOCS=y # # GCOV-based kernel profiling @@ -685,10 +752,10 @@ CONFIG_HAVE_GCC_PLUGINS=y CONFIG_FUNCTION_ALIGNMENT_4B=y CONFIG_FUNCTION_ALIGNMENT_16B=y CONFIG_FUNCTION_ALIGNMENT=16 +CONFIG_ARCH_HAS_CPU_ATTACK_VECTORS=y # end of General architecture-dependent options CONFIG_RT_MUTEXES=y -CONFIG_BASE_SMALL=0 # CONFIG_MODULES is not set CONFIG_BLOCK=y # CONFIG_BLOCK_LEGACY_AUTOLOAD is not set @@ -698,7 +765,6 @@ CONFIG_BLK_DEV_INTEGRITY=y CONFIG_BLK_DEV_WRITE_MOUNTED=y # CONFIG_BLK_DEV_ZONED is not set CONFIG_BLK_DEV_THROTTLING=y -# CONFIG_BLK_DEV_THROTTLING_LOW is not set # CONFIG_BLK_WBT is not set # CONFIG_BLK_CGROUP_IOLATENCY is not set # CONFIG_BLK_CGROUP_IOCOST is not set @@ -731,8 +797,6 @@ CONFIG_EFI_PARTITION=y # CONFIG_CMDLINE_PARTITION is not set # end of Partition Types -CONFIG_BLK_MQ_PCI=y -CONFIG_BLK_MQ_VIRTIO=y CONFIG_BLOCK_HOLDER_DEPRECATED=y CONFIG_BLK_MQ_STACKING=y @@ -744,6 +808,7 @@ CONFIG_BLK_MQ_STACKING=y # CONFIG_IOSCHED_BFQ is not set # end of IO Schedulers +CONFIG_PADATA=y CONFIG_INLINE_SPIN_UNLOCK_IRQ=y CONFIG_INLINE_READ_UNLOCK=y CONFIG_INLINE_READ_UNLOCK_IRQ=y @@ -782,10 +847,12 @@ CONFIG_SWAP=y # Slab allocator options # CONFIG_SLUB=y +CONFIG_KVFREE_RCU_BATCHED=y # CONFIG_SLUB_TINY is not set CONFIG_SLAB_MERGE_DEFAULT=y # CONFIG_SLAB_FREELIST_RANDOM is not set # CONFIG_SLAB_FREELIST_HARDENED is not set +# CONFIG_SLAB_BUCKETS is not set # CONFIG_SLUB_STATS is not set CONFIG_SLUB_CPU_PARTIAL=y # CONFIG_RANDOM_KMALLOC_CACHES is not set @@ -797,15 +864,18 @@ CONFIG_SPARSEMEM=y CONFIG_SPARSEMEM_EXTREME=y CONFIG_SPARSEMEM_VMEMMAP_ENABLE=y CONFIG_SPARSEMEM_VMEMMAP=y +CONFIG_SPARSEMEM_VMEMMAP_PREINIT=y CONFIG_ARCH_WANT_OPTIMIZE_DAX_VMEMMAP=y CONFIG_ARCH_WANT_OPTIMIZE_HUGETLB_VMEMMAP=y -CONFIG_HAVE_FAST_GUP=y +CONFIG_ARCH_WANT_HUGETLB_VMEMMAP_PREINIT=y +CONFIG_HAVE_GUP_FAST=y CONFIG_EXCLUSIVE_SYSTEM_RAM=y CONFIG_ARCH_ENABLE_MEMORY_HOTPLUG=y # CONFIG_MEMORY_HOTPLUG is not set CONFIG_ARCH_MHP_MEMMAP_ON_MEMORY_ENABLE=y -CONFIG_SPLIT_PTLOCK_CPUS=4 +CONFIG_SPLIT_PTE_PTLOCKS=y CONFIG_ARCH_ENABLE_SPLIT_PMD_PTLOCK=y +CONFIG_SPLIT_PMD_PTLOCKS=y CONFIG_MEMORY_BALLOON=y CONFIG_BALLOON_COMPACTION=y CONFIG_COMPACTION=y @@ -822,26 +892,33 @@ CONFIG_ARCH_SUPPORTS_MEMORY_FAILURE=y # CONFIG_MEMORY_FAILURE is not set CONFIG_ARCH_WANT_GENERAL_HUGETLB=y CONFIG_ARCH_WANTS_THP_SWAP=y +CONFIG_MM_ID=y CONFIG_TRANSPARENT_HUGEPAGE=y # CONFIG_TRANSPARENT_HUGEPAGE_ALWAYS is not set CONFIG_TRANSPARENT_HUGEPAGE_MADVISE=y # CONFIG_TRANSPARENT_HUGEPAGE_NEVER is not set CONFIG_THP_SWAP=y # CONFIG_READ_ONLY_THP_FOR_FS is not set +# CONFIG_NO_PAGE_MAPCOUNT is not set +CONFIG_PAGE_MAPCOUNT=y +CONFIG_PGTABLE_HAS_HUGE_LEAVES=y +CONFIG_ARCH_SUPPORTS_HUGE_PFNMAP=y +CONFIG_ARCH_SUPPORTS_PMD_PFNMAP=y +CONFIG_ARCH_SUPPORTS_PUD_PFNMAP=y CONFIG_NEED_PER_CPU_EMBED_FIRST_CHUNK=y CONFIG_NEED_PER_CPU_PAGE_FIRST_CHUNK=y CONFIG_HAVE_SETUP_PER_CPU_AREA=y # CONFIG_CMA is not set +CONFIG_PAGE_BLOCK_MAX_ORDER=10 CONFIG_GENERIC_EARLY_IOREMAP=y # CONFIG_DEFERRED_STRUCT_PAGE_INIT is not set # CONFIG_IDLE_PAGE_TRACKING is not set CONFIG_ARCH_HAS_CACHE_LINE_SIZE=y CONFIG_ARCH_HAS_CURRENT_STACK_POINTER=y -CONFIG_ARCH_HAS_PTE_DEVMAP=y CONFIG_ARCH_HAS_ZONE_DMA_SET=y # CONFIG_ZONE_DMA is not set CONFIG_ZONE_DMA32=y -# CONFIG_VM_EVENT_COUNTERS is not set +CONFIG_VM_EVENT_COUNTERS=y # CONFIG_PERCPU_STATS is not set # @@ -860,6 +937,9 @@ CONFIG_PTE_MARKER_UFFD_WP=y CONFIG_ARCH_SUPPORTS_PER_VMA_LOCK=y CONFIG_PER_VMA_LOCK=y CONFIG_LOCK_MM_AND_FIND_VMA=y +CONFIG_EXECMEM=y +CONFIG_ARCH_SUPPORTS_PT_RECLAIM=y +CONFIG_PT_RECLAIM=y # # Data Access Monitoring @@ -872,6 +952,7 @@ CONFIG_NET=y CONFIG_NET_INGRESS=y CONFIG_NET_EGRESS=y CONFIG_SKB_EXTENSIONS=y +CONFIG_NET_CRC32C=y # # Networking options @@ -879,7 +960,6 @@ CONFIG_SKB_EXTENSIONS=y CONFIG_PACKET=y # CONFIG_PACKET_DIAG is not set CONFIG_UNIX=y -CONFIG_UNIX_SCM=y CONFIG_AF_UNIX_OOB=y # CONFIG_UNIX_DIAG is not set # CONFIG_TLS is not set @@ -890,6 +970,7 @@ CONFIG_XFRM_USER=y # CONFIG_XFRM_MIGRATE is not set # CONFIG_XFRM_STATISTICS is not set # CONFIG_NET_KEY is not set +# CONFIG_XFRM_IPTFS is not set CONFIG_INET=y # CONFIG_IP_MULTICAST is not set # CONFIG_IP_ADVANCED_ROUTER is not set @@ -930,6 +1011,7 @@ CONFIG_NETFILTER_INGRESS=y CONFIG_NETFILTER_EGRESS=y CONFIG_NETFILTER_NETLINK=y CONFIG_NETFILTER_FAMILY_BRIDGE=y +# CONFIG_NETFILTER_NETLINK_HOOK is not set # CONFIG_NETFILTER_NETLINK_ACCT is not set # CONFIG_NETFILTER_NETLINK_QUEUE is not set CONFIG_NETFILTER_NETLINK_LOG=y @@ -944,7 +1026,6 @@ CONFIG_NF_CONNTRACK_MARK=y # CONFIG_NF_CONNTRACK_TIMEOUT is not set # CONFIG_NF_CONNTRACK_TIMESTAMP is not set # CONFIG_NF_CONNTRACK_LABELS is not set -CONFIG_NF_CT_PROTO_DCCP=y CONFIG_NF_CT_PROTO_SCTP=y CONFIG_NF_CT_PROTO_UDPLITE=y # CONFIG_NF_CONNTRACK_AMANDA is not set @@ -959,9 +1040,33 @@ CONFIG_NF_CT_PROTO_UDPLITE=y # CONFIG_NF_CONNTRACK_TFTP is not set # CONFIG_NF_CT_NETLINK is not set CONFIG_NF_NAT=y +CONFIG_NF_NAT_REDIRECT=y CONFIG_NF_NAT_MASQUERADE=y -# CONFIG_NF_TABLES is not set +CONFIG_NF_TABLES=y +# CONFIG_NF_TABLES_NETDEV is not set +# CONFIG_NFT_NUMGEN is not set +CONFIG_NFT_CT=y +# CONFIG_NFT_EXTHDR_DCCP is not set +# CONFIG_NFT_CONNLIMIT is not set +CONFIG_NFT_LOG=y +CONFIG_NFT_LIMIT=y +CONFIG_NFT_MASQ=y +CONFIG_NFT_REDIR=y +CONFIG_NFT_NAT=y +# CONFIG_NFT_TUNNEL is not set +# CONFIG_NFT_QUOTA is not set +CONFIG_NFT_REJECT=y +CONFIG_NFT_COMPAT=y +# CONFIG_NFT_HASH is not set +CONFIG_NFT_FIB=y +# CONFIG_NFT_XFRM is not set +# CONFIG_NFT_SOCKET is not set +# CONFIG_NFT_OSF is not set +# CONFIG_NFT_TPROXY is not set +# CONFIG_NFT_SYNPROXY is not set +# CONFIG_NF_FLOW_TABLE is not set CONFIG_NETFILTER_XTABLES=y +# CONFIG_NETFILTER_XTABLES_LEGACY is not set # # Xtables combined modules @@ -987,13 +1092,11 @@ CONFIG_NETFILTER_XT_NAT=y # CONFIG_NETFILTER_XT_TARGET_NETMAP is not set CONFIG_NETFILTER_XT_TARGET_NFLOG=y # CONFIG_NETFILTER_XT_TARGET_NFQUEUE is not set -# CONFIG_NETFILTER_XT_TARGET_NOTRACK is not set # CONFIG_NETFILTER_XT_TARGET_RATEEST is not set # CONFIG_NETFILTER_XT_TARGET_REDIRECT is not set CONFIG_NETFILTER_XT_TARGET_MASQUERADE=y # CONFIG_NETFILTER_XT_TARGET_TEE is not set # CONFIG_NETFILTER_XT_TARGET_TPROXY is not set -# CONFIG_NETFILTER_XT_TARGET_TRACE is not set # CONFIG_NETFILTER_XT_TARGET_SECMARK is not set CONFIG_NETFILTER_XT_TARGET_TCPMSS=y # CONFIG_NETFILTER_XT_TARGET_TCPOPTSTRIP is not set @@ -1057,7 +1160,12 @@ CONFIG_NETFILTER_XT_MATCH_TCPMSS=y CONFIG_NF_DEFRAG_IPV4=y # CONFIG_NF_SOCKET_IPV4 is not set # CONFIG_NF_TPROXY_IPV4 is not set -# CONFIG_NF_DUP_IPV4 is not set +CONFIG_NF_TABLES_IPV4=y +CONFIG_NFT_REJECT_IPV4=y +CONFIG_NFT_DUP_IPV4=y +CONFIG_NFT_FIB_IPV4=y +# CONFIG_NF_TABLES_ARP is not set +CONFIG_NF_DUP_IPV4=y # CONFIG_NF_LOG_ARP is not set # CONFIG_NF_LOG_IPV4 is not set CONFIG_NF_REJECT_IPV4=y @@ -1066,24 +1174,14 @@ CONFIG_IP_NF_IPTABLES=y # CONFIG_IP_NF_MATCH_ECN is not set # CONFIG_IP_NF_MATCH_RPFILTER is not set # CONFIG_IP_NF_MATCH_TTL is not set -CONFIG_IP_NF_FILTER=y CONFIG_IP_NF_TARGET_REJECT=y # CONFIG_IP_NF_TARGET_SYNPROXY is not set -CONFIG_IP_NF_NAT=y -CONFIG_IP_NF_TARGET_MASQUERADE=y -# CONFIG_IP_NF_TARGET_NETMAP is not set -# CONFIG_IP_NF_TARGET_REDIRECT is not set -CONFIG_IP_NF_MANGLE=y # CONFIG_IP_NF_TARGET_ECN is not set -# CONFIG_IP_NF_TARGET_TTL is not set -CONFIG_IP_NF_RAW=y -# CONFIG_IP_NF_SECURITY is not set -# CONFIG_IP_NF_ARPTABLES is not set # end of IP: Netfilter Configuration +# CONFIG_NF_TABLES_BRIDGE is not set # CONFIG_NF_CONNTRACK_BRIDGE is not set # CONFIG_BRIDGE_NF_EBTABLES is not set -# CONFIG_IP_DCCP is not set # CONFIG_IP_SCTP is not set # CONFIG_RDS is not set # CONFIG_TIPC is not set @@ -1165,9 +1263,8 @@ CONFIG_FAILOVER=y # # Device Drivers # -CONFIG_HAVE_EISA=y -# CONFIG_EISA is not set CONFIG_HAVE_PCI=y +CONFIG_GENERIC_PCI_IOMAP=y CONFIG_PCI=y CONFIG_PCI_DOMAINS=y # CONFIG_PCIEPORTBUS is not set @@ -1177,10 +1274,12 @@ CONFIG_PCI_MSI=y # CONFIG_PCI_QUIRKS is not set # CONFIG_PCI_DEBUG is not set # CONFIG_PCI_STUB is not set +# CONFIG_PCI_DOE is not set CONFIG_PCI_LOCKLESS_CONFIG=y # CONFIG_PCI_IOV is not set # CONFIG_PCI_PRI is not set # CONFIG_PCI_PASID is not set +# CONFIG_PCIE_TPH is not set CONFIG_PCI_LABEL=y CONFIG_PCIE_BUS_TUNE_OFF=y # CONFIG_PCIE_BUS_DEFAULT is not set @@ -1211,6 +1310,11 @@ CONFIG_PCIE_BUS_TUNE_OFF=y # Mobiveil-based PCIe controllers # # end of Mobiveil-based PCIe controllers + +# +# PLDA-based PCIe controllers +# +# end of PLDA-based PCIe controllers # end of PCI controller drivers # @@ -1225,9 +1329,11 @@ CONFIG_PCIE_BUS_TUNE_OFF=y # CONFIG_PCI_SW_SWITCHTEC is not set # end of PCI switch controller drivers +# CONFIG_PCI_PWRCTRL_SLOT is not set # CONFIG_CXL_BUS is not set # CONFIG_PCCARD is not set # CONFIG_RAPIDIO is not set +# CONFIG_PC104 is not set # # Generic Driver Options @@ -1299,8 +1405,10 @@ CONFIG_EFI_RUNTIME_WRAPPERS=y # CONFIG_EFI_DISABLE_PCI_DMA is not set # CONFIG_EFI_CUSTOM_SSDT_OVERLAYS is not set # CONFIG_EFI_DISABLE_RUNTIME is not set -# CONFIG_EFI_COCO_SECRET is not set +CONFIG_EFI_COCO_SECRET=y +# CONFIG_OVMF_DEBUG_LOG is not set CONFIG_UNACCEPTED_MEMORY=y +CONFIG_EFI_SBAT_FILE="" # end of EFI (Extensible Firmware Interface) Support # @@ -1314,6 +1422,7 @@ CONFIG_UNACCEPTED_MEMORY=y # end of Tegra firmware driver # end of Firmware Drivers +# CONFIG_FWCTL is not set # CONFIG_GNSS is not set # CONFIG_MTD is not set # CONFIG_OF is not set @@ -1329,6 +1438,7 @@ CONFIG_PNPACPI=y CONFIG_BLK_DEV=y # CONFIG_BLK_DEV_NULL_BLK is not set # CONFIG_BLK_DEV_PCIESSD_MTIP32XX is not set +# CONFIG_ZRAM is not set CONFIG_BLK_DEV_LOOP=y CONFIG_BLK_DEV_LOOP_MIN_COUNT=8 # CONFIG_BLK_DEV_DRBD is not set @@ -1363,6 +1473,7 @@ CONFIG_VIRTIO_BLK=y # CONFIG_DW_XDATA_PCIE is not set # CONFIG_PCI_ENDPOINT_TEST is not set # CONFIG_XILINX_SDFEC is not set +# CONFIG_NTSYNC is not set # CONFIG_NSM is not set # CONFIG_C2PORT is not set @@ -1374,18 +1485,12 @@ CONFIG_VIRTIO_BLK=y # CONFIG_CB710_CORE is not set -# -# Texas Instruments shared transport line discipline -# -# end of Texas Instruments shared transport line discipline - # # Altera FPGA firmware download module (requires I2C) # # CONFIG_INTEL_MEI is not set # CONFIG_VMWARE_VMCI is not set # CONFIG_GENWQE is not set -# CONFIG_ECHO is not set # CONFIG_BCM_VK is not set # CONFIG_MISC_ALCOR_PCI is not set # CONFIG_MISC_RTSX_PCI is not set @@ -1433,6 +1538,7 @@ CONFIG_DM_CRYPT=y # CONFIG_DM_LOG_WRITES is not set CONFIG_DM_INTEGRITY=y CONFIG_DM_AUDIT=y +# CONFIG_DM_VDO is not set # CONFIG_TARGET_CORE is not set # CONFIG_FUSION is not set @@ -1449,6 +1555,7 @@ CONFIG_NET_CORE=y # CONFIG_BONDING is not set CONFIG_DUMMY=y # CONFIG_WIREGUARD is not set +# CONFIG_OVPN is not set # CONFIG_EQUALIZER is not set # CONFIG_NET_TEAM is not set CONFIG_MACVLAN=y @@ -1460,6 +1567,7 @@ CONFIG_VXLAN=y # CONFIG_GENEVE is not set # CONFIG_BAREUDP is not set # CONFIG_GTP is not set +# CONFIG_PFCP is not set # CONFIG_MACSEC is not set # CONFIG_NETCONSOLE is not set # CONFIG_TUN is not set @@ -1471,14 +1579,13 @@ CONFIG_VIRTIO_NET=y # CONFIG_ETHERNET is not set # CONFIG_FDDI is not set # CONFIG_HIPPI is not set -# CONFIG_NET_SB1000 is not set # CONFIG_PHYLIB is not set -# CONFIG_PSE_CONTROLLER is not set -# CONFIG_MDIO_DEVICE is not set +# CONFIG_MDIO_BUS is not set # # PCS device drivers # +# CONFIG_PCS_XPCS is not set # end of PCS device drivers # CONFIG_PPP is not set @@ -1515,7 +1622,6 @@ CONFIG_INPUT=y # CONFIG_INPUT_MOUSEDEV is not set # CONFIG_INPUT_JOYDEV is not set # CONFIG_INPUT_EVDEV is not set -# CONFIG_INPUT_EVBUG is not set # # Input Device Drivers @@ -1544,7 +1650,6 @@ CONFIG_TTY=y CONFIG_VT=y CONFIG_CONSOLE_TRANSLATIONS=y CONFIG_VT_CONSOLE=y -CONFIG_HW_CONSOLE=y # CONFIG_VT_HW_CONSOLE_BINDING is not set CONFIG_UNIX98_PTYS=y # CONFIG_LEGACY_PTYS is not set @@ -1617,10 +1722,17 @@ CONFIG_PTP_1588_CLOCK_OPTIONAL=y # # end of PTP clock support +# +# DPLL device support +# +# end of DPLL device support + # CONFIG_PINCTRL is not set +CONFIG_GPIOLIB_LEGACY=y # CONFIG_GPIOLIB is not set # CONFIG_W1 is not set # CONFIG_POWER_RESET is not set +# CONFIG_POWER_SEQUENCING is not set # CONFIG_POWER_SUPPLY is not set # CONFIG_HWMON is not set # CONFIG_THERMAL is not set @@ -1633,6 +1745,7 @@ CONFIG_BCMA_POSSIBLE=y # # Multifunction device drivers # +# CONFIG_MFD_CGBC is not set # CONFIG_MFD_MADERA is not set # CONFIG_MFD_INTEL_QUARK_I2C_GPIO is not set # CONFIG_LPC_ICH is not set @@ -1647,6 +1760,7 @@ CONFIG_BCMA_POSSIBLE=y # CONFIG_MFD_SYSCON is not set # CONFIG_MFD_TQMX86 is not set # CONFIG_MFD_VX855 is not set +# CONFIG_MFD_UPBOARD_FPGA is not set # end of Multifunction device drivers # CONFIG_REGULATOR is not set @@ -1667,7 +1781,6 @@ CONFIG_BCMA_POSSIBLE=y # CONFIG_AGP is not set # CONFIG_VGA_SWITCHEROO is not set # CONFIG_DRM is not set -# CONFIG_DRM_DEBUG_MODESET_LOCK is not set # # Frame buffer Devices @@ -1682,6 +1795,8 @@ CONFIG_BCMA_POSSIBLE=y # CONFIG_BACKLIGHT_CLASS_DEVICE is not set # end of Backlight & LCD device support +# CONFIG_FIRMWARE_EDID is not set + # # Console display driver support # @@ -1690,6 +1805,8 @@ CONFIG_DUMMY_CONSOLE=y CONFIG_DUMMY_CONSOLE_COLUMNS=80 CONFIG_DUMMY_CONSOLE_ROWS=25 # end of Console display driver support + +# CONFIG_TRACE_GPU_MEM is not set # end of Graphics support # CONFIG_SOUND is not set @@ -1721,9 +1838,11 @@ CONFIG_VIRT_DRIVERS=y # CONFIG_VMGENID is not set # CONFIG_VBOXGUEST is not set # CONFIG_NITRO_ENCLAVES is not set -CONFIG_TSM_REPORTS=y -# CONFIG_EFI_SECRET is not set +CONFIG_EFI_SECRET=y CONFIG_TDX_GUEST_DRIVER=y +CONFIG_TSM_GUEST=y +CONFIG_TSM_REPORTS=y +CONFIG_TSM_MEASUREMENTS=y CONFIG_VIRTIO_ANCHOR=y CONFIG_VIRTIO=y CONFIG_VIRTIO_PCI_LIB=y @@ -1734,6 +1853,8 @@ CONFIG_VIRTIO_PCI_ADMIN_LEGACY=y CONFIG_VIRTIO_BALLOON=y # CONFIG_VIRTIO_INPUT is not set # CONFIG_VIRTIO_MMIO is not set +# CONFIG_VIRTIO_DEBUG is not set +# CONFIG_VIRTIO_RTC is not set # CONFIG_VDPA is not set # CONFIG_VHOST_MENU is not set @@ -1746,6 +1867,7 @@ CONFIG_VIRTIO_BALLOON=y # CONFIG_GREYBUS is not set # CONFIG_COMEDI is not set # CONFIG_STAGING is not set +# CONFIG_GOLDFISH is not set # CONFIG_CHROME_PLATFORMS is not set # CONFIG_MELLANOX_PLATFORM is not set # CONFIG_SURFACE_PLATFORMS is not set @@ -1778,8 +1900,6 @@ CONFIG_CLKBLD_I8253=y # CONFIG_RPMSG_VIRTIO is not set # end of Rpmsg drivers -# CONFIG_SOUNDWIRE is not set - # # SOC (System On Chip) specific Drivers # @@ -1950,7 +2070,6 @@ CONFIG_EXT4_FS_SECURITY=y CONFIG_JBD2=y # CONFIG_JBD2_DEBUG is not set CONFIG_FS_MBCACHE=y -# CONFIG_REISERFS_FS is not set # CONFIG_JFS_FS is not set # CONFIG_XFS_FS is not set # CONFIG_GFS2_FS is not set @@ -1998,8 +2117,8 @@ CONFIG_OVERLAY_FS_METACOPY=y # CONFIG_MSDOS_FS is not set # CONFIG_VFAT_FS is not set # CONFIG_EXFAT_FS is not set -# CONFIG_NTFS_FS is not set # CONFIG_NTFS3_FS is not set +# CONFIG_NTFS_FS is not set # end of DOS/FAT/EXFAT/NT Filesystems # @@ -2018,10 +2137,12 @@ CONFIG_TMPFS=y CONFIG_TMPFS_XATTR=y CONFIG_TMPFS_INODE64=y # CONFIG_TMPFS_QUOTA is not set +CONFIG_ARCH_SUPPORTS_HUGETLBFS=y CONFIG_HUGETLBFS=y CONFIG_HUGETLB_PAGE_OPTIMIZE_VMEMMAP_DEFAULT_ON=y CONFIG_HUGETLB_PAGE=y CONFIG_HUGETLB_PAGE_OPTIMIZE_VMEMMAP=y +CONFIG_HUGETLB_PMD_PAGE_TABLE_SHARING=y CONFIG_ARCH_HAS_GIGANTIC_PAGE=y CONFIG_CONFIGFS_FS=y CONFIG_EFIVAR_FS=y @@ -2091,19 +2212,23 @@ CONFIG_IO_WQ=y CONFIG_KEYS=y # CONFIG_KEYS_REQUEST_CACHE is not set # CONFIG_PERSISTENT_KEYRINGS is not set +# CONFIG_BIG_KEYS is not set # CONFIG_TRUSTED_KEYS is not set # CONFIG_ENCRYPTED_KEYS is not set # CONFIG_KEY_DH_OPERATIONS is not set # CONFIG_SECURITY_DMESG_RESTRICT is not set +CONFIG_PROC_MEM_ALWAYS_FORCE=y +# CONFIG_PROC_MEM_FORCE_PTRACE is not set +# CONFIG_PROC_MEM_NO_FORCE is not set +# CONFIG_MSEAL_SYSTEM_MAPPINGS is not set # CONFIG_SECURITY_PERF_EVENTS_RESTRICT is not set CONFIG_SECURITY=y +CONFIG_HAS_SECURITY_AUDIT=y CONFIG_SECURITYFS=y CONFIG_SECURITY_NETWORK=y # CONFIG_SECURITY_NETWORK_XFRM is not set CONFIG_SECURITY_PATH=y CONFIG_LSM_MMAP_MIN_ADDR=65536 -# CONFIG_HARDENED_USERCOPY is not set -# CONFIG_FORTIFY_SOURCE is not set # CONFIG_STATIC_USERMODEHELPER is not set CONFIG_SECURITY_SELINUX=y # CONFIG_SECURITY_SELINUX_BOOTPARAM is not set @@ -2127,6 +2252,7 @@ CONFIG_SECURITY_APPARMOR_RESTRICT_USERNS=y # CONFIG_SECURITY_SAFESETID is not set # CONFIG_SECURITY_LOCKDOWN_LSM is not set # CONFIG_SECURITY_LANDLOCK is not set +# CONFIG_SECURITY_IPE is not set CONFIG_INTEGRITY=y # CONFIG_INTEGRITY_SIGNATURE is not set CONFIG_INTEGRITY_AUDIT=y @@ -2157,6 +2283,13 @@ CONFIG_CC_HAS_ZERO_CALL_USED_REGS=y # CONFIG_ZERO_CALL_USED_REGS is not set # end of Memory initialization +# +# Bounds checking +# +# CONFIG_FORTIFY_SOURCE is not set +# CONFIG_HARDENED_USERCOPY is not set +# end of Bounds checking + # # Hardening of kernel data structures # @@ -2194,14 +2327,13 @@ CONFIG_CRYPTO_ACOMP2=y CONFIG_CRYPTO_MANAGER=y CONFIG_CRYPTO_MANAGER2=y CONFIG_CRYPTO_USER=y -CONFIG_CRYPTO_MANAGER_DISABLE_TESTS=y +# CONFIG_CRYPTO_SELFTESTS is not set CONFIG_CRYPTO_NULL=y -CONFIG_CRYPTO_NULL2=y # CONFIG_CRYPTO_PCRYPT is not set CONFIG_CRYPTO_CRYPTD=y CONFIG_CRYPTO_AUTHENC=y -# CONFIG_CRYPTO_TEST is not set -CONFIG_CRYPTO_SIMD=y +# CONFIG_CRYPTO_KRB5ENC is not set +# CONFIG_CRYPTO_BENCHMARK is not set # end of Crypto core or helper # @@ -2212,7 +2344,6 @@ CONFIG_CRYPTO_SIMD=y # CONFIG_CRYPTO_ECDH is not set # CONFIG_CRYPTO_ECDSA is not set # CONFIG_CRYPTO_ECRDSA is not set -# CONFIG_CRYPTO_SM2 is not set # CONFIG_CRYPTO_CURVE25519 is not set # end of Public-key cryptography @@ -2248,7 +2379,6 @@ CONFIG_CRYPTO_CTR=y # CONFIG_CRYPTO_CTS is not set CONFIG_CRYPTO_ECB=y # CONFIG_CRYPTO_HCTR2 is not set -# CONFIG_CRYPTO_KEYWRAP is not set # CONFIG_CRYPTO_LRW is not set # CONFIG_CRYPTO_PCBC is not set CONFIG_CRYPTO_XTS=y @@ -2277,7 +2407,6 @@ CONFIG_CRYPTO_HMAC=y # CONFIG_CRYPTO_MD4 is not set # CONFIG_CRYPTO_MD5 is not set # CONFIG_CRYPTO_MICHAEL_MIC is not set -# CONFIG_CRYPTO_POLY1305 is not set # CONFIG_CRYPTO_RMD160 is not set # CONFIG_CRYPTO_SHA1 is not set CONFIG_CRYPTO_SHA256=y @@ -2285,7 +2414,6 @@ CONFIG_CRYPTO_SHA512=y CONFIG_CRYPTO_SHA3=y # CONFIG_CRYPTO_SM3_GENERIC is not set # CONFIG_CRYPTO_STREEBOG is not set -# CONFIG_CRYPTO_VMAC is not set # CONFIG_CRYPTO_WP512 is not set # CONFIG_CRYPTO_XCBC is not set # CONFIG_CRYPTO_XXHASH is not set @@ -2296,7 +2424,6 @@ CONFIG_CRYPTO_SHA3=y # CONFIG_CRYPTO_CRC32C=y # CONFIG_CRYPTO_CRC32 is not set -# CONFIG_CRYPTO_CRCT10DIF is not set # end of CRCs (cyclic redundancy checks) # @@ -2334,13 +2461,11 @@ CONFIG_CRYPTO_USER_API_SKCIPHER=y # CONFIG_CRYPTO_USER_API_RNG is not set # CONFIG_CRYPTO_USER_API_AEAD is not set CONFIG_CRYPTO_USER_API_ENABLE_OBSOLETE=y -# CONFIG_CRYPTO_STATS is not set # end of Userspace interface # # Accelerated Cryptographic Algorithms for CPU (x86) # -# CONFIG_CRYPTO_CURVE25519_X86 is not set CONFIG_CRYPTO_AES_NI_INTEL=y # CONFIG_CRYPTO_BLOWFISH_X86_64 is not set # CONFIG_CRYPTO_CAMELLIA_X86_64 is not set @@ -2360,20 +2485,12 @@ CONFIG_CRYPTO_AES_NI_INTEL=y # CONFIG_CRYPTO_ARIA_AESNI_AVX_X86_64 is not set # CONFIG_CRYPTO_ARIA_AESNI_AVX2_X86_64 is not set # CONFIG_CRYPTO_ARIA_GFNI_AVX512_X86_64 is not set -# CONFIG_CRYPTO_CHACHA20_X86_64 is not set # CONFIG_CRYPTO_AEGIS128_AESNI_SSE2 is not set # CONFIG_CRYPTO_NHPOLY1305_SSE2 is not set # CONFIG_CRYPTO_NHPOLY1305_AVX2 is not set -# CONFIG_CRYPTO_BLAKE2S_X86 is not set # CONFIG_CRYPTO_POLYVAL_CLMUL_NI is not set -# CONFIG_CRYPTO_POLY1305_X86_64 is not set -# CONFIG_CRYPTO_SHA1_SSSE3 is not set -CONFIG_CRYPTO_SHA256_SSSE3=y -CONFIG_CRYPTO_SHA512_SSSE3=y # CONFIG_CRYPTO_SM3_AVX_X86_64 is not set # CONFIG_CRYPTO_GHASH_CLMUL_NI_INTEL is not set -CONFIG_CRYPTO_CRC32C_INTEL=y -CONFIG_CRYPTO_CRC32_PCLMUL=y # end of Accelerated Cryptographic Algorithms for CPU (x86) # CONFIG_CRYPTO_HW is not set @@ -2385,6 +2502,8 @@ CONFIG_CRYPTO_CRC32_PCLMUL=y # CONFIG_SYSTEM_BLACKLIST_KEYRING is not set # end of Certificates for signature checking +# CONFIG_CRYPTO_KRB5 is not set + # # Library routines # @@ -2396,44 +2515,37 @@ CONFIG_GENERIC_NET_UTILS=y # CONFIG_CORDIC is not set # CONFIG_PRIME_NUMBERS is not set CONFIG_RATIONAL=y -CONFIG_GENERIC_PCI_IOMAP=y CONFIG_GENERIC_IOMAP=y CONFIG_ARCH_USE_CMPXCHG_LOCKREF=y CONFIG_ARCH_HAS_FAST_MULTIPLIER=y CONFIG_ARCH_USE_SYM_ANNOTATIONS=y +CONFIG_CRC16=y +CONFIG_CRC_T10DIF=y +CONFIG_CRC_T10DIF_ARCH=y +CONFIG_CRC32=y +CONFIG_CRC32_ARCH=y +CONFIG_CRC64=y +CONFIG_CRC64_ARCH=y +CONFIG_CRC_OPTIMIZATIONS=y # # Crypto library routines # +CONFIG_CRYPTO_HASH_INFO=y CONFIG_CRYPTO_LIB_UTILS=y CONFIG_CRYPTO_LIB_AES=y CONFIG_CRYPTO_LIB_GF128MUL=y CONFIG_CRYPTO_LIB_BLAKE2S_GENERIC=y -# CONFIG_CRYPTO_LIB_CHACHA is not set -# CONFIG_CRYPTO_LIB_CURVE25519 is not set CONFIG_CRYPTO_LIB_POLY1305_RSIZE=11 -# CONFIG_CRYPTO_LIB_POLY1305 is not set -# CONFIG_CRYPTO_LIB_CHACHA20POLY1305 is not set CONFIG_CRYPTO_LIB_SHA1=y +CONFIG_CRYPTO_LIB_SHA1_ARCH=y CONFIG_CRYPTO_LIB_SHA256=y +CONFIG_CRYPTO_LIB_SHA256_ARCH=y +CONFIG_CRYPTO_LIB_SHA512=y +CONFIG_CRYPTO_LIB_SHA512_ARCH=y +# CONFIG_CRYPTO_BLAKE2S_X86 is not set # end of Crypto library routines -# CONFIG_CRC_CCITT is not set -CONFIG_CRC16=y -# CONFIG_CRC_T10DIF is not set -# CONFIG_CRC64_ROCKSOFT is not set -# CONFIG_CRC_ITU_T is not set -CONFIG_CRC32=y -# CONFIG_CRC32_SELFTEST is not set -CONFIG_CRC32_SLICEBY8=y -# CONFIG_CRC32_SLICEBY4 is not set -# CONFIG_CRC32_SARWATE is not set -# CONFIG_CRC32_BIT is not set -# CONFIG_CRC64 is not set -# CONFIG_CRC4 is not set -# CONFIG_CRC7 is not set -CONFIG_LIBCRC32C=y -# CONFIG_CRC8 is not set CONFIG_XXHASH=y # CONFIG_RANDOM32_SELFTEST is not set CONFIG_ZLIB_INFLATE=y @@ -2445,7 +2557,9 @@ CONFIG_XZ_DEC_X86=y CONFIG_XZ_DEC_POWERPC=y CONFIG_XZ_DEC_ARM=y CONFIG_XZ_DEC_ARMTHUMB=y +CONFIG_XZ_DEC_ARM64=y CONFIG_XZ_DEC_SPARC=y +CONFIG_XZ_DEC_RISCV=y # CONFIG_XZ_DEC_MICROLZMA is not set CONFIG_XZ_DEC_BCJ=y # CONFIG_XZ_DEC_TEST is not set @@ -2464,9 +2578,9 @@ CONFIG_ARCH_DMA_ADDR_T_64BIT=y CONFIG_ARCH_HAS_FORCE_DMA_UNENCRYPTED=y CONFIG_SWIOTLB=y # CONFIG_SWIOTLB_DYNAMIC is not set +CONFIG_DMA_NEED_SYNC=y # CONFIG_DMA_API_DEBUG is not set CONFIG_SGL_ALLOC=y -# CONFIG_FORCE_NR_CPUS is not set CONFIG_CPU_RMAP=y CONFIG_DQL=y CONFIG_NLATTR=y @@ -2476,6 +2590,9 @@ CONFIG_UCS2_STRING=y CONFIG_HAVE_GENERIC_VDSO=y CONFIG_GENERIC_GETTIMEOFDAY=y CONFIG_GENERIC_VDSO_TIME_NS=y +CONFIG_GENERIC_VDSO_OVERFLOW_PROTECT=y +CONFIG_VDSO_GETRANDOM=y +CONFIG_GENERIC_VDSO_DATA_STORE=y CONFIG_SG_POOL=y CONFIG_ARCH_HAS_PMEM_API=y CONFIG_ARCH_HAS_CPU_CACHE_INVALIDATE_MEMREGION=y @@ -2489,6 +2606,7 @@ CONFIG_SBITMAP=y # end of Library routines CONFIG_FIRMWARE_TABLE=y +CONFIG_UNION_FIND=y # # Kernel hacking @@ -2529,6 +2647,7 @@ CONFIG_FRAME_WARN=1024 # CONFIG_SECTION_MISMATCH_WARN_ONLY is not set # CONFIG_DEBUG_FORCE_FUNCTION_ALIGN_64B is not set CONFIG_OBJTOOL=y +# CONFIG_OBJTOOL_WERROR is not set # CONFIG_VMLINUX_MAP is not set # CONFIG_DEBUG_FORCE_WEAK_PER_CPU is not set # end of Compile-time checks and compiler options @@ -2540,7 +2659,7 @@ CONFIG_OBJTOOL=y # CONFIG_DEBUG_FS is not set CONFIG_HAVE_ARCH_KGDB=y # CONFIG_KGDB is not set -CONFIG_ARCH_HAS_UBSAN_SANITIZE_ALL=y +CONFIG_ARCH_HAS_UBSAN=y # CONFIG_UBSAN is not set CONFIG_HAVE_ARCH_KCSAN=y CONFIG_HAVE_KCSAN_COMPILER=y @@ -2553,6 +2672,7 @@ CONFIG_HAVE_KCSAN_COMPILER=y # CONFIG_NET_DEV_REFCNT_TRACKER is not set # CONFIG_NET_NS_REFCNT_TRACKER is not set # CONFIG_DEBUG_NET is not set +# CONFIG_DEBUG_NET_SMALL_RTNL is not set # end of Networking Debugging # @@ -2568,7 +2688,7 @@ CONFIG_SLUB_DEBUG=y # CONFIG_DEBUG_RODATA_TEST is not set CONFIG_ARCH_HAS_DEBUG_WX=y # CONFIG_DEBUG_WX is not set -CONFIG_GENERIC_PTDUMP=y +CONFIG_ARCH_HAS_PTDUMP=y CONFIG_HAVE_DEBUG_KMEMLEAK=y # CONFIG_DEBUG_KMEMLEAK is not set # CONFIG_PER_VMA_LOCK_STATS is not set @@ -2576,6 +2696,7 @@ CONFIG_HAVE_DEBUG_KMEMLEAK=y # CONFIG_DEBUG_STACK_USAGE is not set # CONFIG_SCHED_STACK_END_CHECK is not set CONFIG_ARCH_HAS_DEBUG_VM_PGTABLE=y +# CONFIG_DEBUG_VFS is not set # CONFIG_DEBUG_VM is not set # CONFIG_DEBUG_VM_PGTABLE is not set CONFIG_ARCH_HAS_DEBUG_VIRTUAL=y @@ -2584,6 +2705,7 @@ CONFIG_ARCH_HAS_DEBUG_VIRTUAL=y # CONFIG_DEBUG_PER_CPU_MAPS is not set CONFIG_ARCH_SUPPORTS_KMAP_LOCAL_FORCE_MAP=y # CONFIG_DEBUG_KMAP_LOCAL_FORCE_MAP is not set +# CONFIG_MEM_ALLOC_PROFILING is not set CONFIG_HAVE_ARCH_KASAN=y CONFIG_HAVE_ARCH_KASAN_VMALLOC=y CONFIG_CC_HAS_KASAN_GENERIC=y @@ -2617,8 +2739,6 @@ CONFIG_HARDLOCKUP_CHECK_TIMESTAMP=y # CONFIG_SCHEDSTATS is not set # end of Scheduler Debugging -# CONFIG_DEBUG_TIMEKEEPING is not set - # # Lock Debugging (spinlocks, mutexes, etc...) # @@ -2678,8 +2798,8 @@ CONFIG_HAVE_DYNAMIC_FTRACE=y CONFIG_HAVE_DYNAMIC_FTRACE_WITH_REGS=y CONFIG_HAVE_DYNAMIC_FTRACE_WITH_DIRECT_CALLS=y CONFIG_HAVE_DYNAMIC_FTRACE_WITH_ARGS=y +CONFIG_HAVE_FTRACE_REGS_HAVING_PT_REGS=y CONFIG_HAVE_DYNAMIC_FTRACE_NO_PATCHABLE=y -CONFIG_HAVE_FTRACE_MCOUNT_RECORD=y CONFIG_HAVE_SYSCALL_TRACEPOINTS=y CONFIG_HAVE_FENTRY=y CONFIG_HAVE_OBJTOOL_MCOUNT=y @@ -2723,7 +2843,6 @@ CONFIG_UNWINDER_ORC=y # CONFIG_NOTIFIER_ERROR_INJECTION is not set # CONFIG_FAULT_INJECTION is not set CONFIG_ARCH_HAS_KCOV=y -CONFIG_CC_HAS_SANCOV_TRACE_PC=y # CONFIG_KCOV is not set # CONFIG_RUNTIME_TESTING_MENU is not set CONFIG_ARCH_USE_MEMTEST=y @@ -2735,3 +2854,5 @@ CONFIG_ARCH_USE_MEMTEST=y # # end of Rust hacking # end of Kernel hacking + +CONFIG_IO_URING_ZCRX=y