From e4a518ae0e28c8a227397485fe19b573bdc3a013 Mon Sep 17 00:00:00 2001 From: Ryan Murray Date: Mon, 26 Oct 2026 14:13:12 +1100 Subject: [PATCH 01/10] arm64: configs: trim redundant Asahi requests and enable shared backends Resolve each candidate removal over both arm64 defconfig and the Fedora Asahi base. The 36 removed requests cause no resolved configuration changes on either recipe: the bases or the remaining selections retain those drivers and capabilities. Keep the default thermal governor available over the Fedora base by enabling ENERGY_MODEL and THERMAL_GOV_POWER_ALLOCATOR, as identified in #438. Request 48-bit VA and mixed-granule userspace as in #394, and build the native G15 backend alongside the other supported GPUs. Assisted-by: LLM Signed-off-by: Ryan Murray --- arch/arm64/configs/asahi.config | 41 ++++----------------------------- 1 file changed, 5 insertions(+), 36 deletions(-) diff --git a/arch/arm64/configs/asahi.config b/arch/arm64/configs/asahi.config index 783e41230238c..d07b70afd9294 100644 --- a/arch/arm64/configs/asahi.config +++ b/arch/arm64/configs/asahi.config @@ -3,40 +3,28 @@ # olddefconfig and verify that the requested settings survive resolution. # Device-specific boot, debug and distribution policy stays in the base. CONFIG_RUST=y -CONFIG_ARM64_ACTLR_STATE=y -CONFIG_ARCH_APPLE=y -# CONFIG_ARM64_4K_PAGES is not set CONFIG_ARM64_16K_PAGES=y -# CONFIG_ARM64_64K_PAGES is not set +CONFIG_ARM64_VA_BITS_48=y +CONFIG_ARM64_USER4K_EXPERIMENTAL=y CONFIG_ARM64_MEMORY_MODEL_CONTROL=y CONFIG_ARM_APPLE_CPUIDLE=y -CONFIG_ARM_APPLE_SOC_CPUFREQ=m +CONFIG_ENERGY_MODEL=y +CONFIG_THERMAL_GOV_POWER_ALLOCATOR=y CONFIG_THERMAL_DEFAULT_GOV_POWER_ALLOCATOR=y CONFIG_BT_BRCMEXT=y CONFIG_BT_HCIBCM4377=m CONFIG_BT_MTK7932_PCIE=m CONFIG_PCIE_APPLE=y -CONFIG_NVME_APPLE=m CONFIG_MMC_SDHCI_PCI=m -CONFIG_BRCMFMAC=m CONFIG_BRCMFMAC_PCIE=y CONFIG_PCIE_APPLE_PIODMA_DIAG=y CONFIG_PCIEASPM=y CONFIG_NET_VENDOR_INTEL=y -CONFIG_IGB=m CONFIG_IGC=m CONFIG_MT7932_FULLMAC=m -CONFIG_TOUCHSCREEN_APPLE_Z2=m CONFIG_INPUT_MACSMC_INPUT=m -CONFIG_I2C_APPLE=m -CONFIG_SPI_APPLE=m CONFIG_SPI_APPLE_QSPI=m -CONFIG_SPMI_APPLE=m -CONFIG_PINCTRL_APPLE_GPIO=m -CONFIG_GPIO_MACSMC=m -CONFIG_POWER_RESET_MACSMC=m CONFIG_MACSMC_POWER=m -CONFIG_SENSORS_MACSMC_HWMON=m CONFIG_SENSORS_APPLE_PMP_J613=m CONFIG_THERMAL_NETLINK=y CONFIG_NVME_HWMON=y @@ -45,6 +33,7 @@ CONFIG_VIDEO_APPLE_AVD=m CONFIG_VIDEO_APPLE_ISP=m CONFIG_DRM=y CONFIG_DRM_ASAHI=m +CONFIG_DRM_ASAHI_G15=y CONFIG_DRM_ASAHI_G16=y CONFIG_DRM_ADP=m CONFIG_DRM_APPLE=m @@ -56,7 +45,6 @@ CONFIG_DRM_SIMPLEDRM=y CONFIG_SYSFB_SIMPLEFB=y CONFIG_SND_SOC_APPLE_AOP_AUDIO=m CONFIG_SND_SOC_APPLE_T8140_AOP_AUDIO=m -CONFIG_SND_SOC_APPLE_MCA=m CONFIG_SND_SOC_APPLE_MACAUDIO=m CONFIG_SND_SOC_CS42L83=m CONFIG_SND_SOC_CS42L84=m @@ -66,24 +54,16 @@ CONFIG_SND_SOC_TAS2770=m CONFIG_HID_APPLE=m CONFIG_HID_MAGICMOUSE=m CONFIG_HID_APPLE_MTP_HAPTIC=m -CONFIG_SERIAL_SAMSUNG=y -CONFIG_SERIAL_SAMSUNG_CONSOLE=y CONFIG_HID_DOCKCHANNEL=m CONFIG_SPI_HID_APPLE_OF=m -CONFIG_SPI_HID_APPLE_CORE=m CONFIG_USB_DWC3_APPLE=m -CONFIG_TYPEC=m CONFIG_USB4=m CONFIG_USB4_APPLE_SOC=m CONFIG_USB_XHCI_PCI_ASMEDIA=y CONFIG_TYPEC_SN201202X=m -CONFIG_RTC_DRV_MACSMC=m CONFIG_RTC_DRV_APPLE_PMU=m -CONFIG_APPLE_ADMAC=m CONFIG_APPLE_SIO=m CONFIG_APPLE_SIO_T6030=y -CONFIG_MFD_MACSMC=m -CONFIG_COMMON_CLK_APPLE_NCO=m CONFIG_APPLE_DART=y CONFIG_APPLE_DART_J713_DCP=y CONFIG_APPLE_DOCKCHANNEL=m @@ -93,10 +73,7 @@ CONFIG_APPLE_MAILBOX=y CONFIG_APPLE_PMGR_MISC=y CONFIG_APPLE_RTKIT=y CONFIG_APPLE_RTKIT_HELPER=m -CONFIG_APPLE_SART=m -CONFIG_RUST_APPLE_RTKIT=y CONFIG_APPLE_AOP=m -CONFIG_HW_RANDOM=y CONFIG_KEYS=y CONFIG_TRUSTED_KEYS=y # CONFIG_TRUSTED_KEYS_TPM is not set @@ -104,28 +81,20 @@ CONFIG_TRUSTED_KEYS=y CONFIG_APPLE_SEP=m CONFIG_APPLE_PMGR_PWRSTATE=y CONFIG_APPLE_PMP=m -CONFIG_APPLE_PMP_REPORT=y CONFIG_APPLE_PMP_THERMAL=m CONFIG_APPLE_T8132_PLATFORM_HANDOFF=y CONFIG_IIO_AOP_SENSOR_LAS=m CONFIG_IIO_AOP_SENSOR_ALS=m CONFIG_RUST_FW_LOADER_ABSTRACTIONS=y -CONFIG_PWM_APPLE=m -CONFIG_APPLE_AIC=y CONFIG_PHY_APPLE_ATC=m CONFIG_PHY_APPLE_T6040_USB2=m CONFIG_PHY_APPLE_DPTX=m -CONFIG_APPLE_M1_CPU_PMU=y -CONFIG_NVMEM_APPLE_EFUSES=m -CONFIG_NVMEM_APPLE_SPMI=m CONFIG_MUX_APPLE_DPXBAR=m -CONFIG_TYPEC_TPS6598X=m CONFIG_RESET_APPLE_CIO=y CONFIG_INFINIBAND=m CONFIG_INFINIBAND_USER_ACCESS=m CONFIG_INFINIBAND_USER_MAD=m CONFIG_RDMA_RXE=m CONFIG_RDMA_SIW=m -CONFIG_DMABUF_HEAPS=y CONFIG_DMABUF_HEAPS_SYSTEM=y CONFIG_UDMABUF=y From eb4b4269f3c8b1c8c2c070d83f22b36a9b0b7059 Mon Sep 17 00:00:00 2001 From: Ryan Murray Date: Mon, 26 Oct 2026 14:13:12 +1100 Subject: [PATCH 02/10] selftests: apple-dcp: initialise the probe retry budget fixture The probe fixture calls cd321x_pm_init() on an uninitialised stack object. That helper sets the initial phase and link-event budget but expects the other fields to have the zeroed allocation used by the real driver. The fixture can read arbitrary setup_pending values and fail its retry assertions under UBSan. Start it from the same zeroed state as the other fixtures. Assisted-by: LLM Signed-off-by: Ryan Murray --- tools/testing/selftests/drivers/gpu/apple-dcp/pm.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tools/testing/selftests/drivers/gpu/apple-dcp/pm.py b/tools/testing/selftests/drivers/gpu/apple-dcp/pm.py index d5b3890d30861..664ba046dad35 100644 --- a/tools/testing/selftests/drivers/gpu/apple-dcp/pm.py +++ b/tools/testing/selftests/drivers/gpu/apple-dcp/pm.py @@ -547,7 +547,7 @@ def function(text, name): int main(void) { (void)cd321x_pm_notifications; struct cd321x c; - struct cd321x_pm_state budget; + struct cd321x_pm_state budget={0}; cd321x_pm_init(&budget);assert(cd321x_pm_ready(&budget)); assert(cd321x_display_taken(-ENOSPC,true)&&!cd321x_display_taken(-EBUSY,true)&&!cd321x_display_taken(0,true)&&cd321x_display_taken(-EBUSY,false)&&!cd321x_display_taken(-ENOSPC,false)&&!cd321x_display_taken(0,false)); for(unsigned int i=0;i Date: Mon, 26 Oct 2026 15:08:26 +1100 Subject: [PATCH 03/10] drm/asahi: keep G15 compatible with the shared G16 interfaces Building G15 and G16 together exposes stale initializers and calls in the G15 adapter. Initialise the inactive G16 platform owner and preserve the RTKit default protocol negotiation and legacy shmem callback. Resolve timestamp handles through Buffer::firmware_mapping(), retaining the firmware mapping and rejecting CPU-only destinations. Pass no reserved region map when walking G15 host-allocated RAM page tables, matching the same shared API contract already used by G16. Assisted-by: LLM Signed-off-by: Ryan Murray --- drivers/gpu/drm/asahi/driver.rs | 2 ++ drivers/gpu/drm/asahi/g15/boot.rs | 2 ++ drivers/gpu/drm/asahi/g15/command.rs | 1 + drivers/gpu/drm/asahi/g15/uat.rs | 2 +- 4 files changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/asahi/driver.rs b/drivers/gpu/drm/asahi/driver.rs index addabd04fe701..ab68573881659 100644 --- a/drivers/gpu/drm/asahi/driver.rs +++ b/drivers/gpu/drm/asahi/driver.rs @@ -346,6 +346,8 @@ impl AsahiPlatformDriver { _device: reg.device().into(), _reg: reg, g17: None, + #[cfg(CONFIG_DRM_ASAHI_G16)] + g16: None, raw_dev: core::ptr::null_mut(), raw_stats: core::ptr::null_mut(), stats: None, diff --git a/drivers/gpu/drm/asahi/g15/boot.rs b/drivers/gpu/drm/asahi/g15/boot.rs index ddcf5efef4c3d..7a06aa64ffbc3 100644 --- a/drivers/gpu/drm/asahi/g15/boot.rs +++ b/drivers/gpu/drm/asahi/g15/boot.rs @@ -306,10 +306,12 @@ unsafe extern "C" fn rtkit_shmem_destroy( /// The GPU's RTKit callbacks. static RTKIT_OPS: bindings::apple_rtkit_ops = bindings::apple_rtkit_ops { flags: 0, + protocol_version: 0, crashed: Some(rtkit_crashed), recv_message: Some(rtkit_recv), recv_message_early: Some(rtkit_recv_early), shmem_setup: Some(rtkit_shmem_setup), + shmem_setup_ep: None, shmem_destroy: Some(rtkit_shmem_destroy), syslog_is_debug: None, }; diff --git a/drivers/gpu/drm/asahi/g15/command.rs b/drivers/gpu/drm/asahi/g15/command.rs index 45b65d1ddc026..6fc1e03fb637c 100644 --- a/drivers/gpu/drm/asahi/g15/command.rs +++ b/drivers/gpu/drm/asahi/g15/command.rs @@ -361,6 +361,7 @@ impl Timestamps<'_> { .ok_or(ENOENT)? .clone(); let file::Object::TimestampBuffer(mapping) = object; + let mapping = mapping.firmware_mapping()?; let offset = timestamp.offset as usize; if offset % 8 != 0 || offset >= mapping.size() || mapping.size() - offset < 8 { return Err(EINVAL); diff --git a/drivers/gpu/drm/asahi/g15/uat.rs b/drivers/gpu/drm/asahi/g15/uat.rs index 854ff34e729a3..d6971489ee80f 100644 --- a/drivers/gpu/drm/asahi/g15/uat.rs +++ b/drivers/gpu/drm/asahi/g15/uat.rs @@ -96,7 +96,7 @@ fn with_table( // SAFETY: Every table walked here is a page the shared page-table code allocated in RAM // (`Page::alloc_page`) and never frees while the firmware runs (tables are not freed on // unmap, and these VMs are retained until reboot). - unsafe { pgtable::with_root_entries(pa, count, f) } + unsafe { pgtable::with_root_entries(None, pa, count, f) } } /// Cleans `len` bytes of the RAM table page at `pa`, from entry `first`, to the point of From c01ad1ba4f1a558fe281dd123423032d7aa54172 Mon Sep 17 00:00:00 2001 From: Ryan Murray Date: Mon, 26 Oct 2026 17:23:00 +1100 Subject: [PATCH 04/10] drm/asahi: g17: build test-only helpers only with built-in KUnit Four G17 helpers exist only for the KUnit suites: the compute QID floor, the growth gate and admission pool constructors and the runtime registry constructor. They are gated on cfg(CONFIG_KUNIT), which is also set when KUnit is a module. #[kunit_tests] compiles its suites only for CONFIG_KUNIT=y, so with CONFIG_KUNIT=m (the Fedora-based release configuration) nothing uses the helpers and rustc warns about dead code: warning: constant `COMPUTE_FLOOR` is never used warning: associated function `new` is never used (x3) With CONFIG_WERROR=y, KBUILD_RUSTFLAGS gains -Dwarnings and the asahi module no longer builds. Gate the helpers on CONFIG_KUNIT="y", the condition the suites use. Every caller is inside a #[kunit_tests] module, so built-in KUnit runs are unchanged. Fixes: a36e352d8564 ("drm/asahi: size the G17 compute QID budget by open logical queues") Fixes: 014605a36795 ("drm/asahi: add G17 resource wait domains and use them for queue creation") Fixes: 64f717dcfd1e ("drm/asahi: wait for G17 compute capacity on the release that frees it") Assisted-by: LLM Signed-off-by: Ryan Murray --- drivers/gpu/drm/asahi/g17/kick.rs | 2 +- drivers/gpu/drm/asahi/g17/preparation.rs | 2 +- drivers/gpu/drm/asahi/g17/queue/admission.rs | 2 +- drivers/gpu/drm/asahi/g17/runtime.rs | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/gpu/drm/asahi/g17/kick.rs b/drivers/gpu/drm/asahi/g17/kick.rs index a1f8f70f597d4..4adf2c01ac4d5 100644 --- a/drivers/gpu/drm/asahi/g17/kick.rs +++ b/drivers/gpu/drm/asahi/g17/kick.rs @@ -43,7 +43,7 @@ const RENDER_HEADROOM: usize = 24; /// The render reserve with every execution context open. const FULL_RENDER_RESERVE: usize = render_reserve(crate::mmu::MAX_EXECUTION_CONTEXTS as usize); /// Compute channels that stay reachable with every execution context open. -#[cfg(CONFIG_KUNIT)] +#[cfg(CONFIG_KUNIT = "y")] pub(super) const COMPUTE_FLOOR: usize = QID_COUNT - FULL_RENDER_RESERVE; /// Upper bound on distinct physical compute channels named by one kick. pub(super) const COMPUTE_CHANNELS: usize = QID_COUNT; diff --git a/drivers/gpu/drm/asahi/g17/preparation.rs b/drivers/gpu/drm/asahi/g17/preparation.rs index eb2366fa3451b..2aa3213115076 100644 --- a/drivers/gpu/drm/asahi/g17/preparation.rs +++ b/drivers/gpu/drm/asahi/g17/preparation.rs @@ -60,7 +60,7 @@ pub(super) struct Gate { } impl Gate { - #[cfg(CONFIG_KUNIT)] + #[cfg(CONFIG_KUNIT = "y")] pub(super) fn new() -> Result> { Self::with_waiters(None) } diff --git a/drivers/gpu/drm/asahi/g17/queue/admission.rs b/drivers/gpu/drm/asahi/g17/queue/admission.rs index e1e7552c243f2..5d770ca1f64b0 100644 --- a/drivers/gpu/drm/asahi/g17/queue/admission.rs +++ b/drivers/gpu/drm/asahi/g17/queue/admission.rs @@ -406,7 +406,7 @@ pub(crate) struct Pool { renders: Option>, } impl Pool { - #[cfg(CONFIG_KUNIT)] + #[cfg(CONFIG_KUNIT = "y")] pub(crate) fn new(max_queues: u32) -> Result> { Self::with_waiters(max_queues, None, None) } diff --git a/drivers/gpu/drm/asahi/g17/runtime.rs b/drivers/gpu/drm/asahi/g17/runtime.rs index e04295d576606..9fe17db8a2809 100644 --- a/drivers/gpu/drm/asahi/g17/runtime.rs +++ b/drivers/gpu/drm/asahi/g17/runtime.rs @@ -186,7 +186,7 @@ pub(super) struct Registry { impl Registry { /// Initialize inside the firmware allocation instead of staging the whole /// registry on the probe stack. No additional allocation is required. - #[cfg(CONFIG_KUNIT)] + #[cfg(CONFIG_KUNIT = "y")] pub(super) fn new( clusters: u32, deflake: crate::g17::fw::render::Deflake, From e7843a83510dfb1c3c7fd0a3462379c98decc7c5 Mon Sep 17 00:00:00 2001 From: Ryan Murray Date: Mon, 26 Oct 2026 18:19:49 +1100 Subject: [PATCH 05/10] rust: device: drop the stale private-parent lint expectation Device::parent is a public API in the carried Asahi abstractions, and AOP service lookup uses it with AUXILIARY_BUS disabled. The inherited expectation described the upstream crate-private helper and becomes unfulfilled in the built-in Asahi/firmware KUnit recipe. WERROR correctly rejects it. Remove the obsolete dead_code expectation from the public method. Keep warning enforcement and the minimal test config; do not enable an unrelated bus to hide the warning. Production behavior is unchanged. Assisted-by: LLM --- rust/kernel/device.rs | 1 - 1 file changed, 1 deletion(-) diff --git a/rust/kernel/device.rs b/rust/kernel/device.rs index e54bf419c7a66..f047b90e7b04a 100644 --- a/rust/kernel/device.rs +++ b/rust/kernel/device.rs @@ -268,7 +268,6 @@ impl Device { } /// Returns a reference to the parent device, if any. - #[cfg_attr(not(CONFIG_AUXILIARY_BUS), expect(dead_code))] pub fn parent(&self) -> Option<&Device> { // SAFETY: // - By the type invariant `self.as_raw()` is always valid. From 7b563df1ba87e6f22d54be1186dce7024eab5934 Mon Sep 17 00:00:00 2001 From: Ryan Murray Date: Mon, 26 Oct 2026 20:06:25 +1100 Subject: [PATCH 06/10] rust: require checked binding layouts for every kernel build With SCHEDSTATS disabled, stock bindgen loses the alignment of the empty sched_statistics member and shifts task_struct.mm. A current-MM read can then pass a scheduler-list pointer to the RSS helpers. Keep unconditional size, alignment and offset checks in production builds and document the corrected generator and command-line BINDGEN selection. --- Documentation/rust/bindgen-layout-checks.rst | 57 ++++++++++---------- rust/Makefile | 15 ++---- tools/aurora-bindgen/README.rst | 20 +++---- tools/aurora-bindgen/build.py | 2 +- 4 files changed, 43 insertions(+), 51 deletions(-) diff --git a/Documentation/rust/bindgen-layout-checks.rst b/Documentation/rust/bindgen-layout-checks.rst index aaac5b24fb742..5af9951a64338 100644 --- a/Documentation/rust/bindgen-layout-checks.rst +++ b/Documentation/rust/bindgen-layout-checks.rst @@ -3,22 +3,21 @@ Checking generated binding layouts ================================== -bindgen can emit compile-time assertions that compare the size, alignment and -field offsets of every generated Rust type with the values Clang computes for -the C type. As upstream, the kernel build passes ``--no-layout-tests`` to -bindgen, so the generated bindings do not contain these assertions and any -supported bindgen version can build the kernel. - -To check the layouts of a configuration, build with ``BINDGEN_LAYOUT_TESTS=1``:: - - make LLVM=1 BINDGEN_LAYOUT_TESTS=1 prepare - -The bindings are then generated with the assertions, which are checked while -the ``bindings`` and ``uapi`` crates are compiled; nothing is executed. A -mismatch stops the build with an ``E0080`` error naming the type and the -property (``Size of``, ``Alignment of`` or ``Offset of``). Changing the -variable regenerates the bindings. The check covers only the configuration -being built. +Every Rust build retains bindgen's unconditional compile-time assertions for +size, alignment and field offsets. A mismatch stops the bindings crate build +with an ``E0080`` error naming the C type and property. These assertions are +required even when KUnit is disabled; ``BINDGEN_LAYOUT_TESTS=0`` cannot disable +them. Build the complete Image and all modules with the same generator. + +A successful C build does not validate Rust field offsets. In particular, +``CONFIG_SCHEDSTATS=n`` leaves a zero-sized, cacheline-aligned +``sched_statistics`` in ``task_struct``. Stock bindgen 0.73.2 loses its alignment +and can shift subsequent fields, including ``mm``. The ARM64 defconfig + +Asahi configuration exposed a 40-byte difference: Rust read a scheduler list +pointer as the current mm and Asahi's RSS charge faulted in +``percpu_counter_add_batch``. The C RSS helpers and allocator agreed on the +counter layout; the pointer supplied to them was wrong. Enabling SCHEDSTATS +only masks the generator defect and is not a requirement of the driver. Known generator limitations --------------------------- @@ -37,16 +36,11 @@ Unmodified bindgen 0.73 does not reproduce every C layout used by the kernel: * It can drop the explicit alignment of a defined zero-sized C struct, such as ``struct empty {} __attribute__((aligned(64)));``. -With the assertions enabled and stock bindgen 0.73.2, an arm64 Apple -silicon configuration of this tree fails on the size of ``ns_common`` and of -the namespace structures that embed it; bindgen 0.73.1 also fails on -``task_struct``, ``zone`` and ``pglist_data``. In those builds every offset -and alignment assertion passes: bindgen pads each field to the offset Clang -reports, so only the end of the Rust type is short. Rust code that reaches -such a type through a pointer and reads its fields gets the right data, but -must not rely on ``size_of`` for it, copy it by value or index an array of -it. The affected types depend on the bindgen version and the configuration, -which is what the check is for. +The earlier Fedora configuration exposed only trailing size differences for +some namespace types. That observation does not extend to defconfig: an +aligned empty member can also shift field offsets. Neither size nor offset +mismatches are safe to ignore. The affected types depend on the generator +version and the resolved kernel configuration, so validate each build. Corrected generator ------------------- @@ -56,7 +50,7 @@ repair both cases, a private build recipe and compile-only tests; see ``tools/aurora-bindgen/README.rst``. It installs nothing system-wide. To check the layouts with it:: - make LLVM=1 BINDGEN=/path/to/bindgen BINDGEN_LAYOUT_TESTS=1 ... + make LLVM=1 BINDGEN=/path/to/bindgen ... The generated bindings are consumed by the Rust kernel crate and by several drivers. After changing the bindings generator, rebuild the kernel Image and @@ -64,5 +58,10 @@ all modules together. The assertions need bindgen 0.71.1 or later (the kernel minimum) together with the configured ``--rust-target 1.85``: that selects unconditional constant -assertions rather than ``#[test]`` functions, so a build with -``BINDGEN_LAYOUT_TESTS=1`` checks them without a Rust test configuration. +assertions rather than ``#[test]`` functions. They are checked without a +Rust test configuration. + +Pass ``BINDGEN=/absolute/path/to/bindgen`` as a make command-line argument. +Exporting it in the environment is insufficient: the top-level Makefile's +``BINDGEN = bindgen`` assignment takes precedence over an environment value. +Check the recorded bindings command, not just the toolchain version banner. diff --git a/rust/Makefile b/rust/Makefile index f9b22e936fa40..b5ba0c3176bce 100644 --- a/rust/Makefile +++ b/rust/Makefile @@ -513,23 +513,16 @@ endif # architecture instead of generating `usize`. bindgen_c_flags_final = $(bindgen_c_flags_lto) -fno-builtin -D__BINDGEN__ -# Layout assertions are off by default, as upstream: stock bindgen 0.73 -# computes a different total size for a few kernel types, so the bindings -# would not build with it. `make BINDGEN_LAYOUT_TESTS=1` keeps them, for -# checking a bindings generator; see -# Documentation/rust/bindgen-layout-checks.rst. -ifeq ($(BINDGEN_LAYOUT_TESTS),1) -bindgen_layout_flags := -else -bindgen_layout_flags := --no-layout-tests -endif +# Keep bindgen's unconditional layout assertions in every build. An empty, +# cacheline-aligned sched_statistics (CONFIG_SCHEDSTATS=n) exposes a generator +# bug that shifts task_struct.mm, so even pointer field access can be unsafe. +# See Documentation/rust/bindgen-layout-checks.rst for the corrected generator. # `--rust-target` points to our minimum supported Rust version. quiet_cmd_bindgen = BINDGEN $@ cmd_bindgen = \ $(BINDGEN) $< $(bindgen_target_flags) --rust-target 1.85 \ --use-core --with-derive-default --ctypes-prefix ffi \ - $(bindgen_layout_flags) \ --no-debug '.*' --enable-function-attribute-detection \ -o $@ -- $(bindgen_c_flags_final) -DMODULE \ $(bindgen_target_cflags) $(bindgen_target_extra) diff --git a/tools/aurora-bindgen/README.rst b/tools/aurora-bindgen/README.rst index 75d4c3a2480e7..35e4b6eb8a274 100644 --- a/tools/aurora-bindgen/README.rst +++ b/tools/aurora-bindgen/README.rst @@ -25,10 +25,10 @@ locked dependency graph is used, with at most two build jobs. ``--archive`` can supply an already downloaded source archive; its digest is still checked. The script builds and runs compile-only valid-input checks, then prints the exact ``BINDGEN=/absolute/path/to/bindgen`` make argument. It installs nothing globally. -The kernel build passes ``--no-layout-tests`` to bindgen unless -``BINDGEN_LAYOUT_TESTS=1`` is given, so add that variable to check layouts -with the private tool, and build the complete kernel Image and matching -modules with the same tool. +The kernel always retains layout assertions. Pass the printed ``BINDGEN=`` +argument on the make command line; an exported environment variable is +overridden by the top-level Makefile. Build the complete kernel Image and +matching modules with the same tool. Both scripts reject optimized Python (``-O``, ``-OO`` or ``PYTHONOPTIMIZE``) before creating output, since their validation assertions must remain enabled. @@ -70,14 +70,14 @@ generator, and its changes and both tool digests belong in the build record. Repository guard and supported tool versions -------------------------------------------- -By default the kernel passes ``--no-layout-tests``, as upstream, so stock -bindgen builds it; ``make BINDGEN_LAYOUT_TESTS=1`` keeps the layout checks -(see ``Documentation/rust/bindgen-layout-checks.rst``). Its minimum bindgen is +Every kernel build keeps the layout checks (see +``Documentation/rust/bindgen-layout-checks.rst``). Stock bindgen can fail these +checks for valid configurations; use the corrected generator rather than +disabling the assertions or changing configuration to hide a layout bug. Its minimum bindgen is 0.71.1, and its fixed ``--rust-target 1.85`` enables the ``offset_of`` feature (available from Rust 1.77). In both official 0.71.1 and the pinned 0.73.2 generator, that feature selects unconditional const size/alignment/offset -assertions rather than ``#[test]`` functions. A bindings crate compile with -``BINDGEN_LAYOUT_TESTS=1`` therefore checks layouts without requiring a Rust +assertions rather than ``#[test]`` functions. A bindings crate compile therefore checks layouts without requiring a Rust unit-test configuration. This is source-backed for the accepted minimum and pinned tool; future generator changes must retain that capability. @@ -87,6 +87,6 @@ Primary sources: * https://github.com/rust-lang/rust-bindgen/blob/v0.71.1/bindgen/codegen/mod.rs * https://github.com/rust-lang/rust-bindgen/tree/v0.73.2 -A complete kernel build with ``BINDGEN_LAYOUT_TESTS=1`` remains the +A complete kernel build remains the configuration-specific layout check; these small generator fixtures do not replace it or establish runtime GPU stability. diff --git a/tools/aurora-bindgen/build.py b/tools/aurora-bindgen/build.py index 7aa222cc028bb..fa87873098480 100644 --- a/tools/aurora-bindgen/build.py +++ b/tools/aurora-bindgen/build.py @@ -22,4 +22,4 @@ cmd=['cargo','build','--locked','--release','-p','bindgen-cli','-j'+str(a.jobs)] with (O/'build.log').open('w') as log:subprocess.run(cmd,cwd=S,stdout=log,stderr=subprocess.STDOUT,check=True) binary=S/'target/release/bindgen';subprocess.run([sys.executable,str(P/'test.py'),'--bindgen',str(binary),'--output-dir',str(O/'tests')],check=True) -r={'status':'BUILT_AND_COMPILE_TESTED','binary':str(binary),'binary_sha256':sha(binary),'source_manifest_sha256':sha(P/'sources.json'),'build_command':cmd,'rustc_version':subprocess.check_output(['rustc','-vV'],text=True),'cargo_version':subprocess.check_output(['cargo','-vV'],text=True),'tests_manifest_sha256':sha(O/'tests/result.json'),'installed_globally':False};(O/'result.json').write_text(json.dumps(r,indent=2)+'\n');print(json.dumps(r,indent=2));print('Use make BINDGEN='+str(binary)+' BINDGEN_LAYOUT_TESTS=1 ... to build the kernel with layout assertions.') +r={'status':'BUILT_AND_COMPILE_TESTED','binary':str(binary),'binary_sha256':sha(binary),'source_manifest_sha256':sha(P/'sources.json'),'build_command':cmd,'rustc_version':subprocess.check_output(['rustc','-vV'],text=True),'cargo_version':subprocess.check_output(['cargo','-vV'],text=True),'tests_manifest_sha256':sha(O/'tests/result.json'),'installed_globally':False};(O/'result.json').write_text(json.dumps(r,indent=2)+'\n');print(json.dumps(r,indent=2));print('Use make BINDGEN='+str(binary)+' ... to build the kernel with layout assertions.') From 551e4e5d6dc51116269ff925c4bc41c8f9c3c092 Mon Sep 17 00:00:00 2001 From: Ryan Murray Date: Mon, 26 Oct 2026 20:06:26 +1100 Subject: [PATCH 07/10] arm64: restore common distro and peripheral requirements in asahi.config Keep defconfig plus the single shared fragment while restoring SELinux and its LSM policy order, nftables and NAT, container and systemd requirements, filesystems, hardening, desktop compatibility and attached USB peripherals. Do not enable scheduler statistics to hide an invalid Rust binding layout. --- arch/arm64/configs/asahi.config | 1265 ++++++++++++++++++++++++++++++- 1 file changed, 1262 insertions(+), 3 deletions(-) diff --git a/arch/arm64/configs/asahi.config b/arch/arm64/configs/asahi.config index d07b70afd9294..60d8a679594ef 100644 --- a/arch/arm64/configs/asahi.config +++ b/arch/arm64/configs/asahi.config @@ -1,7 +1,7 @@ -# Shared Apple Silicon hardware defaults for M1 and later, including Neo. -# Merge over ARM64 defconfig or a distribution base config, then run +# Shared Apple Silicon hardware and distribution defaults for M1 and later. +# Merge over ARM64 defconfig, then run # olddefconfig and verify that the requested settings survive resolution. -# Device-specific boot, debug and distribution policy stays in the base. +# One fragment serves every device; distribution policy is selected at runtime. CONFIG_RUST=y CONFIG_ARM64_16K_PAGES=y CONFIG_ARM64_VA_BITS_48=y @@ -98,3 +98,1262 @@ CONFIG_RDMA_RXE=m CONFIG_RDMA_SIW=m CONFIG_DMABUF_HEAPS_SYSTEM=y CONFIG_UDMABUF=y + +# Distribution requirements for the universal defconfig recipe. + +# Security policy, audit and labelled filesystems for the supported distributions. +CONFIG_AUDIT=y +CONFIG_AUDITSYSCALL=y +CONFIG_DEFAULT_SECURITY_SELINUX=y +CONFIG_EXT4_FS_POSIX_ACL=y +CONFIG_EXT4_FS_SECURITY=y +CONFIG_KEYS=y +CONFIG_KEYS_REQUEST_CACHE=y +CONFIG_LOAD_UEFI_KEYS=y +CONFIG_LSM="lockdown,yama,integrity,selinux,bpf,landlock,ipe" +CONFIG_SECONDARY_TRUSTED_KEYRING=y +CONFIG_SECURITY=y +CONFIG_SECURITYFS=y +CONFIG_SECURITY_DMESG_RESTRICT=y +CONFIG_SECURITY_INFINIBAND=y +CONFIG_SECURITY_IPE=y +CONFIG_SECURITY_LANDLOCK=y +CONFIG_SECURITY_LANDLOCK_LOG=y +CONFIG_SECURITY_LOCKDOWN_LSM=y +CONFIG_SECURITY_LOCKDOWN_LSM_EARLY=y +CONFIG_SECURITY_NETWORK=y +CONFIG_SECURITY_NETWORK_XFRM=y +CONFIG_SECURITY_PATH=y +CONFIG_SECURITY_SELINUX=y +CONFIG_SECURITY_SELINUX_AVC_STATS=y +CONFIG_SECURITY_SELINUX_BOOTPARAM=y +CONFIG_SECURITY_SELINUX_DEVELOP=y +CONFIG_SECURITY_YAMA=y +CONFIG_SYSTEM_BLACKLIST_KEYRING=y +CONFIG_SYSTEM_TRUSTED_KEYRING=y +CONFIG_TMPFS_POSIX_ACL=y +CONFIG_TMPFS_XATTR=y +CONFIG_XFRM=y +CONFIG_XFRM_USER=y + +# Integrity appraisal and verified storage; distribution policy controls enforcement. +CONFIG_EVM=y +CONFIG_EVM_ATTR_FSUUID=y +CONFIG_FS_ENCRYPTION=y +CONFIG_FS_ENCRYPTION_ALGS=y +CONFIG_FS_ENCRYPTION_INLINE_CRYPT=y +CONFIG_FS_VERITY=y +CONFIG_IMA=y +CONFIG_IMA_APPRAISE=y +CONFIG_IMA_APPRAISE_BOOTPARAM=y +CONFIG_IMA_APPRAISE_MODSIG=y +CONFIG_IMA_ARCH_POLICY=y +CONFIG_IMA_DEFAULT_HASH="sha256" +CONFIG_IMA_DEFAULT_HASH_SHA256=y +CONFIG_IMA_DEFAULT_TEMPLATE="ima-ng" +CONFIG_IMA_KEXEC=y +CONFIG_IMA_KEXEC_EXTRA_MEMORY_KB=0 +CONFIG_IMA_KEYRINGS_PERMIT_SIGNED_BY_BUILTIN_OR_SECONDARY=y +CONFIG_IMA_LSM_RULES=y +CONFIG_IMA_MEASURE_ASYMMETRIC_KEYS=y +CONFIG_IMA_MEASURE_PCR_IDX=10 +CONFIG_IMA_NG_TEMPLATE=y +CONFIG_IMA_QUEUE_EARLY_BOOT_KEYS=y +CONFIG_IMA_READ_POLICY=y +CONFIG_IMA_SECURE_AND_OR_TRUSTED_BOOT=y +CONFIG_IMA_WRITE_POLICY=y +CONFIG_INTEGRITY=y +CONFIG_INTEGRITY_ASYMMETRIC_KEYS=y +CONFIG_INTEGRITY_AUDIT=y +CONFIG_INTEGRITY_CA_MACHINE_KEYRING=y +CONFIG_INTEGRITY_CA_MACHINE_KEYRING_MAX=y +CONFIG_INTEGRITY_MACHINE_KEYRING=y +CONFIG_INTEGRITY_PLATFORM_KEYRING=y +CONFIG_INTEGRITY_SIGNATURE=y +CONFIG_INTEGRITY_TRUSTED_KEYRING=y + +# Firewalld nftables, IPv4/IPv6/bridge filtering, NAT, sets and iptables compatibility. +CONFIG_BRIDGE=m +CONFIG_BRIDGE_EBT_802_3=m +CONFIG_BRIDGE_EBT_AMONG=m +CONFIG_BRIDGE_EBT_ARP=m +CONFIG_BRIDGE_EBT_ARPREPLY=m +CONFIG_BRIDGE_EBT_BROUTE=m +CONFIG_BRIDGE_EBT_DNAT=m +CONFIG_BRIDGE_EBT_IP=m +CONFIG_BRIDGE_EBT_IP6=m +CONFIG_BRIDGE_EBT_LIMIT=m +CONFIG_BRIDGE_EBT_LOG=m +CONFIG_BRIDGE_EBT_MARK=m +CONFIG_BRIDGE_EBT_MARK_T=m +CONFIG_BRIDGE_EBT_NFLOG=m +CONFIG_BRIDGE_EBT_PKTTYPE=m +CONFIG_BRIDGE_EBT_REDIRECT=m +CONFIG_BRIDGE_EBT_SNAT=m +CONFIG_BRIDGE_EBT_STP=m +CONFIG_BRIDGE_EBT_T_FILTER=m +CONFIG_BRIDGE_EBT_T_NAT=m +CONFIG_BRIDGE_EBT_VLAN=m +CONFIG_BRIDGE_NETFILTER=m +CONFIG_BRIDGE_NF_EBTABLES=m +CONFIG_BRIDGE_NF_EBTABLES_LEGACY=m +CONFIG_IP6_NF_FILTER=m +CONFIG_IP6_NF_IPTABLES=m +CONFIG_IP6_NF_IPTABLES_LEGACY=m +CONFIG_IP6_NF_MANGLE=m +CONFIG_IP6_NF_MATCH_AH=m +CONFIG_IP6_NF_MATCH_EUI64=m +CONFIG_IP6_NF_MATCH_FRAG=m +CONFIG_IP6_NF_MATCH_HL=m +CONFIG_IP6_NF_MATCH_IPV6HEADER=m +CONFIG_IP6_NF_MATCH_MH=m +CONFIG_IP6_NF_MATCH_OPTS=m +CONFIG_IP6_NF_MATCH_RPFILTER=m +CONFIG_IP6_NF_MATCH_RT=m +CONFIG_IP6_NF_MATCH_SRH=m +CONFIG_IP6_NF_NAT=m +CONFIG_IP6_NF_RAW=m +CONFIG_IP6_NF_SECURITY=m +CONFIG_IP6_NF_TARGET_HL=m +CONFIG_IP6_NF_TARGET_MASQUERADE=m +CONFIG_IP6_NF_TARGET_NPT=m +CONFIG_IP6_NF_TARGET_REJECT=m +CONFIG_IP6_NF_TARGET_SYNPROXY=m +CONFIG_IP_NF_ARPFILTER=m +CONFIG_IP_NF_ARPTABLES=m +CONFIG_IP_NF_ARP_MANGLE=m +CONFIG_IP_NF_FILTER=m +CONFIG_IP_NF_IPTABLES=m +CONFIG_IP_NF_IPTABLES_LEGACY=m +CONFIG_IP_NF_MANGLE=m +CONFIG_IP_NF_MATCH_AH=m +CONFIG_IP_NF_MATCH_ECN=m +CONFIG_IP_NF_MATCH_RPFILTER=m +CONFIG_IP_NF_MATCH_TTL=m +CONFIG_IP_NF_NAT=m +CONFIG_IP_NF_RAW=m +CONFIG_IP_NF_SECURITY=m +CONFIG_IP_NF_TARGET_ECN=m +CONFIG_IP_NF_TARGET_MASQUERADE=m +CONFIG_IP_NF_TARGET_NETMAP=m +CONFIG_IP_NF_TARGET_REDIRECT=m +CONFIG_IP_NF_TARGET_REJECT=m +CONFIG_IP_NF_TARGET_SYNPROXY=m +CONFIG_IP_NF_TARGET_TTL=m +CONFIG_IP_SET=m +CONFIG_IP_SET_BITMAP_IP=m +CONFIG_IP_SET_BITMAP_IPMAC=m +CONFIG_IP_SET_BITMAP_PORT=m +CONFIG_IP_SET_HASH_IP=m +CONFIG_IP_SET_HASH_IPMAC=m +CONFIG_IP_SET_HASH_IPMARK=m +CONFIG_IP_SET_HASH_IPPORT=m +CONFIG_IP_SET_HASH_IPPORTIP=m +CONFIG_IP_SET_HASH_IPPORTNET=m +CONFIG_IP_SET_HASH_MAC=m +CONFIG_IP_SET_HASH_NET=m +CONFIG_IP_SET_HASH_NETIFACE=m +CONFIG_IP_SET_HASH_NETNET=m +CONFIG_IP_SET_HASH_NETPORT=m +CONFIG_IP_SET_HASH_NETPORTNET=m +CONFIG_IP_SET_LIST_SET=m +CONFIG_IP_SET_MAX=256 +CONFIG_NETFILTER=y +CONFIG_NETFILTER_ADVANCED=y +CONFIG_NETFILTER_BPF_LINK=y +CONFIG_NETFILTER_CONNCOUNT=m +CONFIG_NETFILTER_EGRESS=y +CONFIG_NETFILTER_FAMILY_ARP=y +CONFIG_NETFILTER_FAMILY_BRIDGE=y +CONFIG_NETFILTER_INGRESS=y +CONFIG_NETFILTER_NETLINK=y +CONFIG_NETFILTER_NETLINK_ACCT=m +CONFIG_NETFILTER_NETLINK_GLUE_CT=y +CONFIG_NETFILTER_NETLINK_HOOK=m +CONFIG_NETFILTER_NETLINK_LOG=m +CONFIG_NETFILTER_NETLINK_OSF=m +CONFIG_NETFILTER_NETLINK_QUEUE=m +CONFIG_NETFILTER_SKIP_EGRESS=y +CONFIG_NETFILTER_SYNPROXY=m +CONFIG_NETFILTER_XTABLES=y +CONFIG_NETFILTER_XTABLES_LEGACY=y +CONFIG_NETFILTER_XT_CONNMARK=m +CONFIG_NETFILTER_XT_MARK=m +CONFIG_NETFILTER_XT_MATCH_ADDRTYPE=m +CONFIG_NETFILTER_XT_MATCH_BPF=m +CONFIG_NETFILTER_XT_MATCH_CGROUP=m +CONFIG_NETFILTER_XT_MATCH_CLUSTER=m +CONFIG_NETFILTER_XT_MATCH_COMMENT=m +CONFIG_NETFILTER_XT_MATCH_CONNBYTES=m +CONFIG_NETFILTER_XT_MATCH_CONNLABEL=m +CONFIG_NETFILTER_XT_MATCH_CONNLIMIT=m +CONFIG_NETFILTER_XT_MATCH_CONNMARK=m +CONFIG_NETFILTER_XT_MATCH_CONNTRACK=m +CONFIG_NETFILTER_XT_MATCH_CPU=m +CONFIG_NETFILTER_XT_MATCH_DCCP=m +CONFIG_NETFILTER_XT_MATCH_DEVGROUP=m +CONFIG_NETFILTER_XT_MATCH_DSCP=m +CONFIG_NETFILTER_XT_MATCH_ECN=m +CONFIG_NETFILTER_XT_MATCH_ESP=m +CONFIG_NETFILTER_XT_MATCH_HASHLIMIT=m +CONFIG_NETFILTER_XT_MATCH_HELPER=m +CONFIG_NETFILTER_XT_MATCH_HL=m +CONFIG_NETFILTER_XT_MATCH_IPCOMP=m +CONFIG_NETFILTER_XT_MATCH_IPRANGE=m +CONFIG_NETFILTER_XT_MATCH_IPVS=m +CONFIG_NETFILTER_XT_MATCH_L2TP=m +CONFIG_NETFILTER_XT_MATCH_LENGTH=m +CONFIG_NETFILTER_XT_MATCH_LIMIT=m +CONFIG_NETFILTER_XT_MATCH_MAC=m +CONFIG_NETFILTER_XT_MATCH_MARK=m +CONFIG_NETFILTER_XT_MATCH_MULTIPORT=m +CONFIG_NETFILTER_XT_MATCH_NFACCT=m +CONFIG_NETFILTER_XT_MATCH_OSF=m +CONFIG_NETFILTER_XT_MATCH_OWNER=m +CONFIG_NETFILTER_XT_MATCH_PHYSDEV=m +CONFIG_NETFILTER_XT_MATCH_PKTTYPE=m +CONFIG_NETFILTER_XT_MATCH_POLICY=m +CONFIG_NETFILTER_XT_MATCH_QUOTA=m +CONFIG_NETFILTER_XT_MATCH_RATEEST=m +CONFIG_NETFILTER_XT_MATCH_REALM=m +CONFIG_NETFILTER_XT_MATCH_RECENT=m +CONFIG_NETFILTER_XT_MATCH_SCTP=m +CONFIG_NETFILTER_XT_MATCH_SOCKET=m +CONFIG_NETFILTER_XT_MATCH_STATE=m +CONFIG_NETFILTER_XT_MATCH_STATISTIC=m +CONFIG_NETFILTER_XT_MATCH_STRING=m +CONFIG_NETFILTER_XT_MATCH_TCPMSS=m +CONFIG_NETFILTER_XT_MATCH_TIME=m +CONFIG_NETFILTER_XT_MATCH_U32=m +CONFIG_NETFILTER_XT_NAT=m +CONFIG_NETFILTER_XT_SET=m +CONFIG_NETFILTER_XT_TARGET_AUDIT=m +CONFIG_NETFILTER_XT_TARGET_CHECKSUM=m +CONFIG_NETFILTER_XT_TARGET_CLASSIFY=m +CONFIG_NETFILTER_XT_TARGET_CONNMARK=m +CONFIG_NETFILTER_XT_TARGET_CONNSECMARK=m +CONFIG_NETFILTER_XT_TARGET_CT=m +CONFIG_NETFILTER_XT_TARGET_DSCP=m +CONFIG_NETFILTER_XT_TARGET_HL=m +CONFIG_NETFILTER_XT_TARGET_HMARK=m +CONFIG_NETFILTER_XT_TARGET_IDLETIMER=m +CONFIG_NETFILTER_XT_TARGET_LED=m +CONFIG_NETFILTER_XT_TARGET_LOG=m +CONFIG_NETFILTER_XT_TARGET_MARK=m +CONFIG_NETFILTER_XT_TARGET_MASQUERADE=m +CONFIG_NETFILTER_XT_TARGET_NETMAP=m +CONFIG_NETFILTER_XT_TARGET_NFLOG=m +CONFIG_NETFILTER_XT_TARGET_NFQUEUE=m +CONFIG_NETFILTER_XT_TARGET_NOTRACK=m +CONFIG_NETFILTER_XT_TARGET_RATEEST=m +CONFIG_NETFILTER_XT_TARGET_REDIRECT=m +CONFIG_NETFILTER_XT_TARGET_SECMARK=m +CONFIG_NETFILTER_XT_TARGET_TCPMSS=m +CONFIG_NETFILTER_XT_TARGET_TCPOPTSTRIP=m +CONFIG_NETFILTER_XT_TARGET_TEE=m +CONFIG_NETFILTER_XT_TARGET_TPROXY=m +CONFIG_NETFILTER_XT_TARGET_TRACE=m +CONFIG_NFT_BRIDGE_META=m +CONFIG_NFT_BRIDGE_REJECT=m +CONFIG_NFT_COMPAT=m +CONFIG_NFT_COMPAT_ARP=m +CONFIG_NFT_CONNLIMIT=m +CONFIG_NFT_CT=m +CONFIG_NFT_DUP_IPV4=m +CONFIG_NFT_DUP_IPV6=m +CONFIG_NFT_DUP_NETDEV=m +CONFIG_NFT_FIB=m +CONFIG_NFT_FIB_INET=m +CONFIG_NFT_FIB_IPV4=m +CONFIG_NFT_FIB_IPV6=m +CONFIG_NFT_FIB_NETDEV=m +CONFIG_NFT_FLOW_OFFLOAD=m +CONFIG_NFT_FWD_NETDEV=m +CONFIG_NFT_HASH=m +CONFIG_NFT_LIMIT=m +CONFIG_NFT_LOG=m +CONFIG_NFT_MASQ=m +CONFIG_NFT_NAT=m +CONFIG_NFT_NUMGEN=m +CONFIG_NFT_OSF=m +CONFIG_NFT_QUEUE=m +CONFIG_NFT_QUOTA=m +CONFIG_NFT_REDIR=m +CONFIG_NFT_REJECT=m +CONFIG_NFT_REJECT_INET=m +CONFIG_NFT_REJECT_IPV4=m +CONFIG_NFT_REJECT_IPV6=m +CONFIG_NFT_REJECT_NETDEV=m +CONFIG_NFT_SOCKET=m +CONFIG_NFT_SYNPROXY=m +CONFIG_NFT_TPROXY=m +CONFIG_NFT_TUNNEL=m +CONFIG_NFT_XFRM=m +CONFIG_NF_CONNTRACK=m +CONFIG_NF_CONNTRACK_AMANDA=m +CONFIG_NF_CONNTRACK_BRIDGE=m +CONFIG_NF_CONNTRACK_BROADCAST=m +CONFIG_NF_CONNTRACK_EVENTS=y +CONFIG_NF_CONNTRACK_FTP=m +CONFIG_NF_CONNTRACK_H323=m +CONFIG_NF_CONNTRACK_IRC=m +CONFIG_NF_CONNTRACK_LABELS=y +CONFIG_NF_CONNTRACK_MARK=y +CONFIG_NF_CONNTRACK_NETBIOS_NS=m +CONFIG_NF_CONNTRACK_OVS=y +CONFIG_NF_CONNTRACK_PPTP=m +CONFIG_NF_CONNTRACK_PROCFS=y +CONFIG_NF_CONNTRACK_SANE=m +CONFIG_NF_CONNTRACK_SECMARK=y +CONFIG_NF_CONNTRACK_SIP=m +CONFIG_NF_CONNTRACK_SNMP=m +CONFIG_NF_CONNTRACK_TFTP=m +CONFIG_NF_CONNTRACK_TIMEOUT=y +CONFIG_NF_CONNTRACK_TIMESTAMP=y +CONFIG_NF_CONNTRACK_ZONES=y +CONFIG_NF_CT_NETLINK=m +CONFIG_NF_CT_NETLINK_HELPER=m +CONFIG_NF_CT_NETLINK_TIMEOUT=m +CONFIG_NF_CT_PROTO_GRE=y +CONFIG_NF_CT_PROTO_SCTP=y +CONFIG_NF_DEFRAG_IPV4=m +CONFIG_NF_DEFRAG_IPV6=m +CONFIG_NF_DUP_IPV4=m +CONFIG_NF_DUP_IPV6=m +CONFIG_NF_DUP_NETDEV=m +CONFIG_NF_FLOW_TABLE=m +CONFIG_NF_FLOW_TABLE_INET=m +CONFIG_NF_FLOW_TABLE_PROCFS=y +CONFIG_NF_LOG_ARP=m +CONFIG_NF_LOG_IPV4=m +CONFIG_NF_LOG_IPV6=m +CONFIG_NF_LOG_SYSLOG=m +CONFIG_NF_NAT=m +CONFIG_NF_NAT_AMANDA=m +CONFIG_NF_NAT_FTP=m +CONFIG_NF_NAT_H323=m +CONFIG_NF_NAT_IRC=m +CONFIG_NF_NAT_MASQUERADE=y +CONFIG_NF_NAT_OVS=y +CONFIG_NF_NAT_PPTP=m +CONFIG_NF_NAT_REDIRECT=y +CONFIG_NF_NAT_SIP=m +CONFIG_NF_NAT_SNMP_BASIC=m +CONFIG_NF_NAT_TFTP=m +CONFIG_NF_REJECT_IPV4=m +CONFIG_NF_REJECT_IPV6=m +CONFIG_NF_SOCKET_IPV4=m +CONFIG_NF_SOCKET_IPV6=m +CONFIG_NF_TABLES=m +CONFIG_NF_TABLES_ARP=y +CONFIG_NF_TABLES_BRIDGE=m +CONFIG_NF_TABLES_INET=y +CONFIG_NF_TABLES_IPV4=y +CONFIG_NF_TABLES_IPV6=y +CONFIG_NF_TABLES_NETDEV=y +CONFIG_NF_TPROXY_IPV4=m +CONFIG_NF_TPROXY_IPV6=m + +# systemd and rootless containers: namespaces, cgroup v2 controllers, seccomp, BPF and pressure reporting. +CONFIG_BLK_CGROUP=y +CONFIG_BPF=y +CONFIG_BPF_EVENTS=y +CONFIG_BPF_JIT=y +CONFIG_BPF_JIT_ALWAYS_ON=y +CONFIG_BPF_LSM=y +CONFIG_BPF_SYSCALL=y +CONFIG_CFS_BANDWIDTH=y +CONFIG_CGROUPS=y +CONFIG_CGROUP_BPF=y +CONFIG_CGROUP_CPUACCT=y +CONFIG_CGROUP_DMEM=y +CONFIG_CGROUP_FREEZER=y +CONFIG_CGROUP_MISC=y +CONFIG_CGROUP_NET_CLASSID=y +CONFIG_CGROUP_NET_PRIO=y +CONFIG_CGROUP_PIDS=y +CONFIG_CGROUP_RDMA=y +CONFIG_CGROUP_SCHED=y +CONFIG_CHECKPOINT_RESTORE=y +CONFIG_CPUSETS=y +CONFIG_DEVTMPFS=y +CONFIG_DEVTMPFS_MOUNT=y +CONFIG_EFIVAR_FS=y +CONFIG_EFI_PARTITION=y +CONFIG_EPOLL=y +CONFIG_FAIR_GROUP_SCHED=y +CONFIG_FANOTIFY=y +CONFIG_FANOTIFY_ACCESS_PERMISSIONS=y +CONFIG_FHANDLE=y +CONFIG_INOTIFY_USER=y +CONFIG_IPC_NS=y +CONFIG_KCMP=y +CONFIG_MEMCG=y +CONFIG_NAMESPACES=y +CONFIG_NET_NS=y +CONFIG_NET_SCHED=y +CONFIG_NET_SCH_FQ_CODEL=y +CONFIG_PID_NS=y +CONFIG_POSIX_MQUEUE=y +CONFIG_PROC_FS=y +CONFIG_PSI=y +CONFIG_SECCOMP=y +CONFIG_SECCOMP_FILTER=y +CONFIG_SHMEM=y +CONFIG_SIGNALFD=y +CONFIG_SYSFS=y +CONFIG_TIMERFD=y +CONFIG_TIME_NS=y +CONFIG_TMPFS=y +CONFIG_UNIX=y +CONFIG_USER_NS=y +CONFIG_UTS_NS=y + +# Container networking, VPNs and the t-3155 distribution compatibility gate. +CONFIG_APPLE_PMC=y +CONFIG_BINFMT_MISC=m +CONFIG_BRCMFMAC=m +CONFIG_GENEVE=m +CONFIG_HIDRAW=y +CONFIG_INPUT_UINPUT=m +CONFIG_IPV6_MULTIPLE_TABLES=y +CONFIG_IPVLAN=m +CONFIG_IP_ADVANCED_ROUTER=y +CONFIG_IP_MULTIPLE_TABLES=y +CONFIG_IP_ROUTE_MULTIPATH=y +CONFIG_MACVLAN=m +CONFIG_MACVTAP=m +CONFIG_NET_CLS_CGROUP=y +CONFIG_NTSYNC=m +CONFIG_OPENVSWITCH=m +CONFIG_TUN=m +CONFIG_UCLAMP_TASK=y +CONFIG_UCLAMP_TASK_GROUP=y +CONFIG_USERFAULTFD=y +CONFIG_VETH=m +CONFIG_VHOST_NET=m +CONFIG_VHOST_VSOCK=m +CONFIG_VIRTIO_VSOCKETS=m +CONFIG_VSOCKETS=m +CONFIG_VXLAN=m +CONFIG_WIREGUARD=m +CONFIG_ZRAM=m + +# Filesystems, quotas and network shares used by distribution installations and removable media. +CONFIG_AUTOFS_FS=y +CONFIG_BLK_DEV_ZONED=y +CONFIG_BTRFS_FS=y +CONFIG_BTRFS_FS_POSIX_ACL=y +CONFIG_CACHEFILES=m +CONFIG_CIFS=m +CONFIG_CIFS_DFS_UPCALL=y +CONFIG_CIFS_FSCACHE=y +CONFIG_CIFS_POSIX=y +CONFIG_CIFS_SWN_UPCALL=y +CONFIG_CIFS_UPCALL=y +CONFIG_CIFS_XATTR=y +CONFIG_CUSE=m +CONFIG_DAX=y +CONFIG_EXFAT_DEFAULT_IOCHARSET="utf8" +CONFIG_EXFAT_FS=m +CONFIG_EXT4_FS=y +CONFIG_EXT4_USE_FOR_EXT2=y +CONFIG_F2FS_FS=m +CONFIG_F2FS_FS_COMPRESSION=y +CONFIG_F2FS_FS_LZ4=y +CONFIG_F2FS_FS_LZ4HC=y +CONFIG_F2FS_FS_LZO=y +CONFIG_F2FS_FS_LZORLE=y +CONFIG_F2FS_FS_POSIX_ACL=y +CONFIG_F2FS_FS_SECURITY=y +CONFIG_F2FS_FS_XATTR=y +CONFIG_F2FS_FS_ZSTD=y +CONFIG_F2FS_IOSTAT=y +CONFIG_F2FS_STAT_FS=y +CONFIG_F2FS_UNFAIR_RWSEM=y +CONFIG_FAT_FS=m +CONFIG_FSCACHE=y +CONFIG_FSCACHE_STATS=y +CONFIG_FS_DAX=y +CONFIG_FUSE_DAX=y +CONFIG_FUSE_FS=m +CONFIG_FUSE_IO_URING=y +CONFIG_FUSE_PASSTHROUGH=y +CONFIG_LCD_CLASS_DEVICE=m +CONFIG_NFSD=m +CONFIG_NFSD_BLOCKLAYOUT=y +CONFIG_NFSD_FLEXFILELAYOUT=y +CONFIG_NFSD_PNFS=y +CONFIG_NFSD_SCSILAYOUT=y +CONFIG_NFSD_V3_ACL=y +CONFIG_NFSD_V4=y +CONFIG_NFSD_V4_2_INTER_SSC=y +CONFIG_NFSD_V4_POSIX_ACLS=y +CONFIG_NFSD_V4_SECURITY_LABEL=y +CONFIG_NFS_ACL_SUPPORT=m +CONFIG_NFS_COMMON=y +CONFIG_NFS_COMMON_LOCALIO_SUPPORT=m +CONFIG_NFS_DISABLE_UDP_SUPPORT=y +CONFIG_NFS_FS=m +CONFIG_NFS_FSCACHE=y +CONFIG_NFS_LOCALIO=y +CONFIG_NFS_SWAP=y +CONFIG_NFS_USE_KERNEL_DNS=y +CONFIG_NFS_V3=m +CONFIG_NFS_V3_ACL=y +CONFIG_NFS_V4=m +CONFIG_NFS_V4_0=y +CONFIG_NFS_V4_1_IMPLEMENTATION_ID_DOMAIN="kernel.org" +CONFIG_NFS_V4_2=y +CONFIG_NFS_V4_2_SSC_HELPER=y +CONFIG_NFS_V4_SECURITY_LABEL=y +CONFIG_NLS_ASCII=y +CONFIG_NLS_CODEPAGE_1250=m +CONFIG_NLS_CODEPAGE_1251=m +CONFIG_NLS_CODEPAGE_437=y +CONFIG_NLS_CODEPAGE_737=m +CONFIG_NLS_CODEPAGE_775=m +CONFIG_NLS_CODEPAGE_850=m +CONFIG_NLS_CODEPAGE_852=m +CONFIG_NLS_CODEPAGE_855=m +CONFIG_NLS_CODEPAGE_857=m +CONFIG_NLS_CODEPAGE_860=m +CONFIG_NLS_CODEPAGE_861=m +CONFIG_NLS_CODEPAGE_862=m +CONFIG_NLS_CODEPAGE_863=m +CONFIG_NLS_CODEPAGE_864=m +CONFIG_NLS_CODEPAGE_865=m +CONFIG_NLS_CODEPAGE_866=m +CONFIG_NLS_CODEPAGE_869=m +CONFIG_NLS_CODEPAGE_874=m +CONFIG_NLS_CODEPAGE_932=m +CONFIG_NLS_CODEPAGE_936=m +CONFIG_NLS_CODEPAGE_949=m +CONFIG_NLS_CODEPAGE_950=m +CONFIG_NLS_DEFAULT="utf8" +CONFIG_NLS_ISO8859_1=m +CONFIG_NLS_ISO8859_13=m +CONFIG_NLS_ISO8859_14=m +CONFIG_NLS_ISO8859_15=m +CONFIG_NLS_ISO8859_2=m +CONFIG_NLS_ISO8859_3=m +CONFIG_NLS_ISO8859_4=m +CONFIG_NLS_ISO8859_5=m +CONFIG_NLS_ISO8859_6=m +CONFIG_NLS_ISO8859_7=m +CONFIG_NLS_ISO8859_8=m +CONFIG_NLS_ISO8859_9=m +CONFIG_NLS_KOI8_R=m +CONFIG_NLS_KOI8_U=m +CONFIG_NLS_MAC_CELTIC=m +CONFIG_NLS_MAC_CENTEURO=m +CONFIG_NLS_MAC_CROATIAN=m +CONFIG_NLS_MAC_CYRILLIC=m +CONFIG_NLS_MAC_GAELIC=m +CONFIG_NLS_MAC_GREEK=m +CONFIG_NLS_MAC_ICELAND=m +CONFIG_NLS_MAC_INUIT=m +CONFIG_NLS_MAC_ROMAN=m +CONFIG_NLS_MAC_ROMANIAN=m +CONFIG_NLS_MAC_TURKISH=m +CONFIG_NLS_UCS2_UTILS=m +CONFIG_NLS_UTF8=m +CONFIG_NTFS3_FS=m +CONFIG_NTFS3_FS_POSIX_ACL=y +CONFIG_NTFS3_LZX_XPRESS=y +CONFIG_OVERLAY_FS=m +CONFIG_OVERLAY_FS_REDIRECT_ALWAYS_FOLLOW=y +CONFIG_QFMT_V2=y +CONFIG_QUOTA=y +CONFIG_QUOTACTL=y +CONFIG_QUOTA_NETLINK_INTERFACE=y +CONFIG_QUOTA_TREE=y +CONFIG_TMPFS_INODE64=y +CONFIG_TMPFS_QUOTA=y +CONFIG_VFAT_FS=m +CONFIG_VIRTIO_FS=m +CONFIG_XFS_BTREE_IN_MEM=y +CONFIG_XFS_DRAIN_INTENTS=y +CONFIG_XFS_FS=m +CONFIG_XFS_LIVE_HOOKS=y +CONFIG_XFS_MEMORY_BUFS=y +CONFIG_XFS_ONLINE_REPAIR=y +CONFIG_XFS_ONLINE_SCRUB=y +CONFIG_XFS_ONLINE_SCRUB_STATS=y +CONFIG_XFS_POSIX_ACL=y +CONFIG_XFS_QUOTA=y +CONFIG_XFS_RT=y +CONFIG_XFS_SUPPORT_ASCII_CI=y +CONFIG_XFS_SUPPORT_V4=y +CONFIG_ZONE_DEVICE=y + +# Encrypted/root storage, software RAID, compression and zram backends. +CONFIG_ASYMMETRIC_KEY_TYPE=y +CONFIG_ASYMMETRIC_PUBLIC_KEY_SUBTYPE=y +CONFIG_BLK_DEV_DM=y +CONFIG_BLK_DEV_DM_BUILTIN=y +CONFIG_BLK_DEV_MD=y +CONFIG_CRYPTO_842=y +CONFIG_CRYPTO_ACOMP2=y +CONFIG_CRYPTO_ADIANTUM=m +CONFIG_CRYPTO_AEAD=y +CONFIG_CRYPTO_AEAD2=y +CONFIG_CRYPTO_AEGIS128=m +CONFIG_CRYPTO_AEGIS128_SIMD=y +CONFIG_CRYPTO_AES=y +CONFIG_CRYPTO_AES_ARM64_BS=m +CONFIG_CRYPTO_AES_ARM64_CE_BLK=y +CONFIG_CRYPTO_AES_ARM64_CE_CCM=y +CONFIG_CRYPTO_AES_ARM64_NEON_BLK=y +CONFIG_CRYPTO_AKCIPHER=y +CONFIG_CRYPTO_AKCIPHER2=y +CONFIG_CRYPTO_ALGAPI=y +CONFIG_CRYPTO_ALGAPI2=y +CONFIG_CRYPTO_AUTHENC=y +CONFIG_CRYPTO_BENCHMARK=m +CONFIG_CRYPTO_BLAKE2B=y +CONFIG_CRYPTO_BLOWFISH=m +CONFIG_CRYPTO_BLOWFISH_COMMON=m +CONFIG_CRYPTO_CAMELLIA=m +CONFIG_CRYPTO_CAST5=m +CONFIG_CRYPTO_CAST6=m +CONFIG_CRYPTO_CAST_COMMON=m +CONFIG_CRYPTO_CBC=y +CONFIG_CRYPTO_CCM=y +CONFIG_CRYPTO_CHACHA20=m +CONFIG_CRYPTO_CHACHA20POLY1305=m +CONFIG_CRYPTO_CMAC=y +CONFIG_CRYPTO_CRC32=m +CONFIG_CRYPTO_CRC32C=y +CONFIG_CRYPTO_CRYPTD=y +CONFIG_CRYPTO_CTR=y +CONFIG_CRYPTO_CTS=y +CONFIG_CRYPTO_DEFLATE=y +CONFIG_CRYPTO_DES=m +CONFIG_CRYPTO_DH=y +CONFIG_CRYPTO_DH_RFC7919_GROUPS=y +CONFIG_CRYPTO_DRBG=y +CONFIG_CRYPTO_ECB=y +CONFIG_CRYPTO_ECC=y +CONFIG_CRYPTO_ECDH=y +CONFIG_CRYPTO_ECDSA=y +CONFIG_CRYPTO_ECHAINIV=m +CONFIG_CRYPTO_ECRDSA=m +CONFIG_CRYPTO_ESSIV=m +CONFIG_CRYPTO_GCM=y +CONFIG_CRYPTO_GENIV=y +CONFIG_CRYPTO_GHASH_ARM64_CE=m +CONFIG_CRYPTO_HASH=y +CONFIG_CRYPTO_HASH2=y +CONFIG_CRYPTO_HASH_INFO=y +CONFIG_CRYPTO_HCTR2=m +CONFIG_CRYPTO_HMAC=y +CONFIG_CRYPTO_HW=y +CONFIG_CRYPTO_JITTERENTROPY=y +CONFIG_CRYPTO_JITTERENTROPY_MEMORY_BLOCKS=64 +CONFIG_CRYPTO_JITTERENTROPY_MEMORY_BLOCKSIZE=32 +CONFIG_CRYPTO_JITTERENTROPY_OSR=1 +CONFIG_CRYPTO_KPP=y +CONFIG_CRYPTO_KPP2=y +CONFIG_CRYPTO_KRB5=m +CONFIG_CRYPTO_KRB5ENC=m +CONFIG_CRYPTO_LIB_AES=y +CONFIG_CRYPTO_LIB_AES_ARCH=y +CONFIG_CRYPTO_LIB_AES_CBC=y +CONFIG_CRYPTO_LIB_AES_CBC_MACS=y +CONFIG_CRYPTO_LIB_AES_CCM=y +CONFIG_CRYPTO_LIB_AES_CTR=y +CONFIG_CRYPTO_LIB_AES_ECB=y +CONFIG_CRYPTO_LIB_AES_GCM=y +CONFIG_CRYPTO_LIB_AES_XTS=y +CONFIG_CRYPTO_LIB_ARC4=m +CONFIG_CRYPTO_LIB_BLAKE2B=y +CONFIG_CRYPTO_LIB_CHACHA_ARCH=y +CONFIG_CRYPTO_LIB_CURVE25519=m +CONFIG_CRYPTO_LIB_CURVE25519_GENERIC=y +CONFIG_CRYPTO_LIB_DES=m +CONFIG_CRYPTO_LIB_GF128HASH=y +CONFIG_CRYPTO_LIB_GF128HASH_ARCH=y +CONFIG_CRYPTO_LIB_GF128MUL=m +CONFIG_CRYPTO_LIB_MD5=y +CONFIG_CRYPTO_LIB_NH=m +CONFIG_CRYPTO_LIB_NH_ARCH=y +CONFIG_CRYPTO_LIB_POLY1305_ARCH=y +CONFIG_CRYPTO_LIB_POLY1305_GENERIC=y +CONFIG_CRYPTO_LIB_POLY1305_RSIZE=9 +CONFIG_CRYPTO_LIB_SHA1=y +CONFIG_CRYPTO_LIB_SHA1_ARCH=y +CONFIG_CRYPTO_LIB_SHA256=y +CONFIG_CRYPTO_LIB_SHA256_ARCH=y +CONFIG_CRYPTO_LIB_SHA3=y +CONFIG_CRYPTO_LIB_SHA3_ARCH=y +CONFIG_CRYPTO_LIB_SHA512=y +CONFIG_CRYPTO_LIB_SHA512_ARCH=y +CONFIG_CRYPTO_LIB_UTILS=y +CONFIG_CRYPTO_LRW=m +CONFIG_CRYPTO_LZ4=y +CONFIG_CRYPTO_LZ4HC=m +CONFIG_CRYPTO_LZO=y +CONFIG_CRYPTO_MANAGER=y +CONFIG_CRYPTO_MANAGER2=y +CONFIG_CRYPTO_MD4=m +CONFIG_CRYPTO_MD5=y +CONFIG_CRYPTO_NULL=y +CONFIG_CRYPTO_PCRYPT=m +CONFIG_CRYPTO_RMD160=m +CONFIG_CRYPTO_RNG=y +CONFIG_CRYPTO_RNG2=y +CONFIG_CRYPTO_RSA=y +CONFIG_CRYPTO_SELFTESTS=y +CONFIG_CRYPTO_SEQIV=y +CONFIG_CRYPTO_SERPENT=m +CONFIG_CRYPTO_SHA1=y +CONFIG_CRYPTO_SHA256=y +CONFIG_CRYPTO_SHA3=y +CONFIG_CRYPTO_SHA512=y +CONFIG_CRYPTO_SIG=y +CONFIG_CRYPTO_SIG2=y +CONFIG_CRYPTO_SKCIPHER=y +CONFIG_CRYPTO_SKCIPHER2=y +CONFIG_CRYPTO_STREEBOG=m +CONFIG_CRYPTO_TWOFISH=m +CONFIG_CRYPTO_TWOFISH_COMMON=m +CONFIG_CRYPTO_USER=m +CONFIG_CRYPTO_USER_API=y +CONFIG_CRYPTO_USER_API_AEAD=y +CONFIG_CRYPTO_USER_API_HASH=y +CONFIG_CRYPTO_USER_API_RNG=y +CONFIG_CRYPTO_USER_API_SKCIPHER=y +CONFIG_CRYPTO_WP512=m +CONFIG_CRYPTO_XCBC=m +CONFIG_CRYPTO_XCTR=m +CONFIG_CRYPTO_XTS=y +CONFIG_CRYPTO_XXHASH=y +CONFIG_CRYPTO_ZSTD=m +CONFIG_DM_AUDIT=y +CONFIG_DM_BIO_PRISON=m +CONFIG_DM_BUFIO=y +CONFIG_DM_CACHE=m +CONFIG_DM_CACHE_SMQ=m +CONFIG_DM_CLONE=m +CONFIG_DM_CRYPT=m +CONFIG_DM_DELAY=m +CONFIG_DM_DUST=m +CONFIG_DM_EBS=m +CONFIG_DM_ERA=m +CONFIG_DM_FLAKEY=m +CONFIG_DM_INIT=y +CONFIG_DM_INTEGRITY=m +CONFIG_DM_LOG_USERSPACE=m +CONFIG_DM_LOG_WRITES=m +CONFIG_DM_MIRROR=y +CONFIG_DM_MULTIPATH=m +CONFIG_DM_MULTIPATH_HST=m +CONFIG_DM_MULTIPATH_IOA=m +CONFIG_DM_MULTIPATH_QL=m +CONFIG_DM_MULTIPATH_ST=m +CONFIG_DM_PERSISTENT_DATA=m +CONFIG_DM_RAID=m +CONFIG_DM_SNAPSHOT=y +CONFIG_DM_SWITCH=m +CONFIG_DM_THIN_PROVISIONING=m +CONFIG_DM_UEVENT=y +CONFIG_DM_UNSTRIPED=m +CONFIG_DM_VDO=m +CONFIG_DM_VERITY=m +CONFIG_DM_VERITY_FEC=y +CONFIG_DM_VERITY_VERIFY_ROOTHASH_SIG=y +CONFIG_DM_VERITY_VERIFY_ROOTHASH_SIG_PLATFORM_KEYRING=y +CONFIG_DM_VERITY_VERIFY_ROOTHASH_SIG_SECONDARY_KEYRING=y +CONFIG_DM_WRITECACHE=m +CONFIG_DM_ZERO=y +CONFIG_DM_ZONED=m +CONFIG_MD_AUTODETECT=y +CONFIG_MD_BITMAP=y +CONFIG_MD_BITMAP_FILE=y +CONFIG_MD_LINEAR=m +CONFIG_MD_RAID0=m +CONFIG_MD_RAID1=m +CONFIG_MD_RAID10=m +CONFIG_MD_RAID456=m +CONFIG_SYSTEM_DATA_VERIFICATION=y +CONFIG_ZRAM_BACKEND_842=y +CONFIG_ZRAM_BACKEND_DEFLATE=y +CONFIG_ZRAM_BACKEND_LZ4=y +CONFIG_ZRAM_BACKEND_LZ4HC=y +CONFIG_ZRAM_BACKEND_LZO=y +CONFIG_ZRAM_BACKEND_ZSTD=y +CONFIG_ZRAM_DEF_COMP="lzo-rle" +CONFIG_ZRAM_DEF_COMP_LZORLE=y +CONFIG_ZRAM_MULTI_COMP=y +CONFIG_ZRAM_WRITEBACK=y +CONFIG_ZSMALLOC_CHAIN_SIZE=8 + +# Attached USB networking, serial adapters, HID, audio and storage peripherals. +CONFIG_DRAGONRISE_FF=y +CONFIG_GREENASIA_FF=y +CONFIG_HID=y +CONFIG_HID_A4TECH=m +CONFIG_HID_ACCUTOUCH=m +CONFIG_HID_ACRUX=m +CONFIG_HID_ACRUX_FF=y +CONFIG_HID_ALPS=m +CONFIG_HID_APPLEIR=m +CONFIG_HID_AUREAL=m +CONFIG_HID_BATTERY_STRENGTH=y +CONFIG_HID_BELKIN=m +CONFIG_HID_BETOP_FF=m +CONFIG_HID_BIGBEN_FF=m +CONFIG_HID_BPF=y +CONFIG_HID_CHERRY=m +CONFIG_HID_CHICONY=m +CONFIG_HID_CMEDIA=m +CONFIG_HID_CORSAIR=m +CONFIG_HID_COUGAR=m +CONFIG_HID_CP2112=m +CONFIG_HID_CREATIVE_SB0540=m +CONFIG_HID_CYPRESS=m +CONFIG_HID_DRAGONRISE=m +CONFIG_HID_ELAN=m +CONFIG_HID_ELECOM=m +CONFIG_HID_ELO=m +CONFIG_HID_EMS_FF=m +CONFIG_HID_EVISION=m +CONFIG_HID_EZKEY=m +CONFIG_HID_FT260=m +CONFIG_HID_GEMBIRD=m +CONFIG_HID_GENERIC=y +CONFIG_HID_GFRM=m +CONFIG_HID_GLORIOUS=m +CONFIG_HID_GOODIX_SPI=m +CONFIG_HID_GOOGLE_STADIA_FF=m +CONFIG_HID_GREENASIA=m +CONFIG_HID_GT683R=m +CONFIG_HID_GYRATION=m +CONFIG_HID_HAPTIC=y +CONFIG_HID_HOLTEK=m +CONFIG_HID_ICADE=m +CONFIG_HID_ITE=m +CONFIG_HID_JABRA=m +CONFIG_HID_KENSINGTON=m +CONFIG_HID_KEYTOUCH=m +CONFIG_HID_KYE=m +CONFIG_HID_KYSONA=m +CONFIG_HID_LCPOWER=m +CONFIG_HID_LED=m +CONFIG_HID_LENOVO=m +CONFIG_HID_LETSKETCH=m +CONFIG_HID_LOGITECH=m +CONFIG_HID_LOGITECH_DJ=m +CONFIG_HID_LOGITECH_HIDPP=m +CONFIG_HID_MACALLY=m +CONFIG_HID_MALTRON=m +CONFIG_HID_MAYFLASH=m +CONFIG_HID_MCP2221=m +CONFIG_HID_MEGAWORLD_FF=m +CONFIG_HID_MICROSOFT=m +CONFIG_HID_MONTEREY=m +CONFIG_HID_MULTITOUCH=m +CONFIG_HID_NINTENDO=m +CONFIG_HID_NTI=m +CONFIG_HID_NTRIG=y +CONFIG_HID_NVIDIA_SHIELD=m +CONFIG_HID_ORTEK=m +CONFIG_HID_PANTHERLORD=m +CONFIG_HID_PENMOUNT=m +CONFIG_HID_PETALYNX=m +CONFIG_HID_PICOLCD=m +CONFIG_HID_PICOLCD_BACKLIGHT=y +CONFIG_HID_PICOLCD_FB=y +CONFIG_HID_PICOLCD_LCD=y +CONFIG_HID_PICOLCD_LEDS=y +CONFIG_HID_PID=y +CONFIG_HID_PLANTRONICS=m +CONFIG_HID_PLAYSTATION=m +CONFIG_HID_PRIMAX=m +CONFIG_HID_PRODIKEYS=m +CONFIG_HID_PXRC=m +CONFIG_HID_RAPOO=m +CONFIG_HID_RAZER=m +CONFIG_HID_RETRODE=m +CONFIG_HID_RMI=m +CONFIG_HID_ROCCAT=m +CONFIG_HID_SAITEK=m +CONFIG_HID_SAMSUNG=m +CONFIG_HID_SEMITEK=m +CONFIG_HID_SENSOR_HUB=m +CONFIG_HID_SIGMAMICRO=m +CONFIG_HID_SMARTJOYPLUS=m +CONFIG_HID_SONY=m +CONFIG_HID_SPEEDLINK=m +CONFIG_HID_STEAM=m +CONFIG_HID_STEELSERIES=m +CONFIG_HID_SUNPLUS=m +CONFIG_HID_SUPPORT=y +CONFIG_HID_THINGM=m +CONFIG_HID_THRUSTMASTER=m +CONFIG_HID_TIVO=m +CONFIG_HID_TOPRE=m +CONFIG_HID_TOPSEED=m +CONFIG_HID_TWINHAN=m +CONFIG_HID_U2FZERO=m +CONFIG_HID_UCLOGIC=m +CONFIG_HID_UDRAW_PS3=m +CONFIG_HID_UNIVERSAL_PIDFF=m +CONFIG_HID_VIEWSONIC=m +CONFIG_HID_VIVALDI=m +CONFIG_HID_VIVALDI_COMMON=m +CONFIG_HID_WACOM=m +CONFIG_HID_WALTOP=m +CONFIG_HID_WIIMOTE=m +CONFIG_HID_WINWING=m +CONFIG_HID_XIAOMI=m +CONFIG_HID_XINMO=m +CONFIG_HID_ZEROPLUS=m +CONFIG_HID_ZYDACRON=m +CONFIG_HOLTEK_FF=y +CONFIG_I2C_HID=y +CONFIG_I2C_HID_ACPI=m +CONFIG_I2C_HID_CORE=y +CONFIG_I2C_HID_OF=y +CONFIG_I2C_HID_OF_ELAN=m +CONFIG_I2C_HID_OF_GOODIX=m +CONFIG_LOGIG940_FF=y +CONFIG_LOGIRUMBLEPAD2_FF=y +CONFIG_LOGITECH_FF=y +CONFIG_LOGIWHEELS_FF=y +CONFIG_NINTENDO_FF=y +CONFIG_NVIDIA_SHIELD_FF=y +CONFIG_PANTHERLORD_FF=y +CONFIG_PLAYSTATION_FF=y +CONFIG_REALTEK_AUTOPM=y +CONFIG_SMARTJOYPLUS_FF=y +CONFIG_SND_BCD2000=m +CONFIG_SND_USB=y +CONFIG_SND_USB_6FIRE=m +CONFIG_SND_USB_AUDIO=m +CONFIG_SND_USB_AUDIO_MIDI_V2=y +CONFIG_SND_USB_AUDIO_QMI=m +CONFIG_SND_USB_AUDIO_USE_MEDIA_CONTROLLER=y +CONFIG_SND_USB_CAIAQ=m +CONFIG_SND_USB_CAIAQ_INPUT=y +CONFIG_SND_USB_HIFACE=m +CONFIG_SND_USB_LINE6=m +CONFIG_SND_USB_POD=m +CONFIG_SND_USB_PODHD=m +CONFIG_SND_USB_TONEPORT=m +CONFIG_SND_USB_UA101=m +CONFIG_SND_USB_VARIAX=m +CONFIG_SONY_FF=y +CONFIG_SPI_HID_APPLE_CORE=m +CONFIG_STEAM_FF=y +CONFIG_THRUSTMASTER_FF=y +CONFIG_UHID=m +CONFIG_USB_ALI_M5632=y +CONFIG_USB_AN2720=y +CONFIG_USB_ARMLINUX=y +CONFIG_USB_BELKIN=y +CONFIG_USB_CATC=m +CONFIG_USB_EPSON2888=y +CONFIG_USB_HID=y +CONFIG_USB_HIDDEV=y +CONFIG_USB_HSO=m +CONFIG_USB_IPHETH=m +CONFIG_USB_KAWETH=m +CONFIG_USB_KC2190=y +CONFIG_USB_LAN78XX=m +CONFIG_USB_NET_AQC111=m +CONFIG_USB_NET_AX88179_178A=m +CONFIG_USB_NET_AX8817X=m +CONFIG_USB_NET_CDCETHER=m +CONFIG_USB_NET_CDC_EEM=m +CONFIG_USB_NET_CDC_MBIM=m +CONFIG_USB_NET_CDC_NCM=m +CONFIG_USB_NET_CDC_SUBSET=m +CONFIG_USB_NET_CDC_SUBSET_ENABLE=m +CONFIG_USB_NET_CH9200=m +CONFIG_USB_NET_CX82310_ETH=m +CONFIG_USB_NET_DM9601=m +CONFIG_USB_NET_DRIVERS=y +CONFIG_USB_NET_GL620A=m +CONFIG_USB_NET_HUAWEI_CDC_NCM=m +CONFIG_USB_NET_INT51X1=m +CONFIG_USB_NET_KALMIA=m +CONFIG_USB_NET_MCS7830=m +CONFIG_USB_NET_NET1080=m +CONFIG_USB_NET_PLUSB=m +CONFIG_USB_NET_QMI_WWAN=m +CONFIG_USB_NET_RNDIS_HOST=m +CONFIG_USB_NET_SMSC75XX=m +CONFIG_USB_NET_SMSC95XX=m +CONFIG_USB_NET_SR9700=m +CONFIG_USB_NET_ZAURUS=m +CONFIG_USB_PEGASUS=m +CONFIG_USB_RTL8150=m +CONFIG_USB_RTL8152=m +CONFIG_USB_RTL8153_ECM=m +CONFIG_USB_SERIAL=y +CONFIG_USB_SERIAL_AIRCABLE=m +CONFIG_USB_SERIAL_ARK3116=m +CONFIG_USB_SERIAL_BELKIN=m +CONFIG_USB_SERIAL_CH341=m +CONFIG_USB_SERIAL_CONSOLE=y +CONFIG_USB_SERIAL_CP210X=m +CONFIG_USB_SERIAL_CYBERJACK=m +CONFIG_USB_SERIAL_CYPRESS_M8=m +CONFIG_USB_SERIAL_DIGI_ACCELEPORT=m +CONFIG_USB_SERIAL_EDGEPORT=m +CONFIG_USB_SERIAL_EDGEPORT_TI=m +CONFIG_USB_SERIAL_EMPEG=m +CONFIG_USB_SERIAL_F81232=m +CONFIG_USB_SERIAL_F8153X=m +CONFIG_USB_SERIAL_FTDI_SIO=m +CONFIG_USB_SERIAL_GARMIN=m +CONFIG_USB_SERIAL_GENERIC=y +CONFIG_USB_SERIAL_IPAQ=m +CONFIG_USB_SERIAL_IPW=m +CONFIG_USB_SERIAL_IR=m +CONFIG_USB_SERIAL_IUU=m +CONFIG_USB_SERIAL_KEYSPAN=m +CONFIG_USB_SERIAL_KEYSPAN_PDA=m +CONFIG_USB_SERIAL_KLSI=m +CONFIG_USB_SERIAL_KOBIL_SCT=m +CONFIG_USB_SERIAL_MCT_U232=m +CONFIG_USB_SERIAL_MOS7720=m +CONFIG_USB_SERIAL_MOS7840=m +CONFIG_USB_SERIAL_NAVMAN=m +CONFIG_USB_SERIAL_OMNINET=m +CONFIG_USB_SERIAL_OPTICON=m +CONFIG_USB_SERIAL_OPTION=m +CONFIG_USB_SERIAL_OTI6858=m +CONFIG_USB_SERIAL_PL2303=m +CONFIG_USB_SERIAL_QCAUX=m +CONFIG_USB_SERIAL_QT2=m +CONFIG_USB_SERIAL_QUALCOMM=m +CONFIG_USB_SERIAL_SAFE=m +CONFIG_USB_SERIAL_SAFE_PADDED=y +CONFIG_USB_SERIAL_SIERRAWIRELESS=m +CONFIG_USB_SERIAL_SIMPLE=m +CONFIG_USB_SERIAL_SPCP8X5=m +CONFIG_USB_SERIAL_SSU100=m +CONFIG_USB_SERIAL_SYMBOL=m +CONFIG_USB_SERIAL_TI=m +CONFIG_USB_SERIAL_UPD78F0730=m +CONFIG_USB_SERIAL_VISOR=m +CONFIG_USB_SERIAL_WHITEHEAT=m +CONFIG_USB_SERIAL_WWAN=m +CONFIG_USB_SERIAL_XR=m +CONFIG_USB_SERIAL_XSENS_MT=m +CONFIG_USB_SIERRA_NET=m +CONFIG_USB_STORAGE=m +CONFIG_USB_STORAGE_ALAUDA=m +CONFIG_USB_STORAGE_CYPRESS_ATACB=m +CONFIG_USB_STORAGE_DATAFAB=m +CONFIG_USB_STORAGE_ENE_UB6250=m +CONFIG_USB_STORAGE_FREECOM=m +CONFIG_USB_STORAGE_ISD200=m +CONFIG_USB_STORAGE_JUMPSHOT=m +CONFIG_USB_STORAGE_KARMA=m +CONFIG_USB_STORAGE_ONETOUCH=m +CONFIG_USB_STORAGE_REALTEK=m +CONFIG_USB_STORAGE_SDDR09=m +CONFIG_USB_STORAGE_SDDR55=m +CONFIG_USB_STORAGE_USBAT=m +CONFIG_USB_UAS=m +CONFIG_USB_USBNET=m +CONFIG_USB_VL600=m +CONFIG_ZEROPLUS_FF=y + +# Desktop compatibility and distribution diagnostics; these do not select a device. +CONFIG_COMPAT=y +CONFIG_COMPAT_VDSO=y +CONFIG_DEBUG_INFO_BTF=y +CONFIG_DEBUG_INFO_BTF_MODULES=y +CONFIG_DEBUG_INFO_DWARF5=y +CONFIG_DEBUG_INFO_REDUCED=n +CONFIG_DYNAMIC_DEBUG=y +CONFIG_DYNAMIC_FTRACE=y +CONFIG_DYNAMIC_FTRACE_WITH_DIRECT_CALLS=y +CONFIG_EXPERT=y +CONFIG_FTRACE=y +CONFIG_FUNCTION_TRACER=y +CONFIG_IKCONFIG=y +CONFIG_IKCONFIG_PROC=y +CONFIG_KALLSYMS=y +CONFIG_KALLSYMS_ALL=y +CONFIG_KPROBES=y +CONFIG_PERF_EVENTS=y +CONFIG_UPROBES=y + +# Memory and userspace hardening retained from the distribution kernel. +CONFIG_BIG_KEYS=y +CONFIG_BUG_ON_DATA_CORRUPTION=y +CONFIG_CC_HAS_AUTO_VAR_INIT_PATTERN=y +CONFIG_CC_HAS_AUTO_VAR_INIT_ZERO=y +CONFIG_CC_HAS_AUTO_VAR_INIT_ZERO_BARE=y +CONFIG_CC_HAS_RANDSTRUCT=y +CONFIG_CC_HAS_SANCOV_STACK_DEPTH_CALLBACK=y +CONFIG_CC_HAS_ZERO_CALL_USED_REGS=y +CONFIG_ENCRYPTED_KEYS=y +CONFIG_FORTIFY_SOURCE=y +CONFIG_HARDENED_USERCOPY=y +CONFIG_HARDENED_USERCOPY_DEFAULT_ON=y +CONFIG_INIT_ON_ALLOC_DEFAULT_ON=y +CONFIG_INIT_STACK_ALL_ZERO=y +CONFIG_LIST_HARDENED=y +CONFIG_NETLABEL=y +CONFIG_NETWORK_SECMARK=y +CONFIG_PERSISTENT_KEYRINGS=y +CONFIG_RANDSTRUCT_NONE=y +CONFIG_SYN_COOKIES=y + +# Bluetooth protocols and common removable/immutable filesystem formats. +CONFIG_BT_AOSPEXT=y +CONFIG_BT_BNEP=m +CONFIG_BT_BNEP_MC_FILTER=y +CONFIG_BT_BNEP_PROTO_FILTER=y +CONFIG_BT_LE=y +CONFIG_BT_LEDS=y +CONFIG_BT_LE_L2CAP_ECRED=y +CONFIG_BT_MSFTEXT=y +CONFIG_BT_RFCOMM=m +CONFIG_BT_RFCOMM_TTY=y +CONFIG_EROFS_FS=m +CONFIG_EROFS_FS_BACKED_BY_FILE=y +CONFIG_EROFS_FS_POSIX_ACL=y +CONFIG_EROFS_FS_SECURITY=y +CONFIG_EROFS_FS_XATTR=y +CONFIG_EROFS_FS_ZIP=y +CONFIG_EROFS_FS_ZIP_ACCEL=y +CONFIG_EROFS_FS_ZIP_DEFLATE=y +CONFIG_EROFS_FS_ZIP_LZMA=y +CONFIG_EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS=16 +CONFIG_EROFS_FS_ZIP_ZSTD=y +CONFIG_HFSPLUS_FS=m +CONFIG_HFS_FS=m +CONFIG_ISO9660_FS=m +CONFIG_JOLIET=y +CONFIG_MSDOS_FS=m +CONFIG_SQUASHFS=m +CONFIG_SQUASHFS_COMPILE_DECOMP_MULTI_PERCPU=y +CONFIG_SQUASHFS_DECOMP_MULTI_PERCPU=y +CONFIG_SQUASHFS_FILE_DIRECT=y +CONFIG_SQUASHFS_FRAGMENT_CACHE_SIZE=3 +CONFIG_SQUASHFS_LZ4=y +CONFIG_SQUASHFS_LZO=y +CONFIG_SQUASHFS_XATTR=y +CONFIG_SQUASHFS_XZ=y +CONFIG_SQUASHFS_ZLIB=y +CONFIG_SQUASHFS_ZSTD=y +CONFIG_UDF_FS=m +CONFIG_ZISOFS=y + +# IPsec, socket diagnostics and traffic control for VPNs and container networking. +CONFIG_CLS_U32_MARK=y +CONFIG_CLS_U32_PERF=y +CONFIG_INET6_AH=m +CONFIG_INET6_ESP=m +CONFIG_INET6_ESPINTCP=y +CONFIG_INET6_ESP_OFFLOAD=m +CONFIG_INET6_IPCOMP=m +CONFIG_INET6_XFRM_TUNNEL=m +CONFIG_INET_AH=m +CONFIG_INET_ESP=m +CONFIG_INET_ESPINTCP=y +CONFIG_INET_ESP_OFFLOAD=m +CONFIG_INET_IPCOMP=m +CONFIG_INET_RAW_DIAG=y +CONFIG_INET_UDP_DIAG=y +CONFIG_INET_XFRM_TUNNEL=m +CONFIG_IPV6_VTI=m +CONFIG_NETLINK_DIAG=y +CONFIG_NET_ACT_BPF=m +CONFIG_NET_ACT_CONNMARK=m +CONFIG_NET_ACT_CSUM=m +CONFIG_NET_ACT_CT=m +CONFIG_NET_ACT_CTINFO=m +CONFIG_NET_ACT_GACT=m +CONFIG_NET_ACT_GATE=m +CONFIG_NET_ACT_IFE=m +CONFIG_NET_ACT_MIRRED=m +CONFIG_NET_ACT_MPLS=m +CONFIG_NET_ACT_NAT=m +CONFIG_NET_ACT_PEDIT=m +CONFIG_NET_ACT_POLICE=m +CONFIG_NET_ACT_SAMPLE=m +CONFIG_NET_ACT_SIMP=m +CONFIG_NET_ACT_SKBEDIT=m +CONFIG_NET_ACT_SKBMOD=m +CONFIG_NET_ACT_TUNNEL_KEY=m +CONFIG_NET_ACT_VLAN=m +CONFIG_NET_CLS_ACT=y +CONFIG_NET_CLS_BASIC=m +CONFIG_NET_CLS_BPF=m +CONFIG_NET_CLS_FLOW=m +CONFIG_NET_CLS_FLOWER=m +CONFIG_NET_CLS_FW=m +CONFIG_NET_CLS_MATCHALL=m +CONFIG_NET_CLS_ROUTE4=m +CONFIG_NET_CLS_U32=m +CONFIG_NET_EMATCH=y +CONFIG_NET_EMATCH_CANID=m +CONFIG_NET_EMATCH_CMP=m +CONFIG_NET_EMATCH_IPSET=m +CONFIG_NET_EMATCH_IPT=m +CONFIG_NET_EMATCH_META=m +CONFIG_NET_EMATCH_NBYTE=m +CONFIG_NET_EMATCH_STACK=32 +CONFIG_NET_EMATCH_TEXT=m +CONFIG_NET_EMATCH_U32=m +CONFIG_NET_IFE=m +CONFIG_NET_IFE_SKBMARK=m +CONFIG_NET_IFE_SKBPRIO=m +CONFIG_NET_IFE_SKBTCINDEX=m +CONFIG_NET_IPVTI=m +CONFIG_NET_KEY=m +CONFIG_NET_KEY_MIGRATE=y +CONFIG_NET_SCH_BPF=y +CONFIG_NET_SCH_CAKE=m +CONFIG_NET_SCH_CBS=m +CONFIG_NET_SCH_CHOKE=m +CONFIG_NET_SCH_CODEL=m +CONFIG_NET_SCH_DRR=m +CONFIG_NET_SCH_DUALPI2=m +CONFIG_NET_SCH_ETF=m +CONFIG_NET_SCH_ETS=m +CONFIG_NET_SCH_FIFO=y +CONFIG_NET_SCH_FQ=m +CONFIG_NET_SCH_FQ_PIE=m +CONFIG_NET_SCH_GRED=m +CONFIG_NET_SCH_HFSC=m +CONFIG_NET_SCH_HHF=m +CONFIG_NET_SCH_HTB=m +CONFIG_NET_SCH_INGRESS=m +CONFIG_NET_SCH_MQPRIO=m +CONFIG_NET_SCH_MQPRIO_LIB=m +CONFIG_NET_SCH_MULTIQ=m +CONFIG_NET_SCH_NETEM=m +CONFIG_NET_SCH_PIE=m +CONFIG_NET_SCH_PLUG=m +CONFIG_NET_SCH_PRIO=m +CONFIG_NET_SCH_QFQ=m +CONFIG_NET_SCH_RED=m +CONFIG_NET_SCH_SFB=m +CONFIG_NET_SCH_SFQ=m +CONFIG_NET_SCH_TAPRIO=m +CONFIG_NET_SCH_TBF=m +CONFIG_NET_SCH_TEQL=m +CONFIG_PACKET_DIAG=y +CONFIG_PSAMPLE=m +CONFIG_UNIX_DIAG=y +CONFIG_XFRM_AH=m +CONFIG_XFRM_ALGO=y +CONFIG_XFRM_ESP=m +CONFIG_XFRM_ESPINTCP=y +CONFIG_XFRM_INTERFACE=m +CONFIG_XFRM_IPCOMP=m +CONFIG_XFRM_IPTFS=m +CONFIG_XFRM_MIGRATE=y +CONFIG_XFRM_OFFLOAD=y +CONFIG_XFRM_STATISTICS=y +CONFIG_XFRM_SUB_POLICY=y From d282380c3baa7a596846df8670e8d993deec39bf Mon Sep 17 00:00:00 2001 From: Ryan Murray Date: Mon, 26 Oct 2026 20:29:57 +1100 Subject: [PATCH 08/10] arm64: retain the distro mmap floors and key notification support --- arch/arm64/configs/asahi.config | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/arch/arm64/configs/asahi.config b/arch/arm64/configs/asahi.config index 60d8a679594ef..ec2215594d521 100644 --- a/arch/arm64/configs/asahi.config +++ b/arch/arm64/configs/asahi.config @@ -109,6 +109,8 @@ CONFIG_EXT4_FS_POSIX_ACL=y CONFIG_EXT4_FS_SECURITY=y CONFIG_KEYS=y CONFIG_KEYS_REQUEST_CACHE=y +CONFIG_KEY_DH_OPERATIONS=y +CONFIG_KEY_NOTIFICATIONS=y CONFIG_LOAD_UEFI_KEYS=y CONFIG_LSM="lockdown,yama,integrity,selinux,bpf,landlock,ipe" CONFIG_SECONDARY_TRUSTED_KEYRING=y @@ -133,6 +135,7 @@ CONFIG_SYSTEM_BLACKLIST_KEYRING=y CONFIG_SYSTEM_TRUSTED_KEYRING=y CONFIG_TMPFS_POSIX_ACL=y CONFIG_TMPFS_XATTR=y +CONFIG_WATCH_QUEUE=y CONFIG_XFRM=y CONFIG_XFRM_USER=y @@ -1194,6 +1197,7 @@ CONFIG_CC_HAS_AUTO_VAR_INIT_ZERO_BARE=y CONFIG_CC_HAS_RANDSTRUCT=y CONFIG_CC_HAS_SANCOV_STACK_DEPTH_CALLBACK=y CONFIG_CC_HAS_ZERO_CALL_USED_REGS=y +CONFIG_DEFAULT_MMAP_MIN_ADDR=65536 CONFIG_ENCRYPTED_KEYS=y CONFIG_FORTIFY_SOURCE=y CONFIG_HARDENED_USERCOPY=y @@ -1201,6 +1205,7 @@ CONFIG_HARDENED_USERCOPY_DEFAULT_ON=y CONFIG_INIT_ON_ALLOC_DEFAULT_ON=y CONFIG_INIT_STACK_ALL_ZERO=y CONFIG_LIST_HARDENED=y +CONFIG_LSM_MMAP_MIN_ADDR=65535 CONFIG_NETLABEL=y CONFIG_NETWORK_SECMARK=y CONFIG_PERSISTENT_KEYRINGS=y From b18158c5ab592eebef397e455f7c28fb377a9fec Mon Sep 17 00:00:00 2001 From: Ryan Murray Date: Mon, 26 Oct 2026 21:41:02 +1100 Subject: [PATCH 09/10] rust: select the prepared corrected bindgen by default Prepare the pinned generator at a stable source-tree entry point and prefer it for in-tree and O= builds. Keep every generated layout assertion mandatory and retain stock-tool rejection coverage. Document upstream status and the scope of aligned empty records. Signed-off-by: Ryan Murray Assisted-by: LLM --- Documentation/rust/bindgen-layout-checks.rst | 22 +++++--- Makefile | 5 +- tools/aurora-bindgen/.gitignore | 1 + tools/aurora-bindgen/README.rst | 58 ++++++++++++++++---- tools/aurora-bindgen/build.py | 7 ++- 5 files changed, 72 insertions(+), 21 deletions(-) create mode 100644 tools/aurora-bindgen/.gitignore diff --git a/Documentation/rust/bindgen-layout-checks.rst b/Documentation/rust/bindgen-layout-checks.rst index 5af9951a64338..4e0a996bd701d 100644 --- a/Documentation/rust/bindgen-layout-checks.rst +++ b/Documentation/rust/bindgen-layout-checks.rst @@ -46,11 +46,17 @@ Corrected generator ------------------- ``tools/aurora-bindgen/`` contains pinned patches for bindgen 0.73.2 that -repair both cases, a private build recipe and compile-only tests; see -``tools/aurora-bindgen/README.rst``. It installs nothing system-wide. To check -the layouts with it:: +repair both cases, a local build recipe and compile-only tests; see +``tools/aurora-bindgen/README.rst``. Prepare it once before configuration:: - make LLVM=1 BINDGEN=/path/to/bindgen ... + python3 tools/aurora-bindgen/build.py + make LLVM=1 ... + +The top-level Makefile automatically selects +``tools/aurora-bindgen/build/bin/bindgen`` from the source tree, also for ``O=`` +builds. Packagers prepare this entry point in their build roots. Make does not +fetch tools or install anything system-wide. If the entry point is absent, +Kbuild uses ``bindgen`` from PATH and the same mandatory assertions apply. The generated bindings are consumed by the Rust kernel crate and by several drivers. After changing the bindings generator, rebuild the kernel Image and @@ -61,7 +67,9 @@ the configured ``--rust-target 1.85``: that selects unconditional constant assertions rather than ``#[test]`` functions. They are checked without a Rust test configuration. -Pass ``BINDGEN=/absolute/path/to/bindgen`` as a make command-line argument. -Exporting it in the environment is insufficient: the top-level Makefile's -``BINDGEN = bindgen`` assignment takes precedence over an environment value. Check the recorded bindings command, not just the toolchain version banner. +Command-line overrides remain available for generator regression tests. +The defect can affect any generated aligned empty record and containing types +under other configurations; all emitted size/alignment/offset checks remain +mandatory. They do not cover C-only types or opaque internal fields. See the +generator README for the upstream status and related empty-struct issues. diff --git a/Makefile b/Makefile index c61ea07ee5051..956665f4965fe 100644 --- a/Makefile +++ b/Makefile @@ -550,7 +550,10 @@ RUSTC = rustc RUSTDOC = rustdoc RUSTFMT = rustfmt CLIPPY_DRIVER = clippy-driver -BINDGEN = bindgen +# Prefer the locally prepared, layout-corrected generator, including O= builds. +# Keep command-line overrides for toolchain testing; layouts are always checked. +aurora_bindgen := $(abs_srctree)/tools/aurora-bindgen/build/bin/bindgen +BINDGEN = $(if $(wildcard $(aurora_bindgen)),$(aurora_bindgen),bindgen) PAHOLE = pahole RESOLVE_BTFIDS = $(objtree)/tools/bpf/resolve_btfids/resolve_btfids LEX = flex diff --git a/tools/aurora-bindgen/.gitignore b/tools/aurora-bindgen/.gitignore new file mode 100644 index 0000000000000..84c048a73cc2e --- /dev/null +++ b/tools/aurora-bindgen/.gitignore @@ -0,0 +1 @@ +/build/ diff --git a/tools/aurora-bindgen/README.rst b/tools/aurora-bindgen/README.rst index 35e4b6eb8a274..9399e5da50c03 100644 --- a/tools/aurora-bindgen/README.rst +++ b/tools/aurora-bindgen/README.rst @@ -1,6 +1,6 @@ .. SPDX-License-Identifier: GPL-2.0-only -Private bindgen with checked C/Rust layouts +Default bindgen with checked C/Rust layouts ========================================== This package builds bindgen 0.73.2 with two generic binding-generation repairs: @@ -16,19 +16,30 @@ compiler or build path produces identical bytes. The manifest identifies when that digest predates comment-only patch changes; each rebuild must record its own binary digest. -Build in a fresh private directory:: +Prepare the default generator once before configuring or building the kernel:: - python3 tools/aurora-bindgen/build.py --output-dir /absolute/new/tool-build + python3 tools/aurora-bindgen/build.py + make LLVM=1 ... Python 3.12 or newer, Cargo/Rust, Clang/libclang and patch are required. Cargo's -locked dependency graph is used, with at most two build jobs. ``--archive`` can -supply an already downloaded source archive; its digest is still checked. The -script builds and runs compile-only valid-input checks, then prints the exact -``BINDGEN=/absolute/path/to/bindgen`` make argument. It installs nothing globally. -The kernel always retains layout assertions. Pass the printed ``BINDGEN=`` -argument on the make command line; an exported environment variable is -overridden by the top-level Makefile. Build the complete kernel Image and -matching modules with the same tool. +locked dependency graph is used, with at most two build jobs. The script builds +in ``tools/aurora-bindgen/build/`` and publishes ``build/bin/bindgen`` only after +its compile-only checks pass. The top-level Makefile selects that entry point +automatically for both in-tree and ``O=`` builds. No make variable or environment +setting is needed. It installs nothing globally and make never downloads or +builds the generator implicitly. Preserve the build log and ``build/result.json``. + +``--archive`` can supply an already downloaded source archive; its digest is +still checked. ``--output-dir`` supports separate tool experiments; a nondefault +location is not automatically selected. Packagers may instead place their +independently built and tested pinned tool at the same ``build/bin/bindgen`` +entry point (a symlink is sufficient). Remove or move a previous build directory +before rebuilding; the script refuses to overwrite it. + +If the prepared entry point is absent, Kbuild falls back to ``bindgen`` on PATH. +The mandatory layout assertions still reject incorrect bindings. A command-line +override remains available for generator regression testing. + Both scripts reject optimized Python (``-O``, ``-OO`` or ``PYTHONOPTIMIZE``) before creating output, since their validation assertions must remain enabled. @@ -90,3 +101,28 @@ Primary sources: A complete kernel build remains the configuration-specific layout check; these small generator fixtures do not replace it or establish runtime GPU stability. + +Upstream status and affected configurations +------------------------------------------ + +As checked on 2026-10-26, the latest upstream release is 0.73.2 and Linux's +minimum is 0.71.1. Both versions, and bindgen main, skip explicit alignment +handling for zero-sized non-opaque structs. Raising the minimum therefore does +not fix this defect. Upstream issue #551 and fix #552 concern C empty-struct +size, while #1683 concerns the Windows ABI; neither fixes this aligned-empty +case. No exact upstream issue or merged fix was found in the issue/PR search. + +The defect is generic: any explicitly aligned empty C record can have the wrong +Rust alignment, and embedding it can shift later fields or change enclosing +size/alignment. Configurations that empty conditional records, change cacheline +alignment or change preceding fields can expose it; it is not specific to +Asahi or ARM64. SCHEDSTATS=y masks this particular scheduler case. Every emitted +layout assertion is compiled regardless of KUnit, but this only covers types +and fields emitted by bindgen, not arbitrary C-only or opaque internals. + +* https://github.com/rust-lang/rust-bindgen/releases/tag/v0.73.2 +* https://github.com/torvalds/linux/blob/master/scripts/min-tool-version.sh +* https://github.com/rust-lang/rust-bindgen/blob/main/bindgen/codegen/mod.rs +* https://github.com/rust-lang/rust-bindgen/issues/551 +* https://github.com/rust-lang/rust-bindgen/pull/552 +* https://github.com/rust-lang/rust-bindgen/issues/1683 diff --git a/tools/aurora-bindgen/build.py b/tools/aurora-bindgen/build.py index fa87873098480..3ae28e18625ea 100644 --- a/tools/aurora-bindgen/build.py +++ b/tools/aurora-bindgen/build.py @@ -6,7 +6,7 @@ import argparse,hashlib,json,subprocess,tarfile,urllib.request,shutil,os,sys from pathlib import Path -P=Path(__file__).resolve().parent;ap=argparse.ArgumentParser();ap.add_argument('--output-dir',required=True,type=Path);ap.add_argument('--archive',type=Path);ap.add_argument('--jobs',type=int,default=2);a=ap.parse_args();assert 1<=a.jobs<=2 +P=Path(__file__).resolve().parent;ap=argparse.ArgumentParser();ap.add_argument('--output-dir',default=P/'build',type=Path);ap.add_argument('--archive',type=Path);ap.add_argument('--jobs',type=int,default=2);a=ap.parse_args();assert 1<=a.jobs<=2 O=a.output_dir.resolve();assert not O.exists(),'refusing to overwrite an existing source or tool';O.mkdir(parents=True) m=json.loads((P/'sources.json').read_text());sha=lambda p:hashlib.sha256(p.read_bytes()).hexdigest();archive=O/'source.tar.gz' if a.archive:shutil.copyfile(a.archive,archive) @@ -22,4 +22,7 @@ cmd=['cargo','build','--locked','--release','-p','bindgen-cli','-j'+str(a.jobs)] with (O/'build.log').open('w') as log:subprocess.run(cmd,cwd=S,stdout=log,stderr=subprocess.STDOUT,check=True) binary=S/'target/release/bindgen';subprocess.run([sys.executable,str(P/'test.py'),'--bindgen',str(binary),'--output-dir',str(O/'tests')],check=True) -r={'status':'BUILT_AND_COMPILE_TESTED','binary':str(binary),'binary_sha256':sha(binary),'source_manifest_sha256':sha(P/'sources.json'),'build_command':cmd,'rustc_version':subprocess.check_output(['rustc','-vV'],text=True),'cargo_version':subprocess.check_output(['cargo','-vV'],text=True),'tests_manifest_sha256':sha(O/'tests/result.json'),'installed_globally':False};(O/'result.json').write_text(json.dumps(r,indent=2)+'\n');print(json.dumps(r,indent=2));print('Use make BINDGEN='+str(binary)+' ... to build the kernel with layout assertions.') +r={'status':'BUILT_AND_COMPILE_TESTED','binary':str(binary),'binary_sha256':sha(binary),'source_manifest_sha256':sha(P/'sources.json'),'build_command':cmd,'rustc_version':subprocess.check_output(['rustc','-vV'],text=True),'cargo_version':subprocess.check_output(['cargo','-vV'],text=True),'tests_manifest_sha256':sha(O/'tests/result.json'),'installed_globally':False};(O/'result.json').write_text(json.dumps(r,indent=2)+'\n') +# Publish the stable entry point only after every compile-only check passed. +(O/'bin').mkdir();(O/'bin/bindgen').symlink_to(binary.relative_to(O/'bin',walk_up=True)) +print(json.dumps(r,indent=2));print('Prepared '+str(O/'bin/bindgen')+'. The default output is selected automatically by Kbuild.') From 7448de6cec9d39d206174b692820c5d472013f6a Mon Sep 17 00:00:00 2001 From: Ryan Murray Date: Mon, 26 Oct 2026 22:00:16 +1100 Subject: [PATCH 10/10] arm64: keep the default ESP charset available in initramfs Asahi dracut loads vfat and mounts the system ESP without charset options before unpacking vendor firmware. Match Fedora codepage 437 and ASCII defaults with built-in converters so the mount does not depend on a modular ISO-8859-1 converter absent from initramfs. Retain XZ and Zstd firmware loading for distribution firmware packages. Signed-off-by: Ryan Murray Assisted-by: LLM --- arch/arm64/configs/asahi.config | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-) diff --git a/arch/arm64/configs/asahi.config b/arch/arm64/configs/asahi.config index ec2215594d521..8980f8f408d75 100644 --- a/arch/arm64/configs/asahi.config +++ b/arch/arm64/configs/asahi.config @@ -542,6 +542,19 @@ CONFIG_VXLAN=m CONFIG_WIREGUARD=m CONFIG_ZRAM=m +# Asahi dracut mounts the ESP with default VFAT options before the rootfs exists. +# Match Fedora's 437/ASCII defaults and keep both converters built in: a modular +# default charset may be absent from the early vendor-firmware initramfs. +CONFIG_FAT_DEFAULT_CODEPAGE=437 +CONFIG_FAT_DEFAULT_IOCHARSET="ascii" +CONFIG_NLS_CODEPAGE_437=y +CONFIG_NLS_ASCII=y + +# Distribution firmware packages can contain .xz and .zst files after extraction. +CONFIG_FW_LOADER_COMPRESS=y +CONFIG_FW_LOADER_COMPRESS_XZ=y +CONFIG_FW_LOADER_COMPRESS_ZSTD=y + # Filesystems, quotas and network shares used by distribution installations and removable media. CONFIG_AUTOFS_FS=y CONFIG_BLK_DEV_ZONED=y @@ -610,10 +623,8 @@ CONFIG_NFS_V4_1_IMPLEMENTATION_ID_DOMAIN="kernel.org" CONFIG_NFS_V4_2=y CONFIG_NFS_V4_2_SSC_HELPER=y CONFIG_NFS_V4_SECURITY_LABEL=y -CONFIG_NLS_ASCII=y CONFIG_NLS_CODEPAGE_1250=m CONFIG_NLS_CODEPAGE_1251=m -CONFIG_NLS_CODEPAGE_437=y CONFIG_NLS_CODEPAGE_737=m CONFIG_NLS_CODEPAGE_775=m CONFIG_NLS_CODEPAGE_850=m