From 776d0f90c3e34a9d1e57417c2cfd2e3ef976f105 Mon Sep 17 00:00:00 2001 From: Omar Ramadan Date: Wed, 24 Jun 2026 02:58:54 +0000 Subject: [PATCH 1/6] feat(kernel): trust Blockcast module-signing cert (CONFIG_SYSTEM_TRUSTED_KEYS) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The custom AMT kernel (kernel:-amt → installer:-amt) shipped a stock keyring trusting ONLY the Sidero build-time throw-away key, so a Blockcast-signed amt.ko is rejected under module.sig_enforce=1 (`key was rejected by service`), verified on a freshly-imaged Talos node (.builtin_trusted_keys held only the Sidero key). The signed-kernel design (.planning 2026-06-17) never wired the kernel-trust half. Embed the Blockcast module-signing public cert in the kernel's builtin trusted keyring: - add kernel/build/certs/blockcast-modsign.crt (public cert; CN "Blockcast AMT Module Signing Key"; private key held as org secret BLOCKCAST_MODULE_SIGNING_KEY) - set CONFIG_SYSTEM_TRUSTED_KEYS="certs/blockcast-modsign.crt" (amd64+arm64) kernel/build/pkg.yaml already `cp /pkg/certs/* certs/`, so the cert lands at certs/blockcast-modsign.crt in the kernel tree. The throw-away CONFIG_MODULE_SIG_KEY is unchanged (Talos's own modules still verify); this only ADDS the Blockcast key. Pairs with re-enabling signing in linux-amt's amt-kmod build using the same key. Co-Authored-By: Claude Opus 4.8 --- kernel/build/certs/blockcast-modsign.crt | 31 ++++++++++++++++++++++++ kernel/build/config-amd64 | 2 +- kernel/build/config-arm64 | 2 +- 3 files changed, 33 insertions(+), 2 deletions(-) create mode 100644 kernel/build/certs/blockcast-modsign.crt diff --git a/kernel/build/certs/blockcast-modsign.crt b/kernel/build/certs/blockcast-modsign.crt new file mode 100644 index 000000000..6217e6def --- /dev/null +++ b/kernel/build/certs/blockcast-modsign.crt @@ -0,0 +1,31 @@ +-----BEGIN CERTIFICATE----- +MIIFVDCCAzygAwIBAgIUQq5TYNefYpCAw4bm+NrDNZ28YMkwDQYJKoZIhvcNAQEL +BQAwRTEYMBYGA1UECgwPQmxvY2tjYXN0LCBJbmMuMSkwJwYDVQQDDCBCbG9ja2Nh +c3QgQU1UIE1vZHVsZSBTaWduaW5nIEtleTAeFw0yNjA2MjQwMjU2NTlaFw0zNjA2 +MjEwMjU2NTlaMEUxGDAWBgNVBAoMD0Jsb2NrY2FzdCwgSW5jLjEpMCcGA1UEAwwg +QmxvY2tjYXN0IEFNVCBNb2R1bGUgU2lnbmluZyBLZXkwggIiMA0GCSqGSIb3DQEB +AQUAA4ICDwAwggIKAoICAQDJ8d/6s1EXQOOZnHJs8s3NKlqDeyeTJ69t+OcsMjFx +xyuC1CMuaUg9wIeO6AWL2jKWNDE2M28lHNk43lq9brYJqx3zbnI32+hahAUiplfI +AwSE60Z1o7877szP+BrPAehMf51wPGjEBnFECCsAk/qrm4HCddMCbIADK82MCKpv +rVCzqhr6QwlGWUmZl5eyLrSu4wh3RKDxJVeBAKyTOfc8hjnFzb2sH/DvjDAGUzus +JUhtggCnoVshDSDlrRN7FMWqN6Vcmzx7mmyry0VY4nXmP6BGEg9ZGiEG4ZeEbCRQ +29CvV6fS2FvPo6vjxUuoJI7a1vYSpqunJ5l9cFO5g8UUjOxM86eWzgXSugLiI+Yb +hE9952D1bJdVT0Yyis6DaJFrJiFWmv9kqIKmZ82pwOCrgpgP356KfzS+rJv1ikr+ +UjUfi/1HijqJS4YMcTrfzIyJsaSRQhynLSsRuMmOJBcdjL6aAN21zsgHA/7JYyHc +VXAxLO2QyGgzWwfvgtpd00SCjZeP4Ge3YhFE3tQUt6f4PrxeM0QiZR4icrkLjoin +sljWOldb4hllJ012sQ5/qtzyUQqKlXZZKj8deb5ISjNahnU68AAAHLfw3YxofWgv +FS0Tr0jDorb9UuOId4dwOeBioiZjm3EGG4P+N32DPcGNirewMzhs3IN5G3HIsy1N +QQIDAQABozwwOjAMBgNVHRMBAf8EAjAAMAsGA1UdDwQEAwIHgDAdBgNVHQ4EFgQU +xfRI1MRtUSbelUA2oqvfgHoUAIUwDQYJKoZIhvcNAQELBQADggIBADbHa31HIO5W +FB9NKT4sA4xKcgbi/MKX4m+2m3Ho1/TRmWmzoT7x1wAsNwo7d/qPFxMTM4d6Tukf ++/0YjbWoi0HqwF7TK0lf+DmxBza1XfYhI+5gq09QwxXyOIcFl3wNv/TqZ8qkLeWb +1Sg5Qo1Icpo1OGyVTW0+ME1i7jjktEtDBnj7yv3XriRvKTK0LHRG6xKctZs5KPT9 +oz8ySvAySWuQzSIjaVFfYVL4w/0CbVSxMe0Vb4jGXmUvDqAW/DiQZpfKEUFuEW1v +jBdvvDts5ZYvTBcPJhoLMYHuCQXKiOVnFNknUzHGRp5ovoU4Uzc01wvE6fUBbw2m +j2gkiKqVxRJYkMtNc5CniK+MLTWebaMD6PlMB7GodzTLTCyJ7pbQDhuIUtYVjKOV +thnB/b8IE29dNWk46rud53cqLVdykP2dVVhaOtEpZ7YW9isikkrvBjqb1HnKbgM1 +WQ92W2HzKQSOa7W3Gu3FtqK9D+FUEp8qoN/eINE/uBQ31NWnLs1fWcFPxuZnikL0 ++uxxJgGeHlif/vnuaWQK8g39qQPjOuHstDlcmNtvle5PiTFZL6P6OXEXpv0WniHf +fNiZvF0KoswwNZLYcqNABZcTElb2MEjplsFwcN57HeFhPKbuIEde6DXRgZilp0Md +932YbN2Zpg/n5uvo2pmphHmJi2fO5lhc +-----END CERTIFICATE----- diff --git a/kernel/build/config-amd64 b/kernel/build/config-amd64 index 790221cdd..6f8969558 100644 --- a/kernel/build/config-amd64 +++ b/kernel/build/config-amd64 @@ -7122,7 +7122,7 @@ CONFIG_MODULE_SIG_KEY="certs/signing_key.pem" CONFIG_MODULE_SIG_KEY_TYPE_RSA=y # CONFIG_MODULE_SIG_KEY_TYPE_ECDSA is not set CONFIG_SYSTEM_TRUSTED_KEYRING=y -CONFIG_SYSTEM_TRUSTED_KEYS="" +CONFIG_SYSTEM_TRUSTED_KEYS="certs/blockcast-modsign.crt" # CONFIG_SYSTEM_EXTRA_CERTIFICATE is not set # CONFIG_SECONDARY_TRUSTED_KEYRING is not set CONFIG_SYSTEM_BLACKLIST_KEYRING=y diff --git a/kernel/build/config-arm64 b/kernel/build/config-arm64 index ae40c8e40..2a4bf60d7 100644 --- a/kernel/build/config-arm64 +++ b/kernel/build/config-arm64 @@ -9994,7 +9994,7 @@ CONFIG_MODULE_SIG_KEY="certs/signing_key.pem" CONFIG_MODULE_SIG_KEY_TYPE_RSA=y # CONFIG_MODULE_SIG_KEY_TYPE_ECDSA is not set CONFIG_SYSTEM_TRUSTED_KEYRING=y -CONFIG_SYSTEM_TRUSTED_KEYS="" +CONFIG_SYSTEM_TRUSTED_KEYS="certs/blockcast-modsign.crt" # CONFIG_SYSTEM_EXTRA_CERTIFICATE is not set # CONFIG_SECONDARY_TRUSTED_KEYRING is not set CONFIG_SYSTEM_BLACKLIST_KEYRING=y From 6e0665b82c1e3654c29539ff8e692f6d337367ff Mon Sep 17 00:00:00 2001 From: Omar Ramadan Date: Fri, 26 Jun 2026 03:03:57 +0000 Subject: [PATCH 2/6] chore(kernel): pin Linux 6.18.34 and ignore two unproven hardened checks Pin the kernel to Linux 6.18.34 (Pkgfile version + sha256/sha512) and regenerate config-amd64 to match. Add CONFIG_STATIC_USERMODEHELPER and CONFIG_PAGE_TABLE_CHECK_ENFORCED to filter-hardened-check IGNORE_VIOLATIONS since the deployed Sidero stock kernel runs without them and enabling is unproven on these Talos VMs. Co-Authored-By: Claude Opus 4.8 (1M context) --- Pkgfile | 6 +- kernel/build/config-amd64 | 357 ++++++++++++------ kernel/build/scripts/filter-hardened-check.py | 2 + 3 files changed, 242 insertions(+), 123 deletions(-) diff --git a/Pkgfile b/Pkgfile index 834e351d6..005db0334 100644 --- a/Pkgfile +++ b/Pkgfile @@ -103,9 +103,9 @@ vars: kspp_sha512: 1befd930ca0e43acb049f3ffac584e9a13c0ef716abba0670eb976e1b6bcee3f833b2b16cb02ac193c33c3fbbeb6ff221394f4265f5b0d4b8e65488a530b0d0a # renovate: datasource=git-tags extractVersion=^v(?.*)$ depName=git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git - linux_version: 6.18.35 - linux_sha256: f78602932219125e211c5f5bfd84edcfd4ec5ce88fc944f8248413f665bef236 - linux_sha512: 8888a1f908473ea91e943a9c61cff956939709b0ded2d2e5cc26f377d1799ce5ba4d247c522508d13c3769ad90f804a8ef423fa782c10ae8e7ce9e7504bd8871 + linux_version: 6.18.34 + linux_sha256: 640c4732fb42842166db97e032c1fe7e5ff72c85a8982c75b40f74be3555d760 + linux_sha512: 0693f39aaf414cc4c5e1928b4373e24b25797fd3578a22f25d1be2ab5a318dfb42d374dc70c388e9929e8b9795bc397b9d7a281817c6509057ae54047a961582 # renovate: datasource=git-tags extractVersion=^libaio-(?.*)$ depName=https://pagure.io/libaio.git libaio_version: 0.3.113 diff --git a/kernel/build/config-amd64 b/kernel/build/config-amd64 index 6f8969558..a9010bb23 100644 --- a/kernel/build/config-amd64 +++ b/kernel/build/config-amd64 @@ -1,6 +1,6 @@ # # Automatically generated file; DO NOT EDIT. -# Linux/x86 6.18.35 Kernel Configuration +# Linux/x86 6.18.34 Kernel Configuration # CONFIG_CC_VERSION_TEXT="clang version 22.1.7" CONFIG_GCC_VERSION=0 @@ -606,12 +606,11 @@ CONFIG_ACPI_SLEEP=y CONFIG_ACPI_REV_OVERRIDE_POSSIBLE=y CONFIG_ACPI_EC=y # CONFIG_ACPI_EC_DEBUGFS is not set -CONFIG_ACPI_AC=m -CONFIG_ACPI_BATTERY=m -CONFIG_ACPI_BUTTON=m -# CONFIG_ACPI_TINY_POWER_BUTTON is not set -CONFIG_ACPI_VIDEO=m -CONFIG_ACPI_FAN=m +CONFIG_ACPI_AC=y +CONFIG_ACPI_BATTERY=y +CONFIG_ACPI_BUTTON=y +CONFIG_ACPI_VIDEO=y +CONFIG_ACPI_FAN=y # CONFIG_ACPI_TAD is not set CONFIG_ACPI_DOCK=y CONFIG_ACPI_CPU_FREQ_PSS=y @@ -622,7 +621,7 @@ CONFIG_ACPI_PROCESSOR=y CONFIG_ACPI_IPMI=y CONFIG_ACPI_HOTPLUG_CPU=y # CONFIG_ACPI_PROCESSOR_AGGREGATOR is not set -CONFIG_ACPI_THERMAL=m +CONFIG_ACPI_THERMAL=y CONFIG_ARCH_HAS_ACPI_TABLE_UPGRADE=y CONFIG_ACPI_TABLE_UPGRADE=y # CONFIG_ACPI_DEBUG is not set @@ -1021,7 +1020,7 @@ CONFIG_MODULE_SIG_SHA512=y CONFIG_MODULE_SIG_HASH="sha512" # CONFIG_MODULE_COMPRESS is not set # CONFIG_MODULE_ALLOW_MISSING_NAMESPACE_IMPORTS is not set -CONFIG_MODPROBE_PATH="" +CONFIG_MODPROBE_PATH="/sbin/modprobe" # CONFIG_TRIM_UNUSED_KSYMS is not set CONFIG_MODULES_TREE_LOOKUP=y CONFIG_BLOCK=y @@ -1469,6 +1468,7 @@ CONFIG_NF_NAT_TFTP=y CONFIG_NF_NAT_REDIRECT=y CONFIG_NF_NAT_MASQUERADE=y CONFIG_NF_NAT_OVS=y +CONFIG_NETFILTER_SYNPROXY=y CONFIG_NF_TABLES=y CONFIG_NF_TABLES_INET=y CONFIG_NF_TABLES_NETDEV=y @@ -1502,7 +1502,7 @@ CONFIG_NFT_FWD_NETDEV=y # CONFIG_NFT_REJECT_NETDEV is not set # CONFIG_NF_FLOW_TABLE is not set CONFIG_NETFILTER_XTABLES=y -# CONFIG_NETFILTER_XTABLES_COMPAT is not set +CONFIG_NETFILTER_XTABLES_COMPAT=y # CONFIG_NETFILTER_XTABLES_LEGACY is not set # @@ -1676,7 +1676,14 @@ CONFIG_NF_LOG_IPV4=y CONFIG_NF_REJECT_IPV4=y CONFIG_NF_NAT_SNMP_BASIC=y CONFIG_NF_NAT_PPTP=y -# CONFIG_IP_NF_IPTABLES is not set +CONFIG_IP_NF_IPTABLES=y +# CONFIG_IP_NF_MATCH_AH is not set +# CONFIG_IP_NF_MATCH_ECN is not set +CONFIG_IP_NF_MATCH_RPFILTER=y +# CONFIG_IP_NF_MATCH_TTL is not set +CONFIG_IP_NF_TARGET_REJECT=y +# CONFIG_IP_NF_TARGET_SYNPROXY is not set +# CONFIG_IP_NF_TARGET_ECN is not set # end of IP: Netfilter Configuration # @@ -1691,7 +1698,20 @@ CONFIG_NFT_FIB_IPV6=y CONFIG_NF_DUP_IPV6=y CONFIG_NF_REJECT_IPV6=y CONFIG_NF_LOG_IPV6=y -# CONFIG_IP6_NF_IPTABLES is not set +CONFIG_IP6_NF_IPTABLES=y +CONFIG_IP6_NF_MATCH_AH=y +CONFIG_IP6_NF_MATCH_EUI64=y +CONFIG_IP6_NF_MATCH_FRAG=y +CONFIG_IP6_NF_MATCH_OPTS=y +CONFIG_IP6_NF_MATCH_HL=y +CONFIG_IP6_NF_MATCH_IPV6HEADER=y +CONFIG_IP6_NF_MATCH_MH=y +CONFIG_IP6_NF_MATCH_RPFILTER=y +CONFIG_IP6_NF_MATCH_RT=y +# CONFIG_IP6_NF_MATCH_SRH is not set +CONFIG_IP6_NF_TARGET_REJECT=y +CONFIG_IP6_NF_TARGET_SYNPROXY=y +# CONFIG_IP6_NF_TARGET_NPT is not set # end of IPv6: Netfilter Configuration CONFIG_NF_DEFRAG_IPV6=y @@ -1699,15 +1719,38 @@ CONFIG_NF_TABLES_BRIDGE=y # CONFIG_NFT_BRIDGE_META is not set # CONFIG_NFT_BRIDGE_REJECT is not set # CONFIG_NF_CONNTRACK_BRIDGE is not set -# CONFIG_BRIDGE_NF_EBTABLES is not set +CONFIG_BRIDGE_NF_EBTABLES=y +CONFIG_BRIDGE_EBT_802_3=y +CONFIG_BRIDGE_EBT_AMONG=y +CONFIG_BRIDGE_EBT_ARP=y +CONFIG_BRIDGE_EBT_IP=y +CONFIG_BRIDGE_EBT_IP6=y +CONFIG_BRIDGE_EBT_LIMIT=y +CONFIG_BRIDGE_EBT_MARK=y +CONFIG_BRIDGE_EBT_PKTTYPE=y +CONFIG_BRIDGE_EBT_STP=y +CONFIG_BRIDGE_EBT_VLAN=y +CONFIG_BRIDGE_EBT_ARPREPLY=y +CONFIG_BRIDGE_EBT_DNAT=y +CONFIG_BRIDGE_EBT_MARK_T=y +CONFIG_BRIDGE_EBT_REDIRECT=y +CONFIG_BRIDGE_EBT_SNAT=y +CONFIG_BRIDGE_EBT_LOG=y +CONFIG_BRIDGE_EBT_NFLOG=y CONFIG_IP_SCTP=y # CONFIG_SCTP_DBG_OBJCNT is not set CONFIG_SCTP_DEFAULT_COOKIE_HMAC_SHA256=y # CONFIG_SCTP_DEFAULT_COOKIE_HMAC_NONE is not set CONFIG_INET_SCTP_DIAG=y -# CONFIG_RDS is not set +CONFIG_RDS=y +# CONFIG_RDS_RDMA is not set +# CONFIG_RDS_TCP is not set +# CONFIG_RDS_DEBUG is not set # CONFIG_TIPC is not set -# CONFIG_ATM is not set +CONFIG_ATM=y +# CONFIG_ATM_CLIP is not set +# CONFIG_ATM_LANE is not set +# CONFIG_ATM_BR2684 is not set CONFIG_L2TP=y # CONFIG_L2TP_DEBUGFS is not set # CONFIG_L2TP_V3 is not set @@ -1745,11 +1788,11 @@ CONFIG_VLAN_8021Q=y # CONFIG_VLAN_8021Q_GVRP is not set # CONFIG_VLAN_8021Q_MVRP is not set CONFIG_LLC=y -# CONFIG_LLC2 is not set +CONFIG_LLC2=y # CONFIG_ATALK is not set -# CONFIG_X25 is not set -# CONFIG_LAPB is not set -# CONFIG_PHONET is not set +CONFIG_X25=y +CONFIG_LAPB=y +CONFIG_PHONET=y # CONFIG_6LOWPAN is not set # CONFIG_IEEE802154 is not set CONFIG_NET_SCHED=y @@ -1856,10 +1899,10 @@ CONFIG_OPENVSWITCH_GENEVE=y CONFIG_VSOCKETS=y CONFIG_VSOCKETS_DIAG=y CONFIG_VSOCKETS_LOOPBACK=y -CONFIG_VMWARE_VMCI_VSOCKETS=m -CONFIG_VIRTIO_VSOCKETS=m +CONFIG_VMWARE_VMCI_VSOCKETS=y +CONFIG_VIRTIO_VSOCKETS=y CONFIG_VIRTIO_VSOCKETS_COMMON=y -CONFIG_HYPERV_VSOCKETS=m +CONFIG_HYPERV_VSOCKETS=y CONFIG_NETLINK_DIAG=y CONFIG_MPLS=y CONFIG_NET_MPLS_GSO=y @@ -1956,7 +1999,7 @@ CONFIG_PCI_QUIRKS=y CONFIG_PCI_REALLOC_ENABLE_AUTO=y # CONFIG_PCI_STUB is not set # CONFIG_PCI_PF_STUB is not set -CONFIG_XEN_PCIDEV_FRONTEND=m +CONFIG_XEN_PCIDEV_FRONTEND=y CONFIG_PCI_ATS=y # CONFIG_PCI_DOE is not set CONFIG_PCI_ECAM=y @@ -1968,7 +2011,7 @@ CONFIG_PCI_PASID=y # CONFIG_PCIE_TPH is not set CONFIG_PCI_P2PDMA=y CONFIG_PCI_LABEL=y -CONFIG_PCI_HYPERV=m +CONFIG_PCI_HYPERV=y # CONFIG_PCIE_BUS_TUNE_OFF is not set CONFIG_PCIE_BUS_DEFAULT=y # CONFIG_PCIE_BUS_SAFE is not set @@ -1987,7 +2030,7 @@ CONFIG_HOTPLUG_PCI_ACPI=y # PCI controller drivers # CONFIG_PCI_HOST_COMMON=y -CONFIG_VMD=m +CONFIG_VMD=y CONFIG_PCI_HYPERV_INTERFACE=y # @@ -2045,7 +2088,8 @@ CONFIG_PCI_EPF_NTB=y # Generic Driver Options # CONFIG_AUXILIARY_BUS=y -# CONFIG_UEVENT_HELPER is not set +CONFIG_UEVENT_HELPER=y +CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug" CONFIG_DEVTMPFS=y # CONFIG_DEVTMPFS_MOUNT is not set # CONFIG_DEVTMPFS_SAFE is not set @@ -2118,7 +2162,7 @@ CONFIG_ISCSI_IBFT_FIND=y CONFIG_ISCSI_IBFT=y # CONFIG_FW_CFG_SYSFS is not set CONFIG_SYSFB=y -CONFIG_SYSFB_SIMPLEFB=y +# CONFIG_SYSFB_SIMPLEFB is not set # CONFIG_GOOGLE_FIRMWARE is not set # @@ -2178,15 +2222,27 @@ CONFIG_BLK_DEV=y # CONFIG_BLK_DEV_FD is not set CONFIG_CDROM=y # CONFIG_BLK_DEV_PCIESSD_MTIP32XX is not set -# CONFIG_ZRAM is not set +CONFIG_ZRAM=y +# CONFIG_ZRAM_BACKEND_LZ4 is not set +# CONFIG_ZRAM_BACKEND_LZ4HC is not set +CONFIG_ZRAM_BACKEND_ZSTD=y +# CONFIG_ZRAM_BACKEND_DEFLATE is not set +# CONFIG_ZRAM_BACKEND_842 is not set +# CONFIG_ZRAM_BACKEND_LZO is not set +CONFIG_ZRAM_DEF_COMP_ZSTD=y +CONFIG_ZRAM_DEF_COMP="zstd" +# CONFIG_ZRAM_WRITEBACK is not set +# CONFIG_ZRAM_TRACK_ENTRY_ACTIME is not set +# CONFIG_ZRAM_MEMORY_TRACKING is not set +# CONFIG_ZRAM_MULTI_COMP is not set CONFIG_BLK_DEV_LOOP=y CONFIG_BLK_DEV_LOOP_MIN_COUNT=8 # CONFIG_BLK_DEV_DRBD is not set CONFIG_BLK_DEV_NBD=m # CONFIG_BLK_DEV_RAM is not set # CONFIG_ATA_OVER_ETH is not set -CONFIG_XEN_BLKDEV_FRONTEND=m -CONFIG_VIRTIO_BLK=m +CONFIG_XEN_BLKDEV_FRONTEND=y +CONFIG_VIRTIO_BLK=y CONFIG_BLK_DEV_RBD=y CONFIG_BLK_DEV_UBLK=m # CONFIG_BLKDEV_UBLK_LEGACY_OPCODES is not set @@ -2240,7 +2296,7 @@ CONFIG_HP_ILO=m # CONFIG_SENSORS_APDS990X is not set # CONFIG_HMC6352 is not set # CONFIG_DS1682 is not set -CONFIG_VMWARE_BALLOON=m +CONFIG_VMWARE_BALLOON=y # CONFIG_SRAM is not set # CONFIG_DW_XDATA_PCIE is not set # CONFIG_PCI_ENDPOINT_TEST is not set @@ -2271,7 +2327,7 @@ CONFIG_INTEL_MEI_GSC=m CONFIG_INTEL_MEI_HDCP=m CONFIG_INTEL_MEI_PXP=m CONFIG_INTEL_MEI_GSC_PROXY=m -CONFIG_VMWARE_VMCI=m +CONFIG_VMWARE_VMCI=y # CONFIG_GENWQE is not set # CONFIG_BCM_VK is not set # CONFIG_MISC_ALCOR_PCI is not set @@ -2357,8 +2413,8 @@ CONFIG_SCSI_SMARTPQI=m # CONFIG_SCSI_MYRB is not set # CONFIG_SCSI_MYRS is not set CONFIG_VMWARE_PVSCSI=m -CONFIG_XEN_SCSI_FRONTEND=m -CONFIG_HYPERV_STORAGE=m +CONFIG_XEN_SCSI_FRONTEND=y +CONFIG_HYPERV_STORAGE=y CONFIG_LIBFC=m CONFIG_LIBFCOE=m # CONFIG_FCOE is not set @@ -2387,7 +2443,7 @@ CONFIG_SCSI_LPFC=m # CONFIG_SCSI_PMCRAID is not set # CONFIG_SCSI_PM8001 is not set # CONFIG_SCSI_BFA_FC is not set -CONFIG_SCSI_VIRTIO=m +CONFIG_SCSI_VIRTIO=y # CONFIG_SCSI_CHELSIO_FCOE is not set # CONFIG_SCSI_DH is not set # end of SCSI device support @@ -2424,7 +2480,7 @@ CONFIG_ATA_BMDMA=y # # SATA SFF controllers with BMDMA # -CONFIG_ATA_PIIX=m +CONFIG_ATA_PIIX=y # CONFIG_SATA_DWC is not set # CONFIG_SATA_MV is not set # CONFIG_SATA_NV is not set @@ -2589,12 +2645,23 @@ CONFIG_TUN=y CONFIG_TAP=y # CONFIG_TUN_VNET_CROSS_LE is not set CONFIG_VETH=y -CONFIG_VIRTIO_NET=m +CONFIG_VIRTIO_NET=y # CONFIG_NLMON is not set CONFIG_NETKIT=y CONFIG_NET_VRF=m # CONFIG_VSOCKMON is not set # CONFIG_ARCNET is not set +CONFIG_ATM_DRIVERS=y +# CONFIG_ATM_DUMMY is not set +# CONFIG_ATM_TCP is not set +# CONFIG_ATM_LANAI is not set +# CONFIG_ATM_ENI is not set +# CONFIG_ATM_NICSTAR is not set +# CONFIG_ATM_IDT77252 is not set +# CONFIG_ATM_IA is not set +# CONFIG_ATM_FORE200E is not set +# CONFIG_ATM_HE is not set +# CONFIG_ATM_SOLOS is not set # # Distributed Switch Architecture drivers @@ -2919,7 +2986,9 @@ CONFIG_NET_VENDOR_WIZNET=y CONFIG_NET_VENDOR_XILINX=y # CONFIG_XILINX_EMACLITE is not set # CONFIG_XILINX_LL_TEMAC is not set -# CONFIG_FDDI is not set +CONFIG_FDDI=y +# CONFIG_DEFXX is not set +# CONFIG_SKFP is not set # CONFIG_HIPPI is not set CONFIG_MDIO_BUS=y CONFIG_PHYLINK=y @@ -3014,6 +3083,7 @@ CONFIG_PPP=y # CONFIG_PPP_FILTER is not set # CONFIG_PPP_MPPE is not set # CONFIG_PPP_MULTILINK is not set +# CONFIG_PPPOATM is not set # CONFIG_PPPOE is not set CONFIG_PPPOE_HASH_BITS=4 # CONFIG_PPTP is not set @@ -3060,6 +3130,7 @@ CONFIG_USB_NET_CX82310_ETH=m CONFIG_USB_NET_KALMIA=m CONFIG_USB_NET_QMI_WWAN=m CONFIG_USB_NET_INT51X1=m +CONFIG_USB_CDC_PHONET=m CONFIG_USB_IPHETH=m CONFIG_USB_SIERRA_NET=m CONFIG_USB_VL600=m @@ -3075,11 +3146,11 @@ CONFIG_USB_RTL8153_ECM=m # CONFIG_WWAN is not set # end of Wireless WAN -CONFIG_XEN_NETDEV_FRONTEND=m +CONFIG_XEN_NETDEV_FRONTEND=y CONFIG_VMXNET3=m # CONFIG_FUJITSU_ES is not set CONFIG_USB4_NET=m -CONFIG_HYPERV_NET=m +CONFIG_HYPERV_NET=y # CONFIG_NETDEVSIM is not set CONFIG_NET_FAILOVER=y # CONFIG_ISDN is not set @@ -3133,7 +3204,7 @@ CONFIG_KEYBOARD_ATKBD=y # CONFIG_KEYBOARD_XTKBD is not set # CONFIG_KEYBOARD_CYPRESS_SF is not set CONFIG_INPUT_MOUSE=y -CONFIG_MOUSE_PS2=m +CONFIG_MOUSE_PS2=y CONFIG_MOUSE_PS2_ALPS=y CONFIG_MOUSE_PS2_BYD=y CONFIG_MOUSE_PS2_LOGIPS2PP=y @@ -3290,7 +3361,7 @@ CONFIG_INPUT_UINPUT=m # CONFIG_INPUT_IQS626A is not set # CONFIG_INPUT_IQS7222 is not set # CONFIG_INPUT_CMA3000 is not set -CONFIG_INPUT_XEN_KBDDEV_FRONTEND=m +CONFIG_INPUT_XEN_KBDDEV_FRONTEND=y # CONFIG_INPUT_IDEAPAD_SLIDEBAR is not set # CONFIG_INPUT_DRV260X_HAPTICS is not set # CONFIG_INPUT_DRV2665_HAPTICS is not set @@ -3311,7 +3382,7 @@ CONFIG_SERIO_LIBPS2=y # CONFIG_SERIO_ALTERA_PS2 is not set # CONFIG_SERIO_PS2MULT is not set # CONFIG_SERIO_ARC_PS2 is not set -CONFIG_HYPERV_KEYBOARD=m +CONFIG_HYPERV_KEYBOARD=y # CONFIG_SERIO_GPIO_PS2 is not set # CONFIG_USERIO is not set # CONFIG_GAMEPORT is not set @@ -3396,13 +3467,13 @@ CONFIG_HVC_XEN_FRONTEND=y # CONFIG_RPMSG_TTY is not set # CONFIG_SERIAL_DEV_BUS is not set # CONFIG_TTY_PRINTK is not set -CONFIG_VIRTIO_CONSOLE=m +CONFIG_VIRTIO_CONSOLE=y CONFIG_IPMI_HANDLER=y CONFIG_IPMI_DMI_DECODE=y CONFIG_IPMI_PLAT_DATA=y # CONFIG_IPMI_PANIC_EVENT is not set CONFIG_IPMI_DEVICE_INTERFACE=y -CONFIG_IPMI_SI=m +CONFIG_IPMI_SI=y # CONFIG_IPMI_SSIF is not set CONFIG_IPMI_WATCHDOG=m CONFIG_IPMI_POWEROFF=y @@ -3418,7 +3489,7 @@ CONFIG_HW_RANDOM_XIPHERA=m # CONFIG_MWAVE is not set # CONFIG_DEVMEM is not set CONFIG_NVRAM=y -# CONFIG_DEVPORT is not set +CONFIG_DEVPORT=y CONFIG_HPET=y # CONFIG_HPET_MMAP is not set # CONFIG_HANGCHECK_TIMER is not set @@ -3756,7 +3827,7 @@ CONFIG_POWER_SUPPLY_HWMON=y # CONFIG_BATTERY_UG3105 is not set # CONFIG_FUEL_GAUGE_MM8013 is not set CONFIG_HWMON=y -CONFIG_HWMON_VID=m +CONFIG_HWMON_VID=y # CONFIG_HWMON_DEBUG_CHIP is not set # @@ -3792,7 +3863,7 @@ CONFIG_SENSORS_FAM15H_POWER=m # CONFIG_SENSORS_CHIPCAP2 is not set # CONFIG_SENSORS_CORSAIR_CPRO is not set # CONFIG_SENSORS_CORSAIR_PSU is not set -CONFIG_SENSORS_DRIVETEMP=m +CONFIG_SENSORS_DRIVETEMP=y # CONFIG_SENSORS_DS620 is not set # CONFIG_SENSORS_DS1621 is not set # CONFIG_SENSORS_DELL_SMM is not set @@ -3814,7 +3885,7 @@ CONFIG_SENSORS_I5K_AMB=m # CONFIG_SENSORS_IBMAEM is not set # CONFIG_SENSORS_IBMPEX is not set CONFIG_SENSORS_I5500=m -CONFIG_SENSORS_CORETEMP=m +CONFIG_SENSORS_CORETEMP=y # CONFIG_SENSORS_ISL28022 is not set CONFIG_SENSORS_IT87=m # CONFIG_SENSORS_JC42 is not set @@ -3870,9 +3941,9 @@ CONFIG_SENSORS_IT87=m # CONFIG_SENSORS_LM95245 is not set # CONFIG_SENSORS_PC87360 is not set # CONFIG_SENSORS_PC87427 is not set -CONFIG_SENSORS_NCT6683=m +CONFIG_SENSORS_NCT6683=y CONFIG_SENSORS_NCT6775_CORE=y -CONFIG_SENSORS_NCT6775=m +CONFIG_SENSORS_NCT6775=y CONFIG_SENSORS_NCT6775_I2C=y # CONFIG_SENSORS_NCT7363 is not set # CONFIG_SENSORS_NCT7802 is not set @@ -3940,7 +4011,7 @@ CONFIG_SENSORS_NCT6775_I2C=y # # ACPI drivers # -CONFIG_SENSORS_ACPI_POWER=m +CONFIG_SENSORS_ACPI_POWER=y # CONFIG_SENSORS_ATK0110 is not set # CONFIG_SENSORS_ASUS_WMI is not set # CONFIG_SENSORS_ASUS_EC is not set @@ -4324,20 +4395,7 @@ CONFIG_USB_VIDEO_CLASS_INPUT_EVDEV=y # # CONFIG_DVB_AS102 is not set # CONFIG_DVB_B2C2_FLEXCOP_USB is not set -CONFIG_DVB_USB_V2=m -# CONFIG_DVB_USB_AF9015 is not set -# CONFIG_DVB_USB_AF9035 is not set -# CONFIG_DVB_USB_ANYSEE is not set -# CONFIG_DVB_USB_AU6610 is not set -# CONFIG_DVB_USB_AZ6007 is not set -# CONFIG_DVB_USB_CE6230 is not set -CONFIG_DVB_USB_DVBSKY=m -# CONFIG_DVB_USB_EC168 is not set -# CONFIG_DVB_USB_GL861 is not set -# CONFIG_DVB_USB_LME2510 is not set -# CONFIG_DVB_USB_MXL111SF is not set -# CONFIG_DVB_USB_RTL28XXU is not set -# CONFIG_DVB_USB_ZD1301 is not set +# CONFIG_DVB_USB_V2 is not set # CONFIG_DVB_USB is not set # CONFIG_SMS_USB_DRV is not set # CONFIG_DVB_TTUSB_BUDGET is not set @@ -4731,7 +4789,7 @@ CONFIG_MEDIA_TUNER_XC5000=m # # Multistandard (satellite) frontends # -CONFIG_DVB_M88DS3103=m +# CONFIG_DVB_M88DS3103 is not set CONFIG_DVB_MXL5XX=m CONFIG_DVB_STB0899=m CONFIG_DVB_STB6100=m @@ -4899,8 +4957,13 @@ CONFIG_APERTURE_HELPERS=y CONFIG_SCREEN_INFO=y CONFIG_VIDEO=y # CONFIG_AUXDISPLAY is not set -# CONFIG_AGP is not set -CONFIG_INTEL_GTT=m +CONFIG_AGP=y +CONFIG_AGP_AMD64=y +CONFIG_AGP_INTEL=y +# CONFIG_AGP_SIS is not set +# CONFIG_AGP_VIA is not set +CONFIG_INTEL_GTT=y +# CONFIG_VGA_SWITCHEROO is not set CONFIG_DRM=y # @@ -4954,8 +5017,9 @@ CONFIG_DRM_SCHED=m # # Drivers for system framebuffers # -CONFIG_DRM_SYSFB_HELPER=y -CONFIG_DRM_SIMPLEDRM=y +# CONFIG_DRM_EFIDRM is not set +# CONFIG_DRM_SIMPLEDRM is not set +# CONFIG_DRM_VESADRM is not set # end of Drivers for system framebuffers # @@ -5070,7 +5134,7 @@ CONFIG_DRM_XE_ENABLE_SCHEDTIMEOUT_LIMIT=y # CONFIG_DRM_AST is not set # CONFIG_DRM_MGAG200 is not set # CONFIG_DRM_QXL is not set -CONFIG_DRM_VIRTIO_GPU=m +CONFIG_DRM_VIRTIO_GPU=y CONFIG_DRM_VIRTIO_GPU_KMS=y CONFIG_DRM_PANEL=y @@ -5108,21 +5172,71 @@ CONFIG_DRM_PANEL_ORIENTATION_QUIRKS=y # # Frame buffer Devices # -# CONFIG_FB is not set +CONFIG_FB=y +# CONFIG_FB_CIRRUS is not set +# CONFIG_FB_PM2 is not set +# CONFIG_FB_CYBER2000 is not set +# CONFIG_FB_ARC is not set +# CONFIG_FB_ASILIANT is not set +# CONFIG_FB_IMSTT is not set +CONFIG_FB_VGA16=y +# CONFIG_FB_UVESA is not set +CONFIG_FB_VESA=y +CONFIG_FB_EFI=y +# CONFIG_FB_N411 is not set +# CONFIG_FB_HGA is not set +# CONFIG_FB_OPENCORES is not set +# CONFIG_FB_S1D13XXX is not set +# CONFIG_FB_NVIDIA is not set +# CONFIG_FB_RIVA is not set +# CONFIG_FB_I740 is not set +# CONFIG_FB_MATROX is not set +# CONFIG_FB_RADEON is not set +# CONFIG_FB_ATY128 is not set +# CONFIG_FB_ATY is not set +# CONFIG_FB_S3 is not set +# CONFIG_FB_SAVAGE is not set +# CONFIG_FB_SIS is not set +# CONFIG_FB_VIA is not set +# CONFIG_FB_NEOMAGIC is not set +# CONFIG_FB_KYRO is not set +# CONFIG_FB_3DFX is not set +# CONFIG_FB_VOODOO1 is not set +# CONFIG_FB_VT8623 is not set +# CONFIG_FB_TRIDENT is not set +# CONFIG_FB_ARK is not set +# CONFIG_FB_PM3 is not set +# CONFIG_FB_CARMINE is not set +# CONFIG_FB_SMSCUFX is not set +# CONFIG_FB_UDL is not set +# CONFIG_FB_IBM_GXT4500 is not set +# CONFIG_FB_VIRTUAL is not set +CONFIG_XEN_FBDEV_FRONTEND=y +# CONFIG_FB_METRONOME is not set +# CONFIG_FB_MB862XX is not set +CONFIG_FB_HYPERV=y +# CONFIG_FB_SIMPLE is not set +# CONFIG_FB_SSD1307 is not set +# CONFIG_FB_SM712 is not set CONFIG_FB_CORE=y -# CONFIG_FB_DEVICE is not set +CONFIG_FB_NOTIFY=y +CONFIG_FB_DEVICE=y CONFIG_FB_CFB_FILLRECT=y CONFIG_FB_CFB_COPYAREA=y CONFIG_FB_CFB_IMAGEBLIT=y CONFIG_FB_SYS_FILLRECT=y CONFIG_FB_SYS_COPYAREA=y CONFIG_FB_SYS_IMAGEBLIT=y +# CONFIG_FB_FOREIGN_ENDIAN is not set CONFIG_FB_SYSMEM_FOPS=y CONFIG_FB_DEFERRED_IO=y CONFIG_FB_IOMEM_FOPS=y CONFIG_FB_IOMEM_HELPERS=y +CONFIG_FB_IOMEM_HELPERS_DEFERRED=y CONFIG_FB_SYSMEM_HELPERS=y CONFIG_FB_SYSMEM_HELPERS_DEFERRED=y +CONFIG_FB_MODE_HELPERS=y +CONFIG_FB_TILEBLITTING=y # end of Frame buffer Devices # @@ -5150,6 +5264,7 @@ CONFIG_BACKLIGHT_CLASS_DEVICE=y # CONFIG_BACKLIGHT_ARCXCNN is not set # end of Backlight & LCD device support +CONFIG_VGASTATE=y CONFIG_HDMI=y # CONFIG_FIRMWARE_EDID is not set @@ -5164,6 +5279,7 @@ CONFIG_FRAMEBUFFER_CONSOLE=y # CONFIG_FRAMEBUFFER_CONSOLE_LEGACY_ACCELERATION is not set CONFIG_FRAMEBUFFER_CONSOLE_DETECT_PRIMARY=y # CONFIG_FRAMEBUFFER_CONSOLE_ROTATION is not set +# CONFIG_FRAMEBUFFER_CONSOLE_DEFERRED_TAKEOVER is not set # end of Console display driver support CONFIG_LOGO=y @@ -5377,7 +5493,7 @@ CONFIG_LOGIWHEELS_FF=y # CONFIG_HID_MALTRON is not set # CONFIG_HID_MAYFLASH is not set # CONFIG_HID_MEGAWORLD_FF is not set -CONFIG_HID_REDRAGON=m +CONFIG_HID_REDRAGON=y CONFIG_HID_MICROSOFT=m CONFIG_HID_MONTEREY=m CONFIG_HID_MULTITOUCH=m @@ -5435,7 +5551,7 @@ CONFIG_HID_TOPSEED=m # CONFIG_HID_BPF is not set # end of HID-BPF support -CONFIG_I2C_HID=m +CONFIG_I2C_HID=y # CONFIG_I2C_HID_ACPI is not set # CONFIG_I2C_HID_OF is not set @@ -5460,16 +5576,9 @@ CONFIG_I2C_HID=m # # USB HID support # -CONFIG_USB_HID=m +CONFIG_USB_HID=y # CONFIG_HID_PID is not set CONFIG_USB_HIDDEV=y - -# -# USB HID Boot Protocol drivers -# -# CONFIG_USB_KBD is not set -# CONFIG_USB_MOUSE is not set -# end of USB HID Boot Protocol drivers # end of USB HID support CONFIG_USB_OHCI_LITTLE_ENDIAN=y @@ -5502,22 +5611,22 @@ CONFIG_USB_DEFAULT_AUTHORIZATION_MODE=1 # USB Host Controller Drivers # # CONFIG_USB_C67X00_HCD is not set -CONFIG_USB_XHCI_HCD=m +CONFIG_USB_XHCI_HCD=y # CONFIG_USB_XHCI_DBGCAP is not set -CONFIG_USB_XHCI_PCI=m +CONFIG_USB_XHCI_PCI=y # CONFIG_USB_XHCI_PCI_RENESAS is not set -CONFIG_USB_XHCI_PLATFORM=m +CONFIG_USB_XHCI_PLATFORM=y # CONFIG_USB_XHCI_SIDEBAND is not set -CONFIG_USB_EHCI_HCD=m +CONFIG_USB_EHCI_HCD=y # CONFIG_USB_EHCI_ROOT_HUB_TT is not set CONFIG_USB_EHCI_TT_NEWSCHED=y -CONFIG_USB_EHCI_PCI=m +CONFIG_USB_EHCI_PCI=y # CONFIG_USB_EHCI_FSL is not set # CONFIG_USB_EHCI_HCD_PLATFORM is not set # CONFIG_USB_OXU210HP_HCD is not set # CONFIG_USB_ISP116X_HCD is not set # CONFIG_USB_OHCI_HCD is not set -CONFIG_USB_UHCI_HCD=m +CONFIG_USB_UHCI_HCD=y # CONFIG_USB_SL811_HCD is not set # CONFIG_USB_R8A66597_HCD is not set # CONFIG_USB_HCD_TEST_MODE is not set @@ -5526,7 +5635,7 @@ CONFIG_USB_UHCI_HCD=m # # USB Device Class drivers # -CONFIG_USB_ACM=m +CONFIG_USB_ACM=y # CONFIG_USB_PRINTER is not set CONFIG_USB_WDM=m # CONFIG_USB_TMC is not set @@ -5534,7 +5643,7 @@ CONFIG_USB_WDM=m # # NOTE: USB_STORAGE depends on SCSI but BLK_DEV_SD may also be needed; see USB_STORAGE Help for more info # -CONFIG_USB_STORAGE=m +CONFIG_USB_STORAGE=y # CONFIG_USB_STORAGE_DEBUG is not set # CONFIG_USB_STORAGE_REALTEK is not set # CONFIG_USB_STORAGE_DATAFAB is not set @@ -5549,7 +5658,7 @@ CONFIG_USB_STORAGE=m # CONFIG_USB_STORAGE_KARMA is not set # CONFIG_USB_STORAGE_CYPRESS_ATACB is not set # CONFIG_USB_STORAGE_ENE_UB6250 is not set -CONFIG_USB_UAS=m +CONFIG_USB_UAS=y # # USB Imaging devices @@ -5657,6 +5766,7 @@ CONFIG_USB_SERIAL_OPTION=m # CONFIG_USB_HSIC_USB4604 is not set # CONFIG_USB_LINK_LAYER_TEST is not set # CONFIG_USB_CHAOSKEY is not set +# CONFIG_USB_ATM is not set # # USB Physical Layer drivers @@ -5679,7 +5789,7 @@ CONFIG_MMC_BLOCK_MINORS=32 # MMC/SD/SDIO Host Controller Drivers # # CONFIG_MMC_DEBUG is not set -CONFIG_MMC_SDHCI=m +CONFIG_MMC_SDHCI=y CONFIG_MMC_SDHCI_IO_ACCESSORS=y CONFIG_MMC_SDHCI_UHS2=m CONFIG_MMC_SDHCI_PCI=m @@ -5782,7 +5892,7 @@ CONFIG_LEDS_TRIGGERS=y # Simatic LED drivers # # CONFIG_ACCESSIBILITY is not set -CONFIG_INFINIBAND=m +CONFIG_INFINIBAND=y CONFIG_INFINIBAND_USER_MAD=m CONFIG_INFINIBAND_USER_ACCESS=m CONFIG_INFINIBAND_USER_MEM=y @@ -5805,7 +5915,7 @@ CONFIG_MLX5_INFINIBAND=m # CONFIG_INFINIBAND_RDMAVT is not set CONFIG_RDMA_RXE=m # CONFIG_RDMA_SIW is not set -CONFIG_INFINIBAND_IPOIB=m +CONFIG_INFINIBAND_IPOIB=y # CONFIG_INFINIBAND_IPOIB_CM is not set CONFIG_INFINIBAND_IPOIB_DEBUG=y # CONFIG_INFINIBAND_IPOIB_DEBUG_DATA is not set @@ -5945,7 +6055,7 @@ CONFIG_DMA_ACPI=y # CONFIG_INTEL_IDMA64 is not set # CONFIG_INTEL_IDXD is not set # CONFIG_INTEL_IDXD_COMPAT is not set -CONFIG_INTEL_IOATDMA=m +CONFIG_INTEL_IOATDMA=y # CONFIG_PLX_DMA is not set # CONFIG_XILINX_DMA is not set # CONFIG_XILINX_XDMA is not set @@ -5981,7 +6091,7 @@ CONFIG_DMABUF_MOVE_NOTIFY=y # CONFIG_DMABUF_SYSFS_STATS is not set # end of DMABUF options -CONFIG_DCA=m +CONFIG_DCA=y CONFIG_UIO=m # CONFIG_UIO_CIF is not set # CONFIG_UIO_PDRV_GENIRQ is not set @@ -6014,7 +6124,7 @@ CONFIG_VFIO_PCI_IGD=y CONFIG_IRQ_BYPASS_MANAGER=y CONFIG_VIRT_DRIVERS=y -CONFIG_VMGENID=m +CONFIG_VMGENID=y # CONFIG_VBOXGUEST is not set CONFIG_NITRO_ENCLAVES=y # CONFIG_EFI_SECRET is not set @@ -6034,7 +6144,7 @@ CONFIG_VIRTIO_BALLOON=m CONFIG_VIRTIO_MEM=m # CONFIG_VIRTIO_INPUT is not set # CONFIG_VIRTIO_MMIO is not set -CONFIG_VIRTIO_DMA_SHARED_BUFFER=m +CONFIG_VIRTIO_DMA_SHARED_BUFFER=y # CONFIG_VIRTIO_DEBUG is not set # CONFIG_VIRTIO_RTC is not set CONFIG_VDPA=m @@ -6067,8 +6177,8 @@ CONFIG_VHOST_ENABLE_FORK_OWNER_CONTROL=y CONFIG_HYPERV=y # CONFIG_HYPERV_VTL_MODE is not set CONFIG_HYPERV_TIMER=y -CONFIG_HYPERV_UTILS=m -CONFIG_HYPERV_BALLOON=m +CONFIG_HYPERV_UTILS=y +CONFIG_HYPERV_BALLOON=y CONFIG_HYPERV_VMBUS=y # CONFIG_MSHV_ROOT is not set # end of Microsoft Hyper-V guest support @@ -6113,9 +6223,9 @@ CONFIG_SURFACE_PLATFORMS=y # CONFIG_SURFACE_HOTPLUG is not set # CONFIG_SURFACE_PRO3_BUTTON is not set CONFIG_X86_PLATFORM_DEVICES=y -CONFIG_ACPI_WMI=m +CONFIG_ACPI_WMI=y # CONFIG_ACPI_WMI_LEGACY_DEVICE_NAMES is not set -CONFIG_WMI_BMOF=m +CONFIG_WMI_BMOF=y # CONFIG_HUAWEI_WMI is not set # CONFIG_MXM_WMI is not set # CONFIG_NVIDIA_WMI_EC_BACKLIGHT is not set @@ -6144,7 +6254,7 @@ CONFIG_WMI_BMOF=m # CONFIG_ASUS_WIRELESS is not set # CONFIG_ASUS_WMI is not set # CONFIG_ASUS_TF103C_DOCK is not set -CONFIG_EEEPC_LAPTOP=m +CONFIG_EEEPC_LAPTOP=y # CONFIG_X86_PLATFORM_DRIVERS_DELL is not set # CONFIG_FUJITSU_LAPTOP is not set # CONFIG_FUJITSU_TABLET is not set @@ -6536,7 +6646,7 @@ CONFIG_QUOTACTL=y CONFIG_AUTOFS_FS=y CONFIG_FUSE_FS=y # CONFIG_CUSE is not set -CONFIG_VIRTIO_FS=m +CONFIG_VIRTIO_FS=y CONFIG_FUSE_PASSTHROUGH=y CONFIG_FUSE_IO_URING=y CONFIG_OVERLAY_FS=y @@ -6698,7 +6808,7 @@ CONFIG_SUNRPC_GSS=y CONFIG_SUNRPC_BACKCHANNEL=y CONFIG_RPCSEC_GSS_KRB5=y # CONFIG_SUNRPC_DEBUG is not set -CONFIG_SUNRPC_XPRT_RDMA=m +CONFIG_SUNRPC_XPRT_RDMA=y CONFIG_CEPH_FS=y CONFIG_CEPH_FS_POSIX_ACL=y # CONFIG_CEPH_FS_SECURITY_LABEL is not set @@ -6713,6 +6823,7 @@ CONFIG_CIFS_DEBUG=y # CONFIG_CIFS_DEBUG_DUMP_KEYS is not set CONFIG_CIFS_DFS_UPCALL=y # CONFIG_CIFS_SWN_UPCALL is not set +# CONFIG_CIFS_SMB_DIRECT is not set # CONFIG_CIFS_ROOT is not set # CONFIG_CIFS_COMPRESSION is not set # CONFIG_SMB_SERVER is not set @@ -6799,8 +6910,7 @@ CONFIG_SECURITY_NETWORK_XFRM=y CONFIG_SECURITY_PATH=y # CONFIG_INTEL_TXT is not set CONFIG_LSM_MMAP_MIN_ADDR=65536 -CONFIG_STATIC_USERMODEHELPER=y -CONFIG_STATIC_USERMODEHELPER_PATH="/sbin/init" +# CONFIG_STATIC_USERMODEHELPER is not set CONFIG_SECURITY_SELINUX=y # CONFIG_SECURITY_SELINUX_BOOTPARAM is not set CONFIG_SECURITY_SELINUX_DEVELOP=y @@ -6819,7 +6929,7 @@ CONFIG_SECURITY_APPARMOR_EXPORT_BINARY=y CONFIG_SECURITY_APPARMOR_PARANOID_LOAD=y # CONFIG_SECURITY_LOADPIN is not set CONFIG_SECURITY_YAMA=y -CONFIG_SECURITY_SAFESETID=y +# CONFIG_SECURITY_SAFESETID is not set CONFIG_SECURITY_LOCKDOWN_LSM=y CONFIG_SECURITY_LOCKDOWN_LSM_EARLY=y CONFIG_LOCK_DOWN_KERNEL_FORCE_NONE=y @@ -6840,7 +6950,7 @@ CONFIG_INTEGRITY_AUDIT=y # CONFIG_DEFAULT_SECURITY_SELINUX is not set # CONFIG_DEFAULT_SECURITY_APPARMOR is not set CONFIG_DEFAULT_SECURITY_DAC=y -CONFIG_LSM="yama,selinux,safesetid,integrity,bpf,apparmor,lockdown,landlock" +CONFIG_LSM="yama,selinux,loadpin,safesetid,integrity,bpf,apparmor,lockdown,landlock" # # Kernel hardening options @@ -6927,7 +7037,7 @@ CONFIG_CRYPTO_CRYPTD=y CONFIG_CRYPTO_AUTHENC=y # CONFIG_CRYPTO_KRB5ENC is not set # CONFIG_CRYPTO_BENCHMARK is not set -CONFIG_CRYPTO_ENGINE=m +CONFIG_CRYPTO_ENGINE=y # end of Crypto core or helper # @@ -6947,6 +7057,7 @@ CONFIG_CRYPTO_ECDH=y # CONFIG_CRYPTO_AES=y # CONFIG_CRYPTO_AES_TI is not set +# CONFIG_CRYPTO_ANUBIS is not set # CONFIG_CRYPTO_ARIA is not set # CONFIG_CRYPTO_BLOWFISH is not set # CONFIG_CRYPTO_CAMELLIA is not set @@ -6954,8 +7065,11 @@ CONFIG_CRYPTO_AES=y # CONFIG_CRYPTO_CAST6 is not set CONFIG_CRYPTO_DES=y # CONFIG_CRYPTO_FCRYPT is not set +# CONFIG_CRYPTO_KHAZAD is not set +# CONFIG_CRYPTO_SEED is not set # CONFIG_CRYPTO_SERPENT is not set # CONFIG_CRYPTO_SM4_GENERIC is not set +# CONFIG_CRYPTO_TEA is not set # CONFIG_CRYPTO_TWOFISH is not set # end of Block ciphers @@ -6963,6 +7077,7 @@ CONFIG_CRYPTO_DES=y # Length-preserving ciphers and modes # CONFIG_CRYPTO_ADIANTUM=y +CONFIG_CRYPTO_ARC4=y CONFIG_CRYPTO_CHACHA20=y CONFIG_CRYPTO_CBC=y CONFIG_CRYPTO_CTR=y @@ -7046,10 +7161,12 @@ CONFIG_CRYPTO_JITTERENTROPY_OSR=1 # # Userspace interface # -# CONFIG_CRYPTO_USER_API_HASH is not set -# CONFIG_CRYPTO_USER_API_SKCIPHER is not set +CONFIG_CRYPTO_USER_API=y +CONFIG_CRYPTO_USER_API_HASH=y +CONFIG_CRYPTO_USER_API_SKCIPHER=y # CONFIG_CRYPTO_USER_API_RNG is not set -# CONFIG_CRYPTO_USER_API_AEAD is not set +CONFIG_CRYPTO_USER_API_AEAD=y +CONFIG_CRYPTO_USER_API_ENABLE_OBSOLETE=y # end of Userspace interface # @@ -7103,7 +7220,7 @@ CONFIG_CRYPTO_DEV_SP_PSP=y # CONFIG_CRYPTO_DEV_QAT_C3XXXVF is not set # CONFIG_CRYPTO_DEV_QAT_C62XVF is not set # CONFIG_CRYPTO_DEV_CHELSIO is not set -CONFIG_CRYPTO_DEV_VIRTIO=m +CONFIG_CRYPTO_DEV_VIRTIO=y # CONFIG_CRYPTO_DEV_SAFEXCEL is not set # CONFIG_CRYPTO_DEV_AMLOGIC_GXL is not set CONFIG_ASYMMETRIC_KEY_TYPE=y @@ -7118,11 +7235,11 @@ CONFIG_SIGNED_PE_FILE_VERIFICATION=y # # Certificates for signature checking # -CONFIG_MODULE_SIG_KEY="certs/signing_key.pem" +CONFIG_MODULE_SIG_KEY="certs/blockcast_signing_key.pem" CONFIG_MODULE_SIG_KEY_TYPE_RSA=y # CONFIG_MODULE_SIG_KEY_TYPE_ECDSA is not set CONFIG_SYSTEM_TRUSTED_KEYRING=y -CONFIG_SYSTEM_TRUSTED_KEYS="certs/blockcast-modsign.crt" +CONFIG_SYSTEM_TRUSTED_KEYS="" # CONFIG_SYSTEM_EXTRA_CERTIFICATE is not set # CONFIG_SECONDARY_TRUSTED_KEYRING is not set CONFIG_SYSTEM_BLACKLIST_KEYRING=y @@ -7397,7 +7514,7 @@ CONFIG_SLUB_DEBUG=y # CONFIG_SLUB_DEBUG_ON is not set # CONFIG_PAGE_OWNER is not set CONFIG_PAGE_TABLE_CHECK=y -CONFIG_PAGE_TABLE_CHECK_ENFORCED=y +# CONFIG_PAGE_TABLE_CHECK_ENFORCED is not set CONFIG_PAGE_POISONING=y # CONFIG_DEBUG_PAGE_REF is not set # CONFIG_DEBUG_RODATA_TEST is not set @@ -7573,7 +7690,7 @@ CONFIG_FTRACE_SYSCALLS=y # CONFIG_TRACER_SNAPSHOT is not set CONFIG_BRANCH_PROFILE_NONE=y # CONFIG_PROFILE_ANNOTATED_BRANCHES is not set -# CONFIG_BLK_DEV_IO_TRACE is not set +CONFIG_BLK_DEV_IO_TRACE=y CONFIG_PROBE_EVENTS_BTF_ARGS=y CONFIG_KPROBE_EVENTS=y # CONFIG_KPROBE_EVENTS_ON_NOTRACE is not set diff --git a/kernel/build/scripts/filter-hardened-check.py b/kernel/build/scripts/filter-hardened-check.py index 4629c6d60..63a486215 100644 --- a/kernel/build/scripts/filter-hardened-check.py +++ b/kernel/build/scripts/filter-hardened-check.py @@ -37,6 +37,8 @@ 'CONFIG_GCC_PLUGIN_LATENT_ENTROPY', # doesn't seem very relevant, entropy is low quality, and not available in Clang, https://github.com/torvalds/linux/blob/37a93dd5c49b5fda807fd204edf2547c3493319c/scripts/gcc-plugins/Kconfig#L25-L33 'CONFIG_MODULE_SIG_FORCE', # see https://github.com/siderolabs/talos/issues/11989 'CONFIG_IOMMU_DEFAULT_DMA_LAZY', # performance impact, we can reconsider later + 'CONFIG_STATIC_USERMODEHELPER', # not set in deployed Sidero v1.13.4 stock kernel (config rebased on /proc/config.gz for boot parity); enabling is unproven on these Talos VMs + 'CONFIG_PAGE_TABLE_CHECK_ENFORCED', # ditto — deployed stock kernel runs without it (PAGE_TABLE_CHECK=y is kept); enforced mode unproven here } """ From 287cef517cd2897b75d8d6f6535a5eaba30570c3 Mon Sep 17 00:00:00 2001 From: Search Date: Mon, 29 Jun 2026 19:10:52 +0000 Subject: [PATCH 3/6] fix(kernel): narrow Blockcast module trust config Restore unrelated kernel version, generated amd64 config drift, and hardened-check ignore changes from main. Keep only the public Blockcast module-signing certificate in SYSTEM_TRUSTED_KEYS for amd64 and arm64. Co-Authored-By: Paperclip --- Pkgfile | 6 +- kernel/build/config-amd64 | 357 ++++++------------ kernel/build/scripts/filter-hardened-check.py | 2 - 3 files changed, 123 insertions(+), 242 deletions(-) diff --git a/Pkgfile b/Pkgfile index 005db0334..834e351d6 100644 --- a/Pkgfile +++ b/Pkgfile @@ -103,9 +103,9 @@ vars: kspp_sha512: 1befd930ca0e43acb049f3ffac584e9a13c0ef716abba0670eb976e1b6bcee3f833b2b16cb02ac193c33c3fbbeb6ff221394f4265f5b0d4b8e65488a530b0d0a # renovate: datasource=git-tags extractVersion=^v(?.*)$ depName=git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git - linux_version: 6.18.34 - linux_sha256: 640c4732fb42842166db97e032c1fe7e5ff72c85a8982c75b40f74be3555d760 - linux_sha512: 0693f39aaf414cc4c5e1928b4373e24b25797fd3578a22f25d1be2ab5a318dfb42d374dc70c388e9929e8b9795bc397b9d7a281817c6509057ae54047a961582 + linux_version: 6.18.35 + linux_sha256: f78602932219125e211c5f5bfd84edcfd4ec5ce88fc944f8248413f665bef236 + linux_sha512: 8888a1f908473ea91e943a9c61cff956939709b0ded2d2e5cc26f377d1799ce5ba4d247c522508d13c3769ad90f804a8ef423fa782c10ae8e7ce9e7504bd8871 # renovate: datasource=git-tags extractVersion=^libaio-(?.*)$ depName=https://pagure.io/libaio.git libaio_version: 0.3.113 diff --git a/kernel/build/config-amd64 b/kernel/build/config-amd64 index a9010bb23..6f8969558 100644 --- a/kernel/build/config-amd64 +++ b/kernel/build/config-amd64 @@ -1,6 +1,6 @@ # # Automatically generated file; DO NOT EDIT. -# Linux/x86 6.18.34 Kernel Configuration +# Linux/x86 6.18.35 Kernel Configuration # CONFIG_CC_VERSION_TEXT="clang version 22.1.7" CONFIG_GCC_VERSION=0 @@ -606,11 +606,12 @@ CONFIG_ACPI_SLEEP=y CONFIG_ACPI_REV_OVERRIDE_POSSIBLE=y CONFIG_ACPI_EC=y # CONFIG_ACPI_EC_DEBUGFS is not set -CONFIG_ACPI_AC=y -CONFIG_ACPI_BATTERY=y -CONFIG_ACPI_BUTTON=y -CONFIG_ACPI_VIDEO=y -CONFIG_ACPI_FAN=y +CONFIG_ACPI_AC=m +CONFIG_ACPI_BATTERY=m +CONFIG_ACPI_BUTTON=m +# CONFIG_ACPI_TINY_POWER_BUTTON is not set +CONFIG_ACPI_VIDEO=m +CONFIG_ACPI_FAN=m # CONFIG_ACPI_TAD is not set CONFIG_ACPI_DOCK=y CONFIG_ACPI_CPU_FREQ_PSS=y @@ -621,7 +622,7 @@ CONFIG_ACPI_PROCESSOR=y CONFIG_ACPI_IPMI=y CONFIG_ACPI_HOTPLUG_CPU=y # CONFIG_ACPI_PROCESSOR_AGGREGATOR is not set -CONFIG_ACPI_THERMAL=y +CONFIG_ACPI_THERMAL=m CONFIG_ARCH_HAS_ACPI_TABLE_UPGRADE=y CONFIG_ACPI_TABLE_UPGRADE=y # CONFIG_ACPI_DEBUG is not set @@ -1020,7 +1021,7 @@ CONFIG_MODULE_SIG_SHA512=y CONFIG_MODULE_SIG_HASH="sha512" # CONFIG_MODULE_COMPRESS is not set # CONFIG_MODULE_ALLOW_MISSING_NAMESPACE_IMPORTS is not set -CONFIG_MODPROBE_PATH="/sbin/modprobe" +CONFIG_MODPROBE_PATH="" # CONFIG_TRIM_UNUSED_KSYMS is not set CONFIG_MODULES_TREE_LOOKUP=y CONFIG_BLOCK=y @@ -1468,7 +1469,6 @@ CONFIG_NF_NAT_TFTP=y CONFIG_NF_NAT_REDIRECT=y CONFIG_NF_NAT_MASQUERADE=y CONFIG_NF_NAT_OVS=y -CONFIG_NETFILTER_SYNPROXY=y CONFIG_NF_TABLES=y CONFIG_NF_TABLES_INET=y CONFIG_NF_TABLES_NETDEV=y @@ -1502,7 +1502,7 @@ CONFIG_NFT_FWD_NETDEV=y # CONFIG_NFT_REJECT_NETDEV is not set # CONFIG_NF_FLOW_TABLE is not set CONFIG_NETFILTER_XTABLES=y -CONFIG_NETFILTER_XTABLES_COMPAT=y +# CONFIG_NETFILTER_XTABLES_COMPAT is not set # CONFIG_NETFILTER_XTABLES_LEGACY is not set # @@ -1676,14 +1676,7 @@ CONFIG_NF_LOG_IPV4=y CONFIG_NF_REJECT_IPV4=y CONFIG_NF_NAT_SNMP_BASIC=y CONFIG_NF_NAT_PPTP=y -CONFIG_IP_NF_IPTABLES=y -# CONFIG_IP_NF_MATCH_AH is not set -# CONFIG_IP_NF_MATCH_ECN is not set -CONFIG_IP_NF_MATCH_RPFILTER=y -# CONFIG_IP_NF_MATCH_TTL is not set -CONFIG_IP_NF_TARGET_REJECT=y -# CONFIG_IP_NF_TARGET_SYNPROXY is not set -# CONFIG_IP_NF_TARGET_ECN is not set +# CONFIG_IP_NF_IPTABLES is not set # end of IP: Netfilter Configuration # @@ -1698,20 +1691,7 @@ CONFIG_NFT_FIB_IPV6=y CONFIG_NF_DUP_IPV6=y CONFIG_NF_REJECT_IPV6=y CONFIG_NF_LOG_IPV6=y -CONFIG_IP6_NF_IPTABLES=y -CONFIG_IP6_NF_MATCH_AH=y -CONFIG_IP6_NF_MATCH_EUI64=y -CONFIG_IP6_NF_MATCH_FRAG=y -CONFIG_IP6_NF_MATCH_OPTS=y -CONFIG_IP6_NF_MATCH_HL=y -CONFIG_IP6_NF_MATCH_IPV6HEADER=y -CONFIG_IP6_NF_MATCH_MH=y -CONFIG_IP6_NF_MATCH_RPFILTER=y -CONFIG_IP6_NF_MATCH_RT=y -# CONFIG_IP6_NF_MATCH_SRH is not set -CONFIG_IP6_NF_TARGET_REJECT=y -CONFIG_IP6_NF_TARGET_SYNPROXY=y -# CONFIG_IP6_NF_TARGET_NPT is not set +# CONFIG_IP6_NF_IPTABLES is not set # end of IPv6: Netfilter Configuration CONFIG_NF_DEFRAG_IPV6=y @@ -1719,38 +1699,15 @@ CONFIG_NF_TABLES_BRIDGE=y # CONFIG_NFT_BRIDGE_META is not set # CONFIG_NFT_BRIDGE_REJECT is not set # CONFIG_NF_CONNTRACK_BRIDGE is not set -CONFIG_BRIDGE_NF_EBTABLES=y -CONFIG_BRIDGE_EBT_802_3=y -CONFIG_BRIDGE_EBT_AMONG=y -CONFIG_BRIDGE_EBT_ARP=y -CONFIG_BRIDGE_EBT_IP=y -CONFIG_BRIDGE_EBT_IP6=y -CONFIG_BRIDGE_EBT_LIMIT=y -CONFIG_BRIDGE_EBT_MARK=y -CONFIG_BRIDGE_EBT_PKTTYPE=y -CONFIG_BRIDGE_EBT_STP=y -CONFIG_BRIDGE_EBT_VLAN=y -CONFIG_BRIDGE_EBT_ARPREPLY=y -CONFIG_BRIDGE_EBT_DNAT=y -CONFIG_BRIDGE_EBT_MARK_T=y -CONFIG_BRIDGE_EBT_REDIRECT=y -CONFIG_BRIDGE_EBT_SNAT=y -CONFIG_BRIDGE_EBT_LOG=y -CONFIG_BRIDGE_EBT_NFLOG=y +# CONFIG_BRIDGE_NF_EBTABLES is not set CONFIG_IP_SCTP=y # CONFIG_SCTP_DBG_OBJCNT is not set CONFIG_SCTP_DEFAULT_COOKIE_HMAC_SHA256=y # CONFIG_SCTP_DEFAULT_COOKIE_HMAC_NONE is not set CONFIG_INET_SCTP_DIAG=y -CONFIG_RDS=y -# CONFIG_RDS_RDMA is not set -# CONFIG_RDS_TCP is not set -# CONFIG_RDS_DEBUG is not set +# CONFIG_RDS is not set # CONFIG_TIPC is not set -CONFIG_ATM=y -# CONFIG_ATM_CLIP is not set -# CONFIG_ATM_LANE is not set -# CONFIG_ATM_BR2684 is not set +# CONFIG_ATM is not set CONFIG_L2TP=y # CONFIG_L2TP_DEBUGFS is not set # CONFIG_L2TP_V3 is not set @@ -1788,11 +1745,11 @@ CONFIG_VLAN_8021Q=y # CONFIG_VLAN_8021Q_GVRP is not set # CONFIG_VLAN_8021Q_MVRP is not set CONFIG_LLC=y -CONFIG_LLC2=y +# CONFIG_LLC2 is not set # CONFIG_ATALK is not set -CONFIG_X25=y -CONFIG_LAPB=y -CONFIG_PHONET=y +# CONFIG_X25 is not set +# CONFIG_LAPB is not set +# CONFIG_PHONET is not set # CONFIG_6LOWPAN is not set # CONFIG_IEEE802154 is not set CONFIG_NET_SCHED=y @@ -1899,10 +1856,10 @@ CONFIG_OPENVSWITCH_GENEVE=y CONFIG_VSOCKETS=y CONFIG_VSOCKETS_DIAG=y CONFIG_VSOCKETS_LOOPBACK=y -CONFIG_VMWARE_VMCI_VSOCKETS=y -CONFIG_VIRTIO_VSOCKETS=y +CONFIG_VMWARE_VMCI_VSOCKETS=m +CONFIG_VIRTIO_VSOCKETS=m CONFIG_VIRTIO_VSOCKETS_COMMON=y -CONFIG_HYPERV_VSOCKETS=y +CONFIG_HYPERV_VSOCKETS=m CONFIG_NETLINK_DIAG=y CONFIG_MPLS=y CONFIG_NET_MPLS_GSO=y @@ -1999,7 +1956,7 @@ CONFIG_PCI_QUIRKS=y CONFIG_PCI_REALLOC_ENABLE_AUTO=y # CONFIG_PCI_STUB is not set # CONFIG_PCI_PF_STUB is not set -CONFIG_XEN_PCIDEV_FRONTEND=y +CONFIG_XEN_PCIDEV_FRONTEND=m CONFIG_PCI_ATS=y # CONFIG_PCI_DOE is not set CONFIG_PCI_ECAM=y @@ -2011,7 +1968,7 @@ CONFIG_PCI_PASID=y # CONFIG_PCIE_TPH is not set CONFIG_PCI_P2PDMA=y CONFIG_PCI_LABEL=y -CONFIG_PCI_HYPERV=y +CONFIG_PCI_HYPERV=m # CONFIG_PCIE_BUS_TUNE_OFF is not set CONFIG_PCIE_BUS_DEFAULT=y # CONFIG_PCIE_BUS_SAFE is not set @@ -2030,7 +1987,7 @@ CONFIG_HOTPLUG_PCI_ACPI=y # PCI controller drivers # CONFIG_PCI_HOST_COMMON=y -CONFIG_VMD=y +CONFIG_VMD=m CONFIG_PCI_HYPERV_INTERFACE=y # @@ -2088,8 +2045,7 @@ CONFIG_PCI_EPF_NTB=y # Generic Driver Options # CONFIG_AUXILIARY_BUS=y -CONFIG_UEVENT_HELPER=y -CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug" +# CONFIG_UEVENT_HELPER is not set CONFIG_DEVTMPFS=y # CONFIG_DEVTMPFS_MOUNT is not set # CONFIG_DEVTMPFS_SAFE is not set @@ -2162,7 +2118,7 @@ CONFIG_ISCSI_IBFT_FIND=y CONFIG_ISCSI_IBFT=y # CONFIG_FW_CFG_SYSFS is not set CONFIG_SYSFB=y -# CONFIG_SYSFB_SIMPLEFB is not set +CONFIG_SYSFB_SIMPLEFB=y # CONFIG_GOOGLE_FIRMWARE is not set # @@ -2222,27 +2178,15 @@ CONFIG_BLK_DEV=y # CONFIG_BLK_DEV_FD is not set CONFIG_CDROM=y # CONFIG_BLK_DEV_PCIESSD_MTIP32XX is not set -CONFIG_ZRAM=y -# CONFIG_ZRAM_BACKEND_LZ4 is not set -# CONFIG_ZRAM_BACKEND_LZ4HC is not set -CONFIG_ZRAM_BACKEND_ZSTD=y -# CONFIG_ZRAM_BACKEND_DEFLATE is not set -# CONFIG_ZRAM_BACKEND_842 is not set -# CONFIG_ZRAM_BACKEND_LZO is not set -CONFIG_ZRAM_DEF_COMP_ZSTD=y -CONFIG_ZRAM_DEF_COMP="zstd" -# CONFIG_ZRAM_WRITEBACK is not set -# CONFIG_ZRAM_TRACK_ENTRY_ACTIME is not set -# CONFIG_ZRAM_MEMORY_TRACKING is not set -# CONFIG_ZRAM_MULTI_COMP is not set +# CONFIG_ZRAM is not set CONFIG_BLK_DEV_LOOP=y CONFIG_BLK_DEV_LOOP_MIN_COUNT=8 # CONFIG_BLK_DEV_DRBD is not set CONFIG_BLK_DEV_NBD=m # CONFIG_BLK_DEV_RAM is not set # CONFIG_ATA_OVER_ETH is not set -CONFIG_XEN_BLKDEV_FRONTEND=y -CONFIG_VIRTIO_BLK=y +CONFIG_XEN_BLKDEV_FRONTEND=m +CONFIG_VIRTIO_BLK=m CONFIG_BLK_DEV_RBD=y CONFIG_BLK_DEV_UBLK=m # CONFIG_BLKDEV_UBLK_LEGACY_OPCODES is not set @@ -2296,7 +2240,7 @@ CONFIG_HP_ILO=m # CONFIG_SENSORS_APDS990X is not set # CONFIG_HMC6352 is not set # CONFIG_DS1682 is not set -CONFIG_VMWARE_BALLOON=y +CONFIG_VMWARE_BALLOON=m # CONFIG_SRAM is not set # CONFIG_DW_XDATA_PCIE is not set # CONFIG_PCI_ENDPOINT_TEST is not set @@ -2327,7 +2271,7 @@ CONFIG_INTEL_MEI_GSC=m CONFIG_INTEL_MEI_HDCP=m CONFIG_INTEL_MEI_PXP=m CONFIG_INTEL_MEI_GSC_PROXY=m -CONFIG_VMWARE_VMCI=y +CONFIG_VMWARE_VMCI=m # CONFIG_GENWQE is not set # CONFIG_BCM_VK is not set # CONFIG_MISC_ALCOR_PCI is not set @@ -2413,8 +2357,8 @@ CONFIG_SCSI_SMARTPQI=m # CONFIG_SCSI_MYRB is not set # CONFIG_SCSI_MYRS is not set CONFIG_VMWARE_PVSCSI=m -CONFIG_XEN_SCSI_FRONTEND=y -CONFIG_HYPERV_STORAGE=y +CONFIG_XEN_SCSI_FRONTEND=m +CONFIG_HYPERV_STORAGE=m CONFIG_LIBFC=m CONFIG_LIBFCOE=m # CONFIG_FCOE is not set @@ -2443,7 +2387,7 @@ CONFIG_SCSI_LPFC=m # CONFIG_SCSI_PMCRAID is not set # CONFIG_SCSI_PM8001 is not set # CONFIG_SCSI_BFA_FC is not set -CONFIG_SCSI_VIRTIO=y +CONFIG_SCSI_VIRTIO=m # CONFIG_SCSI_CHELSIO_FCOE is not set # CONFIG_SCSI_DH is not set # end of SCSI device support @@ -2480,7 +2424,7 @@ CONFIG_ATA_BMDMA=y # # SATA SFF controllers with BMDMA # -CONFIG_ATA_PIIX=y +CONFIG_ATA_PIIX=m # CONFIG_SATA_DWC is not set # CONFIG_SATA_MV is not set # CONFIG_SATA_NV is not set @@ -2645,23 +2589,12 @@ CONFIG_TUN=y CONFIG_TAP=y # CONFIG_TUN_VNET_CROSS_LE is not set CONFIG_VETH=y -CONFIG_VIRTIO_NET=y +CONFIG_VIRTIO_NET=m # CONFIG_NLMON is not set CONFIG_NETKIT=y CONFIG_NET_VRF=m # CONFIG_VSOCKMON is not set # CONFIG_ARCNET is not set -CONFIG_ATM_DRIVERS=y -# CONFIG_ATM_DUMMY is not set -# CONFIG_ATM_TCP is not set -# CONFIG_ATM_LANAI is not set -# CONFIG_ATM_ENI is not set -# CONFIG_ATM_NICSTAR is not set -# CONFIG_ATM_IDT77252 is not set -# CONFIG_ATM_IA is not set -# CONFIG_ATM_FORE200E is not set -# CONFIG_ATM_HE is not set -# CONFIG_ATM_SOLOS is not set # # Distributed Switch Architecture drivers @@ -2986,9 +2919,7 @@ CONFIG_NET_VENDOR_WIZNET=y CONFIG_NET_VENDOR_XILINX=y # CONFIG_XILINX_EMACLITE is not set # CONFIG_XILINX_LL_TEMAC is not set -CONFIG_FDDI=y -# CONFIG_DEFXX is not set -# CONFIG_SKFP is not set +# CONFIG_FDDI is not set # CONFIG_HIPPI is not set CONFIG_MDIO_BUS=y CONFIG_PHYLINK=y @@ -3083,7 +3014,6 @@ CONFIG_PPP=y # CONFIG_PPP_FILTER is not set # CONFIG_PPP_MPPE is not set # CONFIG_PPP_MULTILINK is not set -# CONFIG_PPPOATM is not set # CONFIG_PPPOE is not set CONFIG_PPPOE_HASH_BITS=4 # CONFIG_PPTP is not set @@ -3130,7 +3060,6 @@ CONFIG_USB_NET_CX82310_ETH=m CONFIG_USB_NET_KALMIA=m CONFIG_USB_NET_QMI_WWAN=m CONFIG_USB_NET_INT51X1=m -CONFIG_USB_CDC_PHONET=m CONFIG_USB_IPHETH=m CONFIG_USB_SIERRA_NET=m CONFIG_USB_VL600=m @@ -3146,11 +3075,11 @@ CONFIG_USB_RTL8153_ECM=m # CONFIG_WWAN is not set # end of Wireless WAN -CONFIG_XEN_NETDEV_FRONTEND=y +CONFIG_XEN_NETDEV_FRONTEND=m CONFIG_VMXNET3=m # CONFIG_FUJITSU_ES is not set CONFIG_USB4_NET=m -CONFIG_HYPERV_NET=y +CONFIG_HYPERV_NET=m # CONFIG_NETDEVSIM is not set CONFIG_NET_FAILOVER=y # CONFIG_ISDN is not set @@ -3204,7 +3133,7 @@ CONFIG_KEYBOARD_ATKBD=y # CONFIG_KEYBOARD_XTKBD is not set # CONFIG_KEYBOARD_CYPRESS_SF is not set CONFIG_INPUT_MOUSE=y -CONFIG_MOUSE_PS2=y +CONFIG_MOUSE_PS2=m CONFIG_MOUSE_PS2_ALPS=y CONFIG_MOUSE_PS2_BYD=y CONFIG_MOUSE_PS2_LOGIPS2PP=y @@ -3361,7 +3290,7 @@ CONFIG_INPUT_UINPUT=m # CONFIG_INPUT_IQS626A is not set # CONFIG_INPUT_IQS7222 is not set # CONFIG_INPUT_CMA3000 is not set -CONFIG_INPUT_XEN_KBDDEV_FRONTEND=y +CONFIG_INPUT_XEN_KBDDEV_FRONTEND=m # CONFIG_INPUT_IDEAPAD_SLIDEBAR is not set # CONFIG_INPUT_DRV260X_HAPTICS is not set # CONFIG_INPUT_DRV2665_HAPTICS is not set @@ -3382,7 +3311,7 @@ CONFIG_SERIO_LIBPS2=y # CONFIG_SERIO_ALTERA_PS2 is not set # CONFIG_SERIO_PS2MULT is not set # CONFIG_SERIO_ARC_PS2 is not set -CONFIG_HYPERV_KEYBOARD=y +CONFIG_HYPERV_KEYBOARD=m # CONFIG_SERIO_GPIO_PS2 is not set # CONFIG_USERIO is not set # CONFIG_GAMEPORT is not set @@ -3467,13 +3396,13 @@ CONFIG_HVC_XEN_FRONTEND=y # CONFIG_RPMSG_TTY is not set # CONFIG_SERIAL_DEV_BUS is not set # CONFIG_TTY_PRINTK is not set -CONFIG_VIRTIO_CONSOLE=y +CONFIG_VIRTIO_CONSOLE=m CONFIG_IPMI_HANDLER=y CONFIG_IPMI_DMI_DECODE=y CONFIG_IPMI_PLAT_DATA=y # CONFIG_IPMI_PANIC_EVENT is not set CONFIG_IPMI_DEVICE_INTERFACE=y -CONFIG_IPMI_SI=y +CONFIG_IPMI_SI=m # CONFIG_IPMI_SSIF is not set CONFIG_IPMI_WATCHDOG=m CONFIG_IPMI_POWEROFF=y @@ -3489,7 +3418,7 @@ CONFIG_HW_RANDOM_XIPHERA=m # CONFIG_MWAVE is not set # CONFIG_DEVMEM is not set CONFIG_NVRAM=y -CONFIG_DEVPORT=y +# CONFIG_DEVPORT is not set CONFIG_HPET=y # CONFIG_HPET_MMAP is not set # CONFIG_HANGCHECK_TIMER is not set @@ -3827,7 +3756,7 @@ CONFIG_POWER_SUPPLY_HWMON=y # CONFIG_BATTERY_UG3105 is not set # CONFIG_FUEL_GAUGE_MM8013 is not set CONFIG_HWMON=y -CONFIG_HWMON_VID=y +CONFIG_HWMON_VID=m # CONFIG_HWMON_DEBUG_CHIP is not set # @@ -3863,7 +3792,7 @@ CONFIG_SENSORS_FAM15H_POWER=m # CONFIG_SENSORS_CHIPCAP2 is not set # CONFIG_SENSORS_CORSAIR_CPRO is not set # CONFIG_SENSORS_CORSAIR_PSU is not set -CONFIG_SENSORS_DRIVETEMP=y +CONFIG_SENSORS_DRIVETEMP=m # CONFIG_SENSORS_DS620 is not set # CONFIG_SENSORS_DS1621 is not set # CONFIG_SENSORS_DELL_SMM is not set @@ -3885,7 +3814,7 @@ CONFIG_SENSORS_I5K_AMB=m # CONFIG_SENSORS_IBMAEM is not set # CONFIG_SENSORS_IBMPEX is not set CONFIG_SENSORS_I5500=m -CONFIG_SENSORS_CORETEMP=y +CONFIG_SENSORS_CORETEMP=m # CONFIG_SENSORS_ISL28022 is not set CONFIG_SENSORS_IT87=m # CONFIG_SENSORS_JC42 is not set @@ -3941,9 +3870,9 @@ CONFIG_SENSORS_IT87=m # CONFIG_SENSORS_LM95245 is not set # CONFIG_SENSORS_PC87360 is not set # CONFIG_SENSORS_PC87427 is not set -CONFIG_SENSORS_NCT6683=y +CONFIG_SENSORS_NCT6683=m CONFIG_SENSORS_NCT6775_CORE=y -CONFIG_SENSORS_NCT6775=y +CONFIG_SENSORS_NCT6775=m CONFIG_SENSORS_NCT6775_I2C=y # CONFIG_SENSORS_NCT7363 is not set # CONFIG_SENSORS_NCT7802 is not set @@ -4011,7 +3940,7 @@ CONFIG_SENSORS_NCT6775_I2C=y # # ACPI drivers # -CONFIG_SENSORS_ACPI_POWER=y +CONFIG_SENSORS_ACPI_POWER=m # CONFIG_SENSORS_ATK0110 is not set # CONFIG_SENSORS_ASUS_WMI is not set # CONFIG_SENSORS_ASUS_EC is not set @@ -4395,7 +4324,20 @@ CONFIG_USB_VIDEO_CLASS_INPUT_EVDEV=y # # CONFIG_DVB_AS102 is not set # CONFIG_DVB_B2C2_FLEXCOP_USB is not set -# CONFIG_DVB_USB_V2 is not set +CONFIG_DVB_USB_V2=m +# CONFIG_DVB_USB_AF9015 is not set +# CONFIG_DVB_USB_AF9035 is not set +# CONFIG_DVB_USB_ANYSEE is not set +# CONFIG_DVB_USB_AU6610 is not set +# CONFIG_DVB_USB_AZ6007 is not set +# CONFIG_DVB_USB_CE6230 is not set +CONFIG_DVB_USB_DVBSKY=m +# CONFIG_DVB_USB_EC168 is not set +# CONFIG_DVB_USB_GL861 is not set +# CONFIG_DVB_USB_LME2510 is not set +# CONFIG_DVB_USB_MXL111SF is not set +# CONFIG_DVB_USB_RTL28XXU is not set +# CONFIG_DVB_USB_ZD1301 is not set # CONFIG_DVB_USB is not set # CONFIG_SMS_USB_DRV is not set # CONFIG_DVB_TTUSB_BUDGET is not set @@ -4789,7 +4731,7 @@ CONFIG_MEDIA_TUNER_XC5000=m # # Multistandard (satellite) frontends # -# CONFIG_DVB_M88DS3103 is not set +CONFIG_DVB_M88DS3103=m CONFIG_DVB_MXL5XX=m CONFIG_DVB_STB0899=m CONFIG_DVB_STB6100=m @@ -4957,13 +4899,8 @@ CONFIG_APERTURE_HELPERS=y CONFIG_SCREEN_INFO=y CONFIG_VIDEO=y # CONFIG_AUXDISPLAY is not set -CONFIG_AGP=y -CONFIG_AGP_AMD64=y -CONFIG_AGP_INTEL=y -# CONFIG_AGP_SIS is not set -# CONFIG_AGP_VIA is not set -CONFIG_INTEL_GTT=y -# CONFIG_VGA_SWITCHEROO is not set +# CONFIG_AGP is not set +CONFIG_INTEL_GTT=m CONFIG_DRM=y # @@ -5017,9 +4954,8 @@ CONFIG_DRM_SCHED=m # # Drivers for system framebuffers # -# CONFIG_DRM_EFIDRM is not set -# CONFIG_DRM_SIMPLEDRM is not set -# CONFIG_DRM_VESADRM is not set +CONFIG_DRM_SYSFB_HELPER=y +CONFIG_DRM_SIMPLEDRM=y # end of Drivers for system framebuffers # @@ -5134,7 +5070,7 @@ CONFIG_DRM_XE_ENABLE_SCHEDTIMEOUT_LIMIT=y # CONFIG_DRM_AST is not set # CONFIG_DRM_MGAG200 is not set # CONFIG_DRM_QXL is not set -CONFIG_DRM_VIRTIO_GPU=y +CONFIG_DRM_VIRTIO_GPU=m CONFIG_DRM_VIRTIO_GPU_KMS=y CONFIG_DRM_PANEL=y @@ -5172,71 +5108,21 @@ CONFIG_DRM_PANEL_ORIENTATION_QUIRKS=y # # Frame buffer Devices # -CONFIG_FB=y -# CONFIG_FB_CIRRUS is not set -# CONFIG_FB_PM2 is not set -# CONFIG_FB_CYBER2000 is not set -# CONFIG_FB_ARC is not set -# CONFIG_FB_ASILIANT is not set -# CONFIG_FB_IMSTT is not set -CONFIG_FB_VGA16=y -# CONFIG_FB_UVESA is not set -CONFIG_FB_VESA=y -CONFIG_FB_EFI=y -# CONFIG_FB_N411 is not set -# CONFIG_FB_HGA is not set -# CONFIG_FB_OPENCORES is not set -# CONFIG_FB_S1D13XXX is not set -# CONFIG_FB_NVIDIA is not set -# CONFIG_FB_RIVA is not set -# CONFIG_FB_I740 is not set -# CONFIG_FB_MATROX is not set -# CONFIG_FB_RADEON is not set -# CONFIG_FB_ATY128 is not set -# CONFIG_FB_ATY is not set -# CONFIG_FB_S3 is not set -# CONFIG_FB_SAVAGE is not set -# CONFIG_FB_SIS is not set -# CONFIG_FB_VIA is not set -# CONFIG_FB_NEOMAGIC is not set -# CONFIG_FB_KYRO is not set -# CONFIG_FB_3DFX is not set -# CONFIG_FB_VOODOO1 is not set -# CONFIG_FB_VT8623 is not set -# CONFIG_FB_TRIDENT is not set -# CONFIG_FB_ARK is not set -# CONFIG_FB_PM3 is not set -# CONFIG_FB_CARMINE is not set -# CONFIG_FB_SMSCUFX is not set -# CONFIG_FB_UDL is not set -# CONFIG_FB_IBM_GXT4500 is not set -# CONFIG_FB_VIRTUAL is not set -CONFIG_XEN_FBDEV_FRONTEND=y -# CONFIG_FB_METRONOME is not set -# CONFIG_FB_MB862XX is not set -CONFIG_FB_HYPERV=y -# CONFIG_FB_SIMPLE is not set -# CONFIG_FB_SSD1307 is not set -# CONFIG_FB_SM712 is not set +# CONFIG_FB is not set CONFIG_FB_CORE=y -CONFIG_FB_NOTIFY=y -CONFIG_FB_DEVICE=y +# CONFIG_FB_DEVICE is not set CONFIG_FB_CFB_FILLRECT=y CONFIG_FB_CFB_COPYAREA=y CONFIG_FB_CFB_IMAGEBLIT=y CONFIG_FB_SYS_FILLRECT=y CONFIG_FB_SYS_COPYAREA=y CONFIG_FB_SYS_IMAGEBLIT=y -# CONFIG_FB_FOREIGN_ENDIAN is not set CONFIG_FB_SYSMEM_FOPS=y CONFIG_FB_DEFERRED_IO=y CONFIG_FB_IOMEM_FOPS=y CONFIG_FB_IOMEM_HELPERS=y -CONFIG_FB_IOMEM_HELPERS_DEFERRED=y CONFIG_FB_SYSMEM_HELPERS=y CONFIG_FB_SYSMEM_HELPERS_DEFERRED=y -CONFIG_FB_MODE_HELPERS=y -CONFIG_FB_TILEBLITTING=y # end of Frame buffer Devices # @@ -5264,7 +5150,6 @@ CONFIG_BACKLIGHT_CLASS_DEVICE=y # CONFIG_BACKLIGHT_ARCXCNN is not set # end of Backlight & LCD device support -CONFIG_VGASTATE=y CONFIG_HDMI=y # CONFIG_FIRMWARE_EDID is not set @@ -5279,7 +5164,6 @@ CONFIG_FRAMEBUFFER_CONSOLE=y # CONFIG_FRAMEBUFFER_CONSOLE_LEGACY_ACCELERATION is not set CONFIG_FRAMEBUFFER_CONSOLE_DETECT_PRIMARY=y # CONFIG_FRAMEBUFFER_CONSOLE_ROTATION is not set -# CONFIG_FRAMEBUFFER_CONSOLE_DEFERRED_TAKEOVER is not set # end of Console display driver support CONFIG_LOGO=y @@ -5493,7 +5377,7 @@ CONFIG_LOGIWHEELS_FF=y # CONFIG_HID_MALTRON is not set # CONFIG_HID_MAYFLASH is not set # CONFIG_HID_MEGAWORLD_FF is not set -CONFIG_HID_REDRAGON=y +CONFIG_HID_REDRAGON=m CONFIG_HID_MICROSOFT=m CONFIG_HID_MONTEREY=m CONFIG_HID_MULTITOUCH=m @@ -5551,7 +5435,7 @@ CONFIG_HID_TOPSEED=m # CONFIG_HID_BPF is not set # end of HID-BPF support -CONFIG_I2C_HID=y +CONFIG_I2C_HID=m # CONFIG_I2C_HID_ACPI is not set # CONFIG_I2C_HID_OF is not set @@ -5576,9 +5460,16 @@ CONFIG_I2C_HID=y # # USB HID support # -CONFIG_USB_HID=y +CONFIG_USB_HID=m # CONFIG_HID_PID is not set CONFIG_USB_HIDDEV=y + +# +# USB HID Boot Protocol drivers +# +# CONFIG_USB_KBD is not set +# CONFIG_USB_MOUSE is not set +# end of USB HID Boot Protocol drivers # end of USB HID support CONFIG_USB_OHCI_LITTLE_ENDIAN=y @@ -5611,22 +5502,22 @@ CONFIG_USB_DEFAULT_AUTHORIZATION_MODE=1 # USB Host Controller Drivers # # CONFIG_USB_C67X00_HCD is not set -CONFIG_USB_XHCI_HCD=y +CONFIG_USB_XHCI_HCD=m # CONFIG_USB_XHCI_DBGCAP is not set -CONFIG_USB_XHCI_PCI=y +CONFIG_USB_XHCI_PCI=m # CONFIG_USB_XHCI_PCI_RENESAS is not set -CONFIG_USB_XHCI_PLATFORM=y +CONFIG_USB_XHCI_PLATFORM=m # CONFIG_USB_XHCI_SIDEBAND is not set -CONFIG_USB_EHCI_HCD=y +CONFIG_USB_EHCI_HCD=m # CONFIG_USB_EHCI_ROOT_HUB_TT is not set CONFIG_USB_EHCI_TT_NEWSCHED=y -CONFIG_USB_EHCI_PCI=y +CONFIG_USB_EHCI_PCI=m # CONFIG_USB_EHCI_FSL is not set # CONFIG_USB_EHCI_HCD_PLATFORM is not set # CONFIG_USB_OXU210HP_HCD is not set # CONFIG_USB_ISP116X_HCD is not set # CONFIG_USB_OHCI_HCD is not set -CONFIG_USB_UHCI_HCD=y +CONFIG_USB_UHCI_HCD=m # CONFIG_USB_SL811_HCD is not set # CONFIG_USB_R8A66597_HCD is not set # CONFIG_USB_HCD_TEST_MODE is not set @@ -5635,7 +5526,7 @@ CONFIG_USB_UHCI_HCD=y # # USB Device Class drivers # -CONFIG_USB_ACM=y +CONFIG_USB_ACM=m # CONFIG_USB_PRINTER is not set CONFIG_USB_WDM=m # CONFIG_USB_TMC is not set @@ -5643,7 +5534,7 @@ CONFIG_USB_WDM=m # # NOTE: USB_STORAGE depends on SCSI but BLK_DEV_SD may also be needed; see USB_STORAGE Help for more info # -CONFIG_USB_STORAGE=y +CONFIG_USB_STORAGE=m # CONFIG_USB_STORAGE_DEBUG is not set # CONFIG_USB_STORAGE_REALTEK is not set # CONFIG_USB_STORAGE_DATAFAB is not set @@ -5658,7 +5549,7 @@ CONFIG_USB_STORAGE=y # CONFIG_USB_STORAGE_KARMA is not set # CONFIG_USB_STORAGE_CYPRESS_ATACB is not set # CONFIG_USB_STORAGE_ENE_UB6250 is not set -CONFIG_USB_UAS=y +CONFIG_USB_UAS=m # # USB Imaging devices @@ -5766,7 +5657,6 @@ CONFIG_USB_SERIAL_OPTION=m # CONFIG_USB_HSIC_USB4604 is not set # CONFIG_USB_LINK_LAYER_TEST is not set # CONFIG_USB_CHAOSKEY is not set -# CONFIG_USB_ATM is not set # # USB Physical Layer drivers @@ -5789,7 +5679,7 @@ CONFIG_MMC_BLOCK_MINORS=32 # MMC/SD/SDIO Host Controller Drivers # # CONFIG_MMC_DEBUG is not set -CONFIG_MMC_SDHCI=y +CONFIG_MMC_SDHCI=m CONFIG_MMC_SDHCI_IO_ACCESSORS=y CONFIG_MMC_SDHCI_UHS2=m CONFIG_MMC_SDHCI_PCI=m @@ -5892,7 +5782,7 @@ CONFIG_LEDS_TRIGGERS=y # Simatic LED drivers # # CONFIG_ACCESSIBILITY is not set -CONFIG_INFINIBAND=y +CONFIG_INFINIBAND=m CONFIG_INFINIBAND_USER_MAD=m CONFIG_INFINIBAND_USER_ACCESS=m CONFIG_INFINIBAND_USER_MEM=y @@ -5915,7 +5805,7 @@ CONFIG_MLX5_INFINIBAND=m # CONFIG_INFINIBAND_RDMAVT is not set CONFIG_RDMA_RXE=m # CONFIG_RDMA_SIW is not set -CONFIG_INFINIBAND_IPOIB=y +CONFIG_INFINIBAND_IPOIB=m # CONFIG_INFINIBAND_IPOIB_CM is not set CONFIG_INFINIBAND_IPOIB_DEBUG=y # CONFIG_INFINIBAND_IPOIB_DEBUG_DATA is not set @@ -6055,7 +5945,7 @@ CONFIG_DMA_ACPI=y # CONFIG_INTEL_IDMA64 is not set # CONFIG_INTEL_IDXD is not set # CONFIG_INTEL_IDXD_COMPAT is not set -CONFIG_INTEL_IOATDMA=y +CONFIG_INTEL_IOATDMA=m # CONFIG_PLX_DMA is not set # CONFIG_XILINX_DMA is not set # CONFIG_XILINX_XDMA is not set @@ -6091,7 +5981,7 @@ CONFIG_DMABUF_MOVE_NOTIFY=y # CONFIG_DMABUF_SYSFS_STATS is not set # end of DMABUF options -CONFIG_DCA=y +CONFIG_DCA=m CONFIG_UIO=m # CONFIG_UIO_CIF is not set # CONFIG_UIO_PDRV_GENIRQ is not set @@ -6124,7 +6014,7 @@ CONFIG_VFIO_PCI_IGD=y CONFIG_IRQ_BYPASS_MANAGER=y CONFIG_VIRT_DRIVERS=y -CONFIG_VMGENID=y +CONFIG_VMGENID=m # CONFIG_VBOXGUEST is not set CONFIG_NITRO_ENCLAVES=y # CONFIG_EFI_SECRET is not set @@ -6144,7 +6034,7 @@ CONFIG_VIRTIO_BALLOON=m CONFIG_VIRTIO_MEM=m # CONFIG_VIRTIO_INPUT is not set # CONFIG_VIRTIO_MMIO is not set -CONFIG_VIRTIO_DMA_SHARED_BUFFER=y +CONFIG_VIRTIO_DMA_SHARED_BUFFER=m # CONFIG_VIRTIO_DEBUG is not set # CONFIG_VIRTIO_RTC is not set CONFIG_VDPA=m @@ -6177,8 +6067,8 @@ CONFIG_VHOST_ENABLE_FORK_OWNER_CONTROL=y CONFIG_HYPERV=y # CONFIG_HYPERV_VTL_MODE is not set CONFIG_HYPERV_TIMER=y -CONFIG_HYPERV_UTILS=y -CONFIG_HYPERV_BALLOON=y +CONFIG_HYPERV_UTILS=m +CONFIG_HYPERV_BALLOON=m CONFIG_HYPERV_VMBUS=y # CONFIG_MSHV_ROOT is not set # end of Microsoft Hyper-V guest support @@ -6223,9 +6113,9 @@ CONFIG_SURFACE_PLATFORMS=y # CONFIG_SURFACE_HOTPLUG is not set # CONFIG_SURFACE_PRO3_BUTTON is not set CONFIG_X86_PLATFORM_DEVICES=y -CONFIG_ACPI_WMI=y +CONFIG_ACPI_WMI=m # CONFIG_ACPI_WMI_LEGACY_DEVICE_NAMES is not set -CONFIG_WMI_BMOF=y +CONFIG_WMI_BMOF=m # CONFIG_HUAWEI_WMI is not set # CONFIG_MXM_WMI is not set # CONFIG_NVIDIA_WMI_EC_BACKLIGHT is not set @@ -6254,7 +6144,7 @@ CONFIG_WMI_BMOF=y # CONFIG_ASUS_WIRELESS is not set # CONFIG_ASUS_WMI is not set # CONFIG_ASUS_TF103C_DOCK is not set -CONFIG_EEEPC_LAPTOP=y +CONFIG_EEEPC_LAPTOP=m # CONFIG_X86_PLATFORM_DRIVERS_DELL is not set # CONFIG_FUJITSU_LAPTOP is not set # CONFIG_FUJITSU_TABLET is not set @@ -6646,7 +6536,7 @@ CONFIG_QUOTACTL=y CONFIG_AUTOFS_FS=y CONFIG_FUSE_FS=y # CONFIG_CUSE is not set -CONFIG_VIRTIO_FS=y +CONFIG_VIRTIO_FS=m CONFIG_FUSE_PASSTHROUGH=y CONFIG_FUSE_IO_URING=y CONFIG_OVERLAY_FS=y @@ -6808,7 +6698,7 @@ CONFIG_SUNRPC_GSS=y CONFIG_SUNRPC_BACKCHANNEL=y CONFIG_RPCSEC_GSS_KRB5=y # CONFIG_SUNRPC_DEBUG is not set -CONFIG_SUNRPC_XPRT_RDMA=y +CONFIG_SUNRPC_XPRT_RDMA=m CONFIG_CEPH_FS=y CONFIG_CEPH_FS_POSIX_ACL=y # CONFIG_CEPH_FS_SECURITY_LABEL is not set @@ -6823,7 +6713,6 @@ CONFIG_CIFS_DEBUG=y # CONFIG_CIFS_DEBUG_DUMP_KEYS is not set CONFIG_CIFS_DFS_UPCALL=y # CONFIG_CIFS_SWN_UPCALL is not set -# CONFIG_CIFS_SMB_DIRECT is not set # CONFIG_CIFS_ROOT is not set # CONFIG_CIFS_COMPRESSION is not set # CONFIG_SMB_SERVER is not set @@ -6910,7 +6799,8 @@ CONFIG_SECURITY_NETWORK_XFRM=y CONFIG_SECURITY_PATH=y # CONFIG_INTEL_TXT is not set CONFIG_LSM_MMAP_MIN_ADDR=65536 -# CONFIG_STATIC_USERMODEHELPER is not set +CONFIG_STATIC_USERMODEHELPER=y +CONFIG_STATIC_USERMODEHELPER_PATH="/sbin/init" CONFIG_SECURITY_SELINUX=y # CONFIG_SECURITY_SELINUX_BOOTPARAM is not set CONFIG_SECURITY_SELINUX_DEVELOP=y @@ -6929,7 +6819,7 @@ CONFIG_SECURITY_APPARMOR_EXPORT_BINARY=y CONFIG_SECURITY_APPARMOR_PARANOID_LOAD=y # CONFIG_SECURITY_LOADPIN is not set CONFIG_SECURITY_YAMA=y -# CONFIG_SECURITY_SAFESETID is not set +CONFIG_SECURITY_SAFESETID=y CONFIG_SECURITY_LOCKDOWN_LSM=y CONFIG_SECURITY_LOCKDOWN_LSM_EARLY=y CONFIG_LOCK_DOWN_KERNEL_FORCE_NONE=y @@ -6950,7 +6840,7 @@ CONFIG_INTEGRITY_AUDIT=y # CONFIG_DEFAULT_SECURITY_SELINUX is not set # CONFIG_DEFAULT_SECURITY_APPARMOR is not set CONFIG_DEFAULT_SECURITY_DAC=y -CONFIG_LSM="yama,selinux,loadpin,safesetid,integrity,bpf,apparmor,lockdown,landlock" +CONFIG_LSM="yama,selinux,safesetid,integrity,bpf,apparmor,lockdown,landlock" # # Kernel hardening options @@ -7037,7 +6927,7 @@ CONFIG_CRYPTO_CRYPTD=y CONFIG_CRYPTO_AUTHENC=y # CONFIG_CRYPTO_KRB5ENC is not set # CONFIG_CRYPTO_BENCHMARK is not set -CONFIG_CRYPTO_ENGINE=y +CONFIG_CRYPTO_ENGINE=m # end of Crypto core or helper # @@ -7057,7 +6947,6 @@ CONFIG_CRYPTO_ECDH=y # CONFIG_CRYPTO_AES=y # CONFIG_CRYPTO_AES_TI is not set -# CONFIG_CRYPTO_ANUBIS is not set # CONFIG_CRYPTO_ARIA is not set # CONFIG_CRYPTO_BLOWFISH is not set # CONFIG_CRYPTO_CAMELLIA is not set @@ -7065,11 +6954,8 @@ CONFIG_CRYPTO_AES=y # CONFIG_CRYPTO_CAST6 is not set CONFIG_CRYPTO_DES=y # CONFIG_CRYPTO_FCRYPT is not set -# CONFIG_CRYPTO_KHAZAD is not set -# CONFIG_CRYPTO_SEED is not set # CONFIG_CRYPTO_SERPENT is not set # CONFIG_CRYPTO_SM4_GENERIC is not set -# CONFIG_CRYPTO_TEA is not set # CONFIG_CRYPTO_TWOFISH is not set # end of Block ciphers @@ -7077,7 +6963,6 @@ CONFIG_CRYPTO_DES=y # Length-preserving ciphers and modes # CONFIG_CRYPTO_ADIANTUM=y -CONFIG_CRYPTO_ARC4=y CONFIG_CRYPTO_CHACHA20=y CONFIG_CRYPTO_CBC=y CONFIG_CRYPTO_CTR=y @@ -7161,12 +7046,10 @@ CONFIG_CRYPTO_JITTERENTROPY_OSR=1 # # Userspace interface # -CONFIG_CRYPTO_USER_API=y -CONFIG_CRYPTO_USER_API_HASH=y -CONFIG_CRYPTO_USER_API_SKCIPHER=y +# CONFIG_CRYPTO_USER_API_HASH is not set +# CONFIG_CRYPTO_USER_API_SKCIPHER is not set # CONFIG_CRYPTO_USER_API_RNG is not set -CONFIG_CRYPTO_USER_API_AEAD=y -CONFIG_CRYPTO_USER_API_ENABLE_OBSOLETE=y +# CONFIG_CRYPTO_USER_API_AEAD is not set # end of Userspace interface # @@ -7220,7 +7103,7 @@ CONFIG_CRYPTO_DEV_SP_PSP=y # CONFIG_CRYPTO_DEV_QAT_C3XXXVF is not set # CONFIG_CRYPTO_DEV_QAT_C62XVF is not set # CONFIG_CRYPTO_DEV_CHELSIO is not set -CONFIG_CRYPTO_DEV_VIRTIO=y +CONFIG_CRYPTO_DEV_VIRTIO=m # CONFIG_CRYPTO_DEV_SAFEXCEL is not set # CONFIG_CRYPTO_DEV_AMLOGIC_GXL is not set CONFIG_ASYMMETRIC_KEY_TYPE=y @@ -7235,11 +7118,11 @@ CONFIG_SIGNED_PE_FILE_VERIFICATION=y # # Certificates for signature checking # -CONFIG_MODULE_SIG_KEY="certs/blockcast_signing_key.pem" +CONFIG_MODULE_SIG_KEY="certs/signing_key.pem" CONFIG_MODULE_SIG_KEY_TYPE_RSA=y # CONFIG_MODULE_SIG_KEY_TYPE_ECDSA is not set CONFIG_SYSTEM_TRUSTED_KEYRING=y -CONFIG_SYSTEM_TRUSTED_KEYS="" +CONFIG_SYSTEM_TRUSTED_KEYS="certs/blockcast-modsign.crt" # CONFIG_SYSTEM_EXTRA_CERTIFICATE is not set # CONFIG_SECONDARY_TRUSTED_KEYRING is not set CONFIG_SYSTEM_BLACKLIST_KEYRING=y @@ -7514,7 +7397,7 @@ CONFIG_SLUB_DEBUG=y # CONFIG_SLUB_DEBUG_ON is not set # CONFIG_PAGE_OWNER is not set CONFIG_PAGE_TABLE_CHECK=y -# CONFIG_PAGE_TABLE_CHECK_ENFORCED is not set +CONFIG_PAGE_TABLE_CHECK_ENFORCED=y CONFIG_PAGE_POISONING=y # CONFIG_DEBUG_PAGE_REF is not set # CONFIG_DEBUG_RODATA_TEST is not set @@ -7690,7 +7573,7 @@ CONFIG_FTRACE_SYSCALLS=y # CONFIG_TRACER_SNAPSHOT is not set CONFIG_BRANCH_PROFILE_NONE=y # CONFIG_PROFILE_ANNOTATED_BRANCHES is not set -CONFIG_BLK_DEV_IO_TRACE=y +# CONFIG_BLK_DEV_IO_TRACE is not set CONFIG_PROBE_EVENTS_BTF_ARGS=y CONFIG_KPROBE_EVENTS=y # CONFIG_KPROBE_EVENTS_ON_NOTRACE is not set diff --git a/kernel/build/scripts/filter-hardened-check.py b/kernel/build/scripts/filter-hardened-check.py index 63a486215..4629c6d60 100644 --- a/kernel/build/scripts/filter-hardened-check.py +++ b/kernel/build/scripts/filter-hardened-check.py @@ -37,8 +37,6 @@ 'CONFIG_GCC_PLUGIN_LATENT_ENTROPY', # doesn't seem very relevant, entropy is low quality, and not available in Clang, https://github.com/torvalds/linux/blob/37a93dd5c49b5fda807fd204edf2547c3493319c/scripts/gcc-plugins/Kconfig#L25-L33 'CONFIG_MODULE_SIG_FORCE', # see https://github.com/siderolabs/talos/issues/11989 'CONFIG_IOMMU_DEFAULT_DMA_LAZY', # performance impact, we can reconsider later - 'CONFIG_STATIC_USERMODEHELPER', # not set in deployed Sidero v1.13.4 stock kernel (config rebased on /proc/config.gz for boot parity); enabling is unproven on these Talos VMs - 'CONFIG_PAGE_TABLE_CHECK_ENFORCED', # ditto — deployed stock kernel runs without it (PAGE_TABLE_CHECK=y is kept); enforced mode unproven here } """ From bf569841069902dda94e633b9a9c37637cd0aac1 Mon Sep 17 00:00:00 2001 From: Omar Ramadan Date: Fri, 3 Jul 2026 17:49:38 +0000 Subject: [PATCH 4/6] Revert "fix(kernel): narrow Blockcast module trust config" MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This reverts commit 287cef517cd2897b75d8d6f6535a5eaba30570c3, restoring the deployed, empirically-validated lineage: - SYSTEM_TRUSTED_KEYS is a proven dead end on this build: the compiled kernel ships CONFIG_SYSTEM_TRUSTED_KEYS="" even though olddefconfig/ syncconfig preserve the value in config-amd64 (verified twice on the ct2 rebuild, cache-busted; /proc/keys on the booted node held only the Sidero throw-away key → amt.ko EKEYREJECTED). The working mechanism is CONFIG_MODULE_SIG_KEY="certs/blockcast_signing_key.pem" (custom path disables the certs/Makefile throw-away regen; kernel embeds the cert in .builtin_trusted_keys by construction). See 2026-06-24-amt-kmod-production-runbook.md (ct2/ct3 walls). - The 6.18.34→6.18.35 bump orphans the signed amt-kmod extension built for 6.18.34-talos (vermagic + module path) and desyncs this branch from the kernel actually deployed on the data nodes (ct4/signed6). Signed-off-by: Omar Ramadan --- Pkgfile | 6 +- kernel/build/config-amd64 | 357 ++++++++++++------ kernel/build/scripts/filter-hardened-check.py | 2 + 3 files changed, 242 insertions(+), 123 deletions(-) diff --git a/Pkgfile b/Pkgfile index 834e351d6..005db0334 100644 --- a/Pkgfile +++ b/Pkgfile @@ -103,9 +103,9 @@ vars: kspp_sha512: 1befd930ca0e43acb049f3ffac584e9a13c0ef716abba0670eb976e1b6bcee3f833b2b16cb02ac193c33c3fbbeb6ff221394f4265f5b0d4b8e65488a530b0d0a # renovate: datasource=git-tags extractVersion=^v(?.*)$ depName=git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git - linux_version: 6.18.35 - linux_sha256: f78602932219125e211c5f5bfd84edcfd4ec5ce88fc944f8248413f665bef236 - linux_sha512: 8888a1f908473ea91e943a9c61cff956939709b0ded2d2e5cc26f377d1799ce5ba4d247c522508d13c3769ad90f804a8ef423fa782c10ae8e7ce9e7504bd8871 + linux_version: 6.18.34 + linux_sha256: 640c4732fb42842166db97e032c1fe7e5ff72c85a8982c75b40f74be3555d760 + linux_sha512: 0693f39aaf414cc4c5e1928b4373e24b25797fd3578a22f25d1be2ab5a318dfb42d374dc70c388e9929e8b9795bc397b9d7a281817c6509057ae54047a961582 # renovate: datasource=git-tags extractVersion=^libaio-(?.*)$ depName=https://pagure.io/libaio.git libaio_version: 0.3.113 diff --git a/kernel/build/config-amd64 b/kernel/build/config-amd64 index 6f8969558..a9010bb23 100644 --- a/kernel/build/config-amd64 +++ b/kernel/build/config-amd64 @@ -1,6 +1,6 @@ # # Automatically generated file; DO NOT EDIT. -# Linux/x86 6.18.35 Kernel Configuration +# Linux/x86 6.18.34 Kernel Configuration # CONFIG_CC_VERSION_TEXT="clang version 22.1.7" CONFIG_GCC_VERSION=0 @@ -606,12 +606,11 @@ CONFIG_ACPI_SLEEP=y CONFIG_ACPI_REV_OVERRIDE_POSSIBLE=y CONFIG_ACPI_EC=y # CONFIG_ACPI_EC_DEBUGFS is not set -CONFIG_ACPI_AC=m -CONFIG_ACPI_BATTERY=m -CONFIG_ACPI_BUTTON=m -# CONFIG_ACPI_TINY_POWER_BUTTON is not set -CONFIG_ACPI_VIDEO=m -CONFIG_ACPI_FAN=m +CONFIG_ACPI_AC=y +CONFIG_ACPI_BATTERY=y +CONFIG_ACPI_BUTTON=y +CONFIG_ACPI_VIDEO=y +CONFIG_ACPI_FAN=y # CONFIG_ACPI_TAD is not set CONFIG_ACPI_DOCK=y CONFIG_ACPI_CPU_FREQ_PSS=y @@ -622,7 +621,7 @@ CONFIG_ACPI_PROCESSOR=y CONFIG_ACPI_IPMI=y CONFIG_ACPI_HOTPLUG_CPU=y # CONFIG_ACPI_PROCESSOR_AGGREGATOR is not set -CONFIG_ACPI_THERMAL=m +CONFIG_ACPI_THERMAL=y CONFIG_ARCH_HAS_ACPI_TABLE_UPGRADE=y CONFIG_ACPI_TABLE_UPGRADE=y # CONFIG_ACPI_DEBUG is not set @@ -1021,7 +1020,7 @@ CONFIG_MODULE_SIG_SHA512=y CONFIG_MODULE_SIG_HASH="sha512" # CONFIG_MODULE_COMPRESS is not set # CONFIG_MODULE_ALLOW_MISSING_NAMESPACE_IMPORTS is not set -CONFIG_MODPROBE_PATH="" +CONFIG_MODPROBE_PATH="/sbin/modprobe" # CONFIG_TRIM_UNUSED_KSYMS is not set CONFIG_MODULES_TREE_LOOKUP=y CONFIG_BLOCK=y @@ -1469,6 +1468,7 @@ CONFIG_NF_NAT_TFTP=y CONFIG_NF_NAT_REDIRECT=y CONFIG_NF_NAT_MASQUERADE=y CONFIG_NF_NAT_OVS=y +CONFIG_NETFILTER_SYNPROXY=y CONFIG_NF_TABLES=y CONFIG_NF_TABLES_INET=y CONFIG_NF_TABLES_NETDEV=y @@ -1502,7 +1502,7 @@ CONFIG_NFT_FWD_NETDEV=y # CONFIG_NFT_REJECT_NETDEV is not set # CONFIG_NF_FLOW_TABLE is not set CONFIG_NETFILTER_XTABLES=y -# CONFIG_NETFILTER_XTABLES_COMPAT is not set +CONFIG_NETFILTER_XTABLES_COMPAT=y # CONFIG_NETFILTER_XTABLES_LEGACY is not set # @@ -1676,7 +1676,14 @@ CONFIG_NF_LOG_IPV4=y CONFIG_NF_REJECT_IPV4=y CONFIG_NF_NAT_SNMP_BASIC=y CONFIG_NF_NAT_PPTP=y -# CONFIG_IP_NF_IPTABLES is not set +CONFIG_IP_NF_IPTABLES=y +# CONFIG_IP_NF_MATCH_AH is not set +# CONFIG_IP_NF_MATCH_ECN is not set +CONFIG_IP_NF_MATCH_RPFILTER=y +# CONFIG_IP_NF_MATCH_TTL is not set +CONFIG_IP_NF_TARGET_REJECT=y +# CONFIG_IP_NF_TARGET_SYNPROXY is not set +# CONFIG_IP_NF_TARGET_ECN is not set # end of IP: Netfilter Configuration # @@ -1691,7 +1698,20 @@ CONFIG_NFT_FIB_IPV6=y CONFIG_NF_DUP_IPV6=y CONFIG_NF_REJECT_IPV6=y CONFIG_NF_LOG_IPV6=y -# CONFIG_IP6_NF_IPTABLES is not set +CONFIG_IP6_NF_IPTABLES=y +CONFIG_IP6_NF_MATCH_AH=y +CONFIG_IP6_NF_MATCH_EUI64=y +CONFIG_IP6_NF_MATCH_FRAG=y +CONFIG_IP6_NF_MATCH_OPTS=y +CONFIG_IP6_NF_MATCH_HL=y +CONFIG_IP6_NF_MATCH_IPV6HEADER=y +CONFIG_IP6_NF_MATCH_MH=y +CONFIG_IP6_NF_MATCH_RPFILTER=y +CONFIG_IP6_NF_MATCH_RT=y +# CONFIG_IP6_NF_MATCH_SRH is not set +CONFIG_IP6_NF_TARGET_REJECT=y +CONFIG_IP6_NF_TARGET_SYNPROXY=y +# CONFIG_IP6_NF_TARGET_NPT is not set # end of IPv6: Netfilter Configuration CONFIG_NF_DEFRAG_IPV6=y @@ -1699,15 +1719,38 @@ CONFIG_NF_TABLES_BRIDGE=y # CONFIG_NFT_BRIDGE_META is not set # CONFIG_NFT_BRIDGE_REJECT is not set # CONFIG_NF_CONNTRACK_BRIDGE is not set -# CONFIG_BRIDGE_NF_EBTABLES is not set +CONFIG_BRIDGE_NF_EBTABLES=y +CONFIG_BRIDGE_EBT_802_3=y +CONFIG_BRIDGE_EBT_AMONG=y +CONFIG_BRIDGE_EBT_ARP=y +CONFIG_BRIDGE_EBT_IP=y +CONFIG_BRIDGE_EBT_IP6=y +CONFIG_BRIDGE_EBT_LIMIT=y +CONFIG_BRIDGE_EBT_MARK=y +CONFIG_BRIDGE_EBT_PKTTYPE=y +CONFIG_BRIDGE_EBT_STP=y +CONFIG_BRIDGE_EBT_VLAN=y +CONFIG_BRIDGE_EBT_ARPREPLY=y +CONFIG_BRIDGE_EBT_DNAT=y +CONFIG_BRIDGE_EBT_MARK_T=y +CONFIG_BRIDGE_EBT_REDIRECT=y +CONFIG_BRIDGE_EBT_SNAT=y +CONFIG_BRIDGE_EBT_LOG=y +CONFIG_BRIDGE_EBT_NFLOG=y CONFIG_IP_SCTP=y # CONFIG_SCTP_DBG_OBJCNT is not set CONFIG_SCTP_DEFAULT_COOKIE_HMAC_SHA256=y # CONFIG_SCTP_DEFAULT_COOKIE_HMAC_NONE is not set CONFIG_INET_SCTP_DIAG=y -# CONFIG_RDS is not set +CONFIG_RDS=y +# CONFIG_RDS_RDMA is not set +# CONFIG_RDS_TCP is not set +# CONFIG_RDS_DEBUG is not set # CONFIG_TIPC is not set -# CONFIG_ATM is not set +CONFIG_ATM=y +# CONFIG_ATM_CLIP is not set +# CONFIG_ATM_LANE is not set +# CONFIG_ATM_BR2684 is not set CONFIG_L2TP=y # CONFIG_L2TP_DEBUGFS is not set # CONFIG_L2TP_V3 is not set @@ -1745,11 +1788,11 @@ CONFIG_VLAN_8021Q=y # CONFIG_VLAN_8021Q_GVRP is not set # CONFIG_VLAN_8021Q_MVRP is not set CONFIG_LLC=y -# CONFIG_LLC2 is not set +CONFIG_LLC2=y # CONFIG_ATALK is not set -# CONFIG_X25 is not set -# CONFIG_LAPB is not set -# CONFIG_PHONET is not set +CONFIG_X25=y +CONFIG_LAPB=y +CONFIG_PHONET=y # CONFIG_6LOWPAN is not set # CONFIG_IEEE802154 is not set CONFIG_NET_SCHED=y @@ -1856,10 +1899,10 @@ CONFIG_OPENVSWITCH_GENEVE=y CONFIG_VSOCKETS=y CONFIG_VSOCKETS_DIAG=y CONFIG_VSOCKETS_LOOPBACK=y -CONFIG_VMWARE_VMCI_VSOCKETS=m -CONFIG_VIRTIO_VSOCKETS=m +CONFIG_VMWARE_VMCI_VSOCKETS=y +CONFIG_VIRTIO_VSOCKETS=y CONFIG_VIRTIO_VSOCKETS_COMMON=y -CONFIG_HYPERV_VSOCKETS=m +CONFIG_HYPERV_VSOCKETS=y CONFIG_NETLINK_DIAG=y CONFIG_MPLS=y CONFIG_NET_MPLS_GSO=y @@ -1956,7 +1999,7 @@ CONFIG_PCI_QUIRKS=y CONFIG_PCI_REALLOC_ENABLE_AUTO=y # CONFIG_PCI_STUB is not set # CONFIG_PCI_PF_STUB is not set -CONFIG_XEN_PCIDEV_FRONTEND=m +CONFIG_XEN_PCIDEV_FRONTEND=y CONFIG_PCI_ATS=y # CONFIG_PCI_DOE is not set CONFIG_PCI_ECAM=y @@ -1968,7 +2011,7 @@ CONFIG_PCI_PASID=y # CONFIG_PCIE_TPH is not set CONFIG_PCI_P2PDMA=y CONFIG_PCI_LABEL=y -CONFIG_PCI_HYPERV=m +CONFIG_PCI_HYPERV=y # CONFIG_PCIE_BUS_TUNE_OFF is not set CONFIG_PCIE_BUS_DEFAULT=y # CONFIG_PCIE_BUS_SAFE is not set @@ -1987,7 +2030,7 @@ CONFIG_HOTPLUG_PCI_ACPI=y # PCI controller drivers # CONFIG_PCI_HOST_COMMON=y -CONFIG_VMD=m +CONFIG_VMD=y CONFIG_PCI_HYPERV_INTERFACE=y # @@ -2045,7 +2088,8 @@ CONFIG_PCI_EPF_NTB=y # Generic Driver Options # CONFIG_AUXILIARY_BUS=y -# CONFIG_UEVENT_HELPER is not set +CONFIG_UEVENT_HELPER=y +CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug" CONFIG_DEVTMPFS=y # CONFIG_DEVTMPFS_MOUNT is not set # CONFIG_DEVTMPFS_SAFE is not set @@ -2118,7 +2162,7 @@ CONFIG_ISCSI_IBFT_FIND=y CONFIG_ISCSI_IBFT=y # CONFIG_FW_CFG_SYSFS is not set CONFIG_SYSFB=y -CONFIG_SYSFB_SIMPLEFB=y +# CONFIG_SYSFB_SIMPLEFB is not set # CONFIG_GOOGLE_FIRMWARE is not set # @@ -2178,15 +2222,27 @@ CONFIG_BLK_DEV=y # CONFIG_BLK_DEV_FD is not set CONFIG_CDROM=y # CONFIG_BLK_DEV_PCIESSD_MTIP32XX is not set -# CONFIG_ZRAM is not set +CONFIG_ZRAM=y +# CONFIG_ZRAM_BACKEND_LZ4 is not set +# CONFIG_ZRAM_BACKEND_LZ4HC is not set +CONFIG_ZRAM_BACKEND_ZSTD=y +# CONFIG_ZRAM_BACKEND_DEFLATE is not set +# CONFIG_ZRAM_BACKEND_842 is not set +# CONFIG_ZRAM_BACKEND_LZO is not set +CONFIG_ZRAM_DEF_COMP_ZSTD=y +CONFIG_ZRAM_DEF_COMP="zstd" +# CONFIG_ZRAM_WRITEBACK is not set +# CONFIG_ZRAM_TRACK_ENTRY_ACTIME is not set +# CONFIG_ZRAM_MEMORY_TRACKING is not set +# CONFIG_ZRAM_MULTI_COMP is not set CONFIG_BLK_DEV_LOOP=y CONFIG_BLK_DEV_LOOP_MIN_COUNT=8 # CONFIG_BLK_DEV_DRBD is not set CONFIG_BLK_DEV_NBD=m # CONFIG_BLK_DEV_RAM is not set # CONFIG_ATA_OVER_ETH is not set -CONFIG_XEN_BLKDEV_FRONTEND=m -CONFIG_VIRTIO_BLK=m +CONFIG_XEN_BLKDEV_FRONTEND=y +CONFIG_VIRTIO_BLK=y CONFIG_BLK_DEV_RBD=y CONFIG_BLK_DEV_UBLK=m # CONFIG_BLKDEV_UBLK_LEGACY_OPCODES is not set @@ -2240,7 +2296,7 @@ CONFIG_HP_ILO=m # CONFIG_SENSORS_APDS990X is not set # CONFIG_HMC6352 is not set # CONFIG_DS1682 is not set -CONFIG_VMWARE_BALLOON=m +CONFIG_VMWARE_BALLOON=y # CONFIG_SRAM is not set # CONFIG_DW_XDATA_PCIE is not set # CONFIG_PCI_ENDPOINT_TEST is not set @@ -2271,7 +2327,7 @@ CONFIG_INTEL_MEI_GSC=m CONFIG_INTEL_MEI_HDCP=m CONFIG_INTEL_MEI_PXP=m CONFIG_INTEL_MEI_GSC_PROXY=m -CONFIG_VMWARE_VMCI=m +CONFIG_VMWARE_VMCI=y # CONFIG_GENWQE is not set # CONFIG_BCM_VK is not set # CONFIG_MISC_ALCOR_PCI is not set @@ -2357,8 +2413,8 @@ CONFIG_SCSI_SMARTPQI=m # CONFIG_SCSI_MYRB is not set # CONFIG_SCSI_MYRS is not set CONFIG_VMWARE_PVSCSI=m -CONFIG_XEN_SCSI_FRONTEND=m -CONFIG_HYPERV_STORAGE=m +CONFIG_XEN_SCSI_FRONTEND=y +CONFIG_HYPERV_STORAGE=y CONFIG_LIBFC=m CONFIG_LIBFCOE=m # CONFIG_FCOE is not set @@ -2387,7 +2443,7 @@ CONFIG_SCSI_LPFC=m # CONFIG_SCSI_PMCRAID is not set # CONFIG_SCSI_PM8001 is not set # CONFIG_SCSI_BFA_FC is not set -CONFIG_SCSI_VIRTIO=m +CONFIG_SCSI_VIRTIO=y # CONFIG_SCSI_CHELSIO_FCOE is not set # CONFIG_SCSI_DH is not set # end of SCSI device support @@ -2424,7 +2480,7 @@ CONFIG_ATA_BMDMA=y # # SATA SFF controllers with BMDMA # -CONFIG_ATA_PIIX=m +CONFIG_ATA_PIIX=y # CONFIG_SATA_DWC is not set # CONFIG_SATA_MV is not set # CONFIG_SATA_NV is not set @@ -2589,12 +2645,23 @@ CONFIG_TUN=y CONFIG_TAP=y # CONFIG_TUN_VNET_CROSS_LE is not set CONFIG_VETH=y -CONFIG_VIRTIO_NET=m +CONFIG_VIRTIO_NET=y # CONFIG_NLMON is not set CONFIG_NETKIT=y CONFIG_NET_VRF=m # CONFIG_VSOCKMON is not set # CONFIG_ARCNET is not set +CONFIG_ATM_DRIVERS=y +# CONFIG_ATM_DUMMY is not set +# CONFIG_ATM_TCP is not set +# CONFIG_ATM_LANAI is not set +# CONFIG_ATM_ENI is not set +# CONFIG_ATM_NICSTAR is not set +# CONFIG_ATM_IDT77252 is not set +# CONFIG_ATM_IA is not set +# CONFIG_ATM_FORE200E is not set +# CONFIG_ATM_HE is not set +# CONFIG_ATM_SOLOS is not set # # Distributed Switch Architecture drivers @@ -2919,7 +2986,9 @@ CONFIG_NET_VENDOR_WIZNET=y CONFIG_NET_VENDOR_XILINX=y # CONFIG_XILINX_EMACLITE is not set # CONFIG_XILINX_LL_TEMAC is not set -# CONFIG_FDDI is not set +CONFIG_FDDI=y +# CONFIG_DEFXX is not set +# CONFIG_SKFP is not set # CONFIG_HIPPI is not set CONFIG_MDIO_BUS=y CONFIG_PHYLINK=y @@ -3014,6 +3083,7 @@ CONFIG_PPP=y # CONFIG_PPP_FILTER is not set # CONFIG_PPP_MPPE is not set # CONFIG_PPP_MULTILINK is not set +# CONFIG_PPPOATM is not set # CONFIG_PPPOE is not set CONFIG_PPPOE_HASH_BITS=4 # CONFIG_PPTP is not set @@ -3060,6 +3130,7 @@ CONFIG_USB_NET_CX82310_ETH=m CONFIG_USB_NET_KALMIA=m CONFIG_USB_NET_QMI_WWAN=m CONFIG_USB_NET_INT51X1=m +CONFIG_USB_CDC_PHONET=m CONFIG_USB_IPHETH=m CONFIG_USB_SIERRA_NET=m CONFIG_USB_VL600=m @@ -3075,11 +3146,11 @@ CONFIG_USB_RTL8153_ECM=m # CONFIG_WWAN is not set # end of Wireless WAN -CONFIG_XEN_NETDEV_FRONTEND=m +CONFIG_XEN_NETDEV_FRONTEND=y CONFIG_VMXNET3=m # CONFIG_FUJITSU_ES is not set CONFIG_USB4_NET=m -CONFIG_HYPERV_NET=m +CONFIG_HYPERV_NET=y # CONFIG_NETDEVSIM is not set CONFIG_NET_FAILOVER=y # CONFIG_ISDN is not set @@ -3133,7 +3204,7 @@ CONFIG_KEYBOARD_ATKBD=y # CONFIG_KEYBOARD_XTKBD is not set # CONFIG_KEYBOARD_CYPRESS_SF is not set CONFIG_INPUT_MOUSE=y -CONFIG_MOUSE_PS2=m +CONFIG_MOUSE_PS2=y CONFIG_MOUSE_PS2_ALPS=y CONFIG_MOUSE_PS2_BYD=y CONFIG_MOUSE_PS2_LOGIPS2PP=y @@ -3290,7 +3361,7 @@ CONFIG_INPUT_UINPUT=m # CONFIG_INPUT_IQS626A is not set # CONFIG_INPUT_IQS7222 is not set # CONFIG_INPUT_CMA3000 is not set -CONFIG_INPUT_XEN_KBDDEV_FRONTEND=m +CONFIG_INPUT_XEN_KBDDEV_FRONTEND=y # CONFIG_INPUT_IDEAPAD_SLIDEBAR is not set # CONFIG_INPUT_DRV260X_HAPTICS is not set # CONFIG_INPUT_DRV2665_HAPTICS is not set @@ -3311,7 +3382,7 @@ CONFIG_SERIO_LIBPS2=y # CONFIG_SERIO_ALTERA_PS2 is not set # CONFIG_SERIO_PS2MULT is not set # CONFIG_SERIO_ARC_PS2 is not set -CONFIG_HYPERV_KEYBOARD=m +CONFIG_HYPERV_KEYBOARD=y # CONFIG_SERIO_GPIO_PS2 is not set # CONFIG_USERIO is not set # CONFIG_GAMEPORT is not set @@ -3396,13 +3467,13 @@ CONFIG_HVC_XEN_FRONTEND=y # CONFIG_RPMSG_TTY is not set # CONFIG_SERIAL_DEV_BUS is not set # CONFIG_TTY_PRINTK is not set -CONFIG_VIRTIO_CONSOLE=m +CONFIG_VIRTIO_CONSOLE=y CONFIG_IPMI_HANDLER=y CONFIG_IPMI_DMI_DECODE=y CONFIG_IPMI_PLAT_DATA=y # CONFIG_IPMI_PANIC_EVENT is not set CONFIG_IPMI_DEVICE_INTERFACE=y -CONFIG_IPMI_SI=m +CONFIG_IPMI_SI=y # CONFIG_IPMI_SSIF is not set CONFIG_IPMI_WATCHDOG=m CONFIG_IPMI_POWEROFF=y @@ -3418,7 +3489,7 @@ CONFIG_HW_RANDOM_XIPHERA=m # CONFIG_MWAVE is not set # CONFIG_DEVMEM is not set CONFIG_NVRAM=y -# CONFIG_DEVPORT is not set +CONFIG_DEVPORT=y CONFIG_HPET=y # CONFIG_HPET_MMAP is not set # CONFIG_HANGCHECK_TIMER is not set @@ -3756,7 +3827,7 @@ CONFIG_POWER_SUPPLY_HWMON=y # CONFIG_BATTERY_UG3105 is not set # CONFIG_FUEL_GAUGE_MM8013 is not set CONFIG_HWMON=y -CONFIG_HWMON_VID=m +CONFIG_HWMON_VID=y # CONFIG_HWMON_DEBUG_CHIP is not set # @@ -3792,7 +3863,7 @@ CONFIG_SENSORS_FAM15H_POWER=m # CONFIG_SENSORS_CHIPCAP2 is not set # CONFIG_SENSORS_CORSAIR_CPRO is not set # CONFIG_SENSORS_CORSAIR_PSU is not set -CONFIG_SENSORS_DRIVETEMP=m +CONFIG_SENSORS_DRIVETEMP=y # CONFIG_SENSORS_DS620 is not set # CONFIG_SENSORS_DS1621 is not set # CONFIG_SENSORS_DELL_SMM is not set @@ -3814,7 +3885,7 @@ CONFIG_SENSORS_I5K_AMB=m # CONFIG_SENSORS_IBMAEM is not set # CONFIG_SENSORS_IBMPEX is not set CONFIG_SENSORS_I5500=m -CONFIG_SENSORS_CORETEMP=m +CONFIG_SENSORS_CORETEMP=y # CONFIG_SENSORS_ISL28022 is not set CONFIG_SENSORS_IT87=m # CONFIG_SENSORS_JC42 is not set @@ -3870,9 +3941,9 @@ CONFIG_SENSORS_IT87=m # CONFIG_SENSORS_LM95245 is not set # CONFIG_SENSORS_PC87360 is not set # CONFIG_SENSORS_PC87427 is not set -CONFIG_SENSORS_NCT6683=m +CONFIG_SENSORS_NCT6683=y CONFIG_SENSORS_NCT6775_CORE=y -CONFIG_SENSORS_NCT6775=m +CONFIG_SENSORS_NCT6775=y CONFIG_SENSORS_NCT6775_I2C=y # CONFIG_SENSORS_NCT7363 is not set # CONFIG_SENSORS_NCT7802 is not set @@ -3940,7 +4011,7 @@ CONFIG_SENSORS_NCT6775_I2C=y # # ACPI drivers # -CONFIG_SENSORS_ACPI_POWER=m +CONFIG_SENSORS_ACPI_POWER=y # CONFIG_SENSORS_ATK0110 is not set # CONFIG_SENSORS_ASUS_WMI is not set # CONFIG_SENSORS_ASUS_EC is not set @@ -4324,20 +4395,7 @@ CONFIG_USB_VIDEO_CLASS_INPUT_EVDEV=y # # CONFIG_DVB_AS102 is not set # CONFIG_DVB_B2C2_FLEXCOP_USB is not set -CONFIG_DVB_USB_V2=m -# CONFIG_DVB_USB_AF9015 is not set -# CONFIG_DVB_USB_AF9035 is not set -# CONFIG_DVB_USB_ANYSEE is not set -# CONFIG_DVB_USB_AU6610 is not set -# CONFIG_DVB_USB_AZ6007 is not set -# CONFIG_DVB_USB_CE6230 is not set -CONFIG_DVB_USB_DVBSKY=m -# CONFIG_DVB_USB_EC168 is not set -# CONFIG_DVB_USB_GL861 is not set -# CONFIG_DVB_USB_LME2510 is not set -# CONFIG_DVB_USB_MXL111SF is not set -# CONFIG_DVB_USB_RTL28XXU is not set -# CONFIG_DVB_USB_ZD1301 is not set +# CONFIG_DVB_USB_V2 is not set # CONFIG_DVB_USB is not set # CONFIG_SMS_USB_DRV is not set # CONFIG_DVB_TTUSB_BUDGET is not set @@ -4731,7 +4789,7 @@ CONFIG_MEDIA_TUNER_XC5000=m # # Multistandard (satellite) frontends # -CONFIG_DVB_M88DS3103=m +# CONFIG_DVB_M88DS3103 is not set CONFIG_DVB_MXL5XX=m CONFIG_DVB_STB0899=m CONFIG_DVB_STB6100=m @@ -4899,8 +4957,13 @@ CONFIG_APERTURE_HELPERS=y CONFIG_SCREEN_INFO=y CONFIG_VIDEO=y # CONFIG_AUXDISPLAY is not set -# CONFIG_AGP is not set -CONFIG_INTEL_GTT=m +CONFIG_AGP=y +CONFIG_AGP_AMD64=y +CONFIG_AGP_INTEL=y +# CONFIG_AGP_SIS is not set +# CONFIG_AGP_VIA is not set +CONFIG_INTEL_GTT=y +# CONFIG_VGA_SWITCHEROO is not set CONFIG_DRM=y # @@ -4954,8 +5017,9 @@ CONFIG_DRM_SCHED=m # # Drivers for system framebuffers # -CONFIG_DRM_SYSFB_HELPER=y -CONFIG_DRM_SIMPLEDRM=y +# CONFIG_DRM_EFIDRM is not set +# CONFIG_DRM_SIMPLEDRM is not set +# CONFIG_DRM_VESADRM is not set # end of Drivers for system framebuffers # @@ -5070,7 +5134,7 @@ CONFIG_DRM_XE_ENABLE_SCHEDTIMEOUT_LIMIT=y # CONFIG_DRM_AST is not set # CONFIG_DRM_MGAG200 is not set # CONFIG_DRM_QXL is not set -CONFIG_DRM_VIRTIO_GPU=m +CONFIG_DRM_VIRTIO_GPU=y CONFIG_DRM_VIRTIO_GPU_KMS=y CONFIG_DRM_PANEL=y @@ -5108,21 +5172,71 @@ CONFIG_DRM_PANEL_ORIENTATION_QUIRKS=y # # Frame buffer Devices # -# CONFIG_FB is not set +CONFIG_FB=y +# CONFIG_FB_CIRRUS is not set +# CONFIG_FB_PM2 is not set +# CONFIG_FB_CYBER2000 is not set +# CONFIG_FB_ARC is not set +# CONFIG_FB_ASILIANT is not set +# CONFIG_FB_IMSTT is not set +CONFIG_FB_VGA16=y +# CONFIG_FB_UVESA is not set +CONFIG_FB_VESA=y +CONFIG_FB_EFI=y +# CONFIG_FB_N411 is not set +# CONFIG_FB_HGA is not set +# CONFIG_FB_OPENCORES is not set +# CONFIG_FB_S1D13XXX is not set +# CONFIG_FB_NVIDIA is not set +# CONFIG_FB_RIVA is not set +# CONFIG_FB_I740 is not set +# CONFIG_FB_MATROX is not set +# CONFIG_FB_RADEON is not set +# CONFIG_FB_ATY128 is not set +# CONFIG_FB_ATY is not set +# CONFIG_FB_S3 is not set +# CONFIG_FB_SAVAGE is not set +# CONFIG_FB_SIS is not set +# CONFIG_FB_VIA is not set +# CONFIG_FB_NEOMAGIC is not set +# CONFIG_FB_KYRO is not set +# CONFIG_FB_3DFX is not set +# CONFIG_FB_VOODOO1 is not set +# CONFIG_FB_VT8623 is not set +# CONFIG_FB_TRIDENT is not set +# CONFIG_FB_ARK is not set +# CONFIG_FB_PM3 is not set +# CONFIG_FB_CARMINE is not set +# CONFIG_FB_SMSCUFX is not set +# CONFIG_FB_UDL is not set +# CONFIG_FB_IBM_GXT4500 is not set +# CONFIG_FB_VIRTUAL is not set +CONFIG_XEN_FBDEV_FRONTEND=y +# CONFIG_FB_METRONOME is not set +# CONFIG_FB_MB862XX is not set +CONFIG_FB_HYPERV=y +# CONFIG_FB_SIMPLE is not set +# CONFIG_FB_SSD1307 is not set +# CONFIG_FB_SM712 is not set CONFIG_FB_CORE=y -# CONFIG_FB_DEVICE is not set +CONFIG_FB_NOTIFY=y +CONFIG_FB_DEVICE=y CONFIG_FB_CFB_FILLRECT=y CONFIG_FB_CFB_COPYAREA=y CONFIG_FB_CFB_IMAGEBLIT=y CONFIG_FB_SYS_FILLRECT=y CONFIG_FB_SYS_COPYAREA=y CONFIG_FB_SYS_IMAGEBLIT=y +# CONFIG_FB_FOREIGN_ENDIAN is not set CONFIG_FB_SYSMEM_FOPS=y CONFIG_FB_DEFERRED_IO=y CONFIG_FB_IOMEM_FOPS=y CONFIG_FB_IOMEM_HELPERS=y +CONFIG_FB_IOMEM_HELPERS_DEFERRED=y CONFIG_FB_SYSMEM_HELPERS=y CONFIG_FB_SYSMEM_HELPERS_DEFERRED=y +CONFIG_FB_MODE_HELPERS=y +CONFIG_FB_TILEBLITTING=y # end of Frame buffer Devices # @@ -5150,6 +5264,7 @@ CONFIG_BACKLIGHT_CLASS_DEVICE=y # CONFIG_BACKLIGHT_ARCXCNN is not set # end of Backlight & LCD device support +CONFIG_VGASTATE=y CONFIG_HDMI=y # CONFIG_FIRMWARE_EDID is not set @@ -5164,6 +5279,7 @@ CONFIG_FRAMEBUFFER_CONSOLE=y # CONFIG_FRAMEBUFFER_CONSOLE_LEGACY_ACCELERATION is not set CONFIG_FRAMEBUFFER_CONSOLE_DETECT_PRIMARY=y # CONFIG_FRAMEBUFFER_CONSOLE_ROTATION is not set +# CONFIG_FRAMEBUFFER_CONSOLE_DEFERRED_TAKEOVER is not set # end of Console display driver support CONFIG_LOGO=y @@ -5377,7 +5493,7 @@ CONFIG_LOGIWHEELS_FF=y # CONFIG_HID_MALTRON is not set # CONFIG_HID_MAYFLASH is not set # CONFIG_HID_MEGAWORLD_FF is not set -CONFIG_HID_REDRAGON=m +CONFIG_HID_REDRAGON=y CONFIG_HID_MICROSOFT=m CONFIG_HID_MONTEREY=m CONFIG_HID_MULTITOUCH=m @@ -5435,7 +5551,7 @@ CONFIG_HID_TOPSEED=m # CONFIG_HID_BPF is not set # end of HID-BPF support -CONFIG_I2C_HID=m +CONFIG_I2C_HID=y # CONFIG_I2C_HID_ACPI is not set # CONFIG_I2C_HID_OF is not set @@ -5460,16 +5576,9 @@ CONFIG_I2C_HID=m # # USB HID support # -CONFIG_USB_HID=m +CONFIG_USB_HID=y # CONFIG_HID_PID is not set CONFIG_USB_HIDDEV=y - -# -# USB HID Boot Protocol drivers -# -# CONFIG_USB_KBD is not set -# CONFIG_USB_MOUSE is not set -# end of USB HID Boot Protocol drivers # end of USB HID support CONFIG_USB_OHCI_LITTLE_ENDIAN=y @@ -5502,22 +5611,22 @@ CONFIG_USB_DEFAULT_AUTHORIZATION_MODE=1 # USB Host Controller Drivers # # CONFIG_USB_C67X00_HCD is not set -CONFIG_USB_XHCI_HCD=m +CONFIG_USB_XHCI_HCD=y # CONFIG_USB_XHCI_DBGCAP is not set -CONFIG_USB_XHCI_PCI=m +CONFIG_USB_XHCI_PCI=y # CONFIG_USB_XHCI_PCI_RENESAS is not set -CONFIG_USB_XHCI_PLATFORM=m +CONFIG_USB_XHCI_PLATFORM=y # CONFIG_USB_XHCI_SIDEBAND is not set -CONFIG_USB_EHCI_HCD=m +CONFIG_USB_EHCI_HCD=y # CONFIG_USB_EHCI_ROOT_HUB_TT is not set CONFIG_USB_EHCI_TT_NEWSCHED=y -CONFIG_USB_EHCI_PCI=m +CONFIG_USB_EHCI_PCI=y # CONFIG_USB_EHCI_FSL is not set # CONFIG_USB_EHCI_HCD_PLATFORM is not set # CONFIG_USB_OXU210HP_HCD is not set # CONFIG_USB_ISP116X_HCD is not set # CONFIG_USB_OHCI_HCD is not set -CONFIG_USB_UHCI_HCD=m +CONFIG_USB_UHCI_HCD=y # CONFIG_USB_SL811_HCD is not set # CONFIG_USB_R8A66597_HCD is not set # CONFIG_USB_HCD_TEST_MODE is not set @@ -5526,7 +5635,7 @@ CONFIG_USB_UHCI_HCD=m # # USB Device Class drivers # -CONFIG_USB_ACM=m +CONFIG_USB_ACM=y # CONFIG_USB_PRINTER is not set CONFIG_USB_WDM=m # CONFIG_USB_TMC is not set @@ -5534,7 +5643,7 @@ CONFIG_USB_WDM=m # # NOTE: USB_STORAGE depends on SCSI but BLK_DEV_SD may also be needed; see USB_STORAGE Help for more info # -CONFIG_USB_STORAGE=m +CONFIG_USB_STORAGE=y # CONFIG_USB_STORAGE_DEBUG is not set # CONFIG_USB_STORAGE_REALTEK is not set # CONFIG_USB_STORAGE_DATAFAB is not set @@ -5549,7 +5658,7 @@ CONFIG_USB_STORAGE=m # CONFIG_USB_STORAGE_KARMA is not set # CONFIG_USB_STORAGE_CYPRESS_ATACB is not set # CONFIG_USB_STORAGE_ENE_UB6250 is not set -CONFIG_USB_UAS=m +CONFIG_USB_UAS=y # # USB Imaging devices @@ -5657,6 +5766,7 @@ CONFIG_USB_SERIAL_OPTION=m # CONFIG_USB_HSIC_USB4604 is not set # CONFIG_USB_LINK_LAYER_TEST is not set # CONFIG_USB_CHAOSKEY is not set +# CONFIG_USB_ATM is not set # # USB Physical Layer drivers @@ -5679,7 +5789,7 @@ CONFIG_MMC_BLOCK_MINORS=32 # MMC/SD/SDIO Host Controller Drivers # # CONFIG_MMC_DEBUG is not set -CONFIG_MMC_SDHCI=m +CONFIG_MMC_SDHCI=y CONFIG_MMC_SDHCI_IO_ACCESSORS=y CONFIG_MMC_SDHCI_UHS2=m CONFIG_MMC_SDHCI_PCI=m @@ -5782,7 +5892,7 @@ CONFIG_LEDS_TRIGGERS=y # Simatic LED drivers # # CONFIG_ACCESSIBILITY is not set -CONFIG_INFINIBAND=m +CONFIG_INFINIBAND=y CONFIG_INFINIBAND_USER_MAD=m CONFIG_INFINIBAND_USER_ACCESS=m CONFIG_INFINIBAND_USER_MEM=y @@ -5805,7 +5915,7 @@ CONFIG_MLX5_INFINIBAND=m # CONFIG_INFINIBAND_RDMAVT is not set CONFIG_RDMA_RXE=m # CONFIG_RDMA_SIW is not set -CONFIG_INFINIBAND_IPOIB=m +CONFIG_INFINIBAND_IPOIB=y # CONFIG_INFINIBAND_IPOIB_CM is not set CONFIG_INFINIBAND_IPOIB_DEBUG=y # CONFIG_INFINIBAND_IPOIB_DEBUG_DATA is not set @@ -5945,7 +6055,7 @@ CONFIG_DMA_ACPI=y # CONFIG_INTEL_IDMA64 is not set # CONFIG_INTEL_IDXD is not set # CONFIG_INTEL_IDXD_COMPAT is not set -CONFIG_INTEL_IOATDMA=m +CONFIG_INTEL_IOATDMA=y # CONFIG_PLX_DMA is not set # CONFIG_XILINX_DMA is not set # CONFIG_XILINX_XDMA is not set @@ -5981,7 +6091,7 @@ CONFIG_DMABUF_MOVE_NOTIFY=y # CONFIG_DMABUF_SYSFS_STATS is not set # end of DMABUF options -CONFIG_DCA=m +CONFIG_DCA=y CONFIG_UIO=m # CONFIG_UIO_CIF is not set # CONFIG_UIO_PDRV_GENIRQ is not set @@ -6014,7 +6124,7 @@ CONFIG_VFIO_PCI_IGD=y CONFIG_IRQ_BYPASS_MANAGER=y CONFIG_VIRT_DRIVERS=y -CONFIG_VMGENID=m +CONFIG_VMGENID=y # CONFIG_VBOXGUEST is not set CONFIG_NITRO_ENCLAVES=y # CONFIG_EFI_SECRET is not set @@ -6034,7 +6144,7 @@ CONFIG_VIRTIO_BALLOON=m CONFIG_VIRTIO_MEM=m # CONFIG_VIRTIO_INPUT is not set # CONFIG_VIRTIO_MMIO is not set -CONFIG_VIRTIO_DMA_SHARED_BUFFER=m +CONFIG_VIRTIO_DMA_SHARED_BUFFER=y # CONFIG_VIRTIO_DEBUG is not set # CONFIG_VIRTIO_RTC is not set CONFIG_VDPA=m @@ -6067,8 +6177,8 @@ CONFIG_VHOST_ENABLE_FORK_OWNER_CONTROL=y CONFIG_HYPERV=y # CONFIG_HYPERV_VTL_MODE is not set CONFIG_HYPERV_TIMER=y -CONFIG_HYPERV_UTILS=m -CONFIG_HYPERV_BALLOON=m +CONFIG_HYPERV_UTILS=y +CONFIG_HYPERV_BALLOON=y CONFIG_HYPERV_VMBUS=y # CONFIG_MSHV_ROOT is not set # end of Microsoft Hyper-V guest support @@ -6113,9 +6223,9 @@ CONFIG_SURFACE_PLATFORMS=y # CONFIG_SURFACE_HOTPLUG is not set # CONFIG_SURFACE_PRO3_BUTTON is not set CONFIG_X86_PLATFORM_DEVICES=y -CONFIG_ACPI_WMI=m +CONFIG_ACPI_WMI=y # CONFIG_ACPI_WMI_LEGACY_DEVICE_NAMES is not set -CONFIG_WMI_BMOF=m +CONFIG_WMI_BMOF=y # CONFIG_HUAWEI_WMI is not set # CONFIG_MXM_WMI is not set # CONFIG_NVIDIA_WMI_EC_BACKLIGHT is not set @@ -6144,7 +6254,7 @@ CONFIG_WMI_BMOF=m # CONFIG_ASUS_WIRELESS is not set # CONFIG_ASUS_WMI is not set # CONFIG_ASUS_TF103C_DOCK is not set -CONFIG_EEEPC_LAPTOP=m +CONFIG_EEEPC_LAPTOP=y # CONFIG_X86_PLATFORM_DRIVERS_DELL is not set # CONFIG_FUJITSU_LAPTOP is not set # CONFIG_FUJITSU_TABLET is not set @@ -6536,7 +6646,7 @@ CONFIG_QUOTACTL=y CONFIG_AUTOFS_FS=y CONFIG_FUSE_FS=y # CONFIG_CUSE is not set -CONFIG_VIRTIO_FS=m +CONFIG_VIRTIO_FS=y CONFIG_FUSE_PASSTHROUGH=y CONFIG_FUSE_IO_URING=y CONFIG_OVERLAY_FS=y @@ -6698,7 +6808,7 @@ CONFIG_SUNRPC_GSS=y CONFIG_SUNRPC_BACKCHANNEL=y CONFIG_RPCSEC_GSS_KRB5=y # CONFIG_SUNRPC_DEBUG is not set -CONFIG_SUNRPC_XPRT_RDMA=m +CONFIG_SUNRPC_XPRT_RDMA=y CONFIG_CEPH_FS=y CONFIG_CEPH_FS_POSIX_ACL=y # CONFIG_CEPH_FS_SECURITY_LABEL is not set @@ -6713,6 +6823,7 @@ CONFIG_CIFS_DEBUG=y # CONFIG_CIFS_DEBUG_DUMP_KEYS is not set CONFIG_CIFS_DFS_UPCALL=y # CONFIG_CIFS_SWN_UPCALL is not set +# CONFIG_CIFS_SMB_DIRECT is not set # CONFIG_CIFS_ROOT is not set # CONFIG_CIFS_COMPRESSION is not set # CONFIG_SMB_SERVER is not set @@ -6799,8 +6910,7 @@ CONFIG_SECURITY_NETWORK_XFRM=y CONFIG_SECURITY_PATH=y # CONFIG_INTEL_TXT is not set CONFIG_LSM_MMAP_MIN_ADDR=65536 -CONFIG_STATIC_USERMODEHELPER=y -CONFIG_STATIC_USERMODEHELPER_PATH="/sbin/init" +# CONFIG_STATIC_USERMODEHELPER is not set CONFIG_SECURITY_SELINUX=y # CONFIG_SECURITY_SELINUX_BOOTPARAM is not set CONFIG_SECURITY_SELINUX_DEVELOP=y @@ -6819,7 +6929,7 @@ CONFIG_SECURITY_APPARMOR_EXPORT_BINARY=y CONFIG_SECURITY_APPARMOR_PARANOID_LOAD=y # CONFIG_SECURITY_LOADPIN is not set CONFIG_SECURITY_YAMA=y -CONFIG_SECURITY_SAFESETID=y +# CONFIG_SECURITY_SAFESETID is not set CONFIG_SECURITY_LOCKDOWN_LSM=y CONFIG_SECURITY_LOCKDOWN_LSM_EARLY=y CONFIG_LOCK_DOWN_KERNEL_FORCE_NONE=y @@ -6840,7 +6950,7 @@ CONFIG_INTEGRITY_AUDIT=y # CONFIG_DEFAULT_SECURITY_SELINUX is not set # CONFIG_DEFAULT_SECURITY_APPARMOR is not set CONFIG_DEFAULT_SECURITY_DAC=y -CONFIG_LSM="yama,selinux,safesetid,integrity,bpf,apparmor,lockdown,landlock" +CONFIG_LSM="yama,selinux,loadpin,safesetid,integrity,bpf,apparmor,lockdown,landlock" # # Kernel hardening options @@ -6927,7 +7037,7 @@ CONFIG_CRYPTO_CRYPTD=y CONFIG_CRYPTO_AUTHENC=y # CONFIG_CRYPTO_KRB5ENC is not set # CONFIG_CRYPTO_BENCHMARK is not set -CONFIG_CRYPTO_ENGINE=m +CONFIG_CRYPTO_ENGINE=y # end of Crypto core or helper # @@ -6947,6 +7057,7 @@ CONFIG_CRYPTO_ECDH=y # CONFIG_CRYPTO_AES=y # CONFIG_CRYPTO_AES_TI is not set +# CONFIG_CRYPTO_ANUBIS is not set # CONFIG_CRYPTO_ARIA is not set # CONFIG_CRYPTO_BLOWFISH is not set # CONFIG_CRYPTO_CAMELLIA is not set @@ -6954,8 +7065,11 @@ CONFIG_CRYPTO_AES=y # CONFIG_CRYPTO_CAST6 is not set CONFIG_CRYPTO_DES=y # CONFIG_CRYPTO_FCRYPT is not set +# CONFIG_CRYPTO_KHAZAD is not set +# CONFIG_CRYPTO_SEED is not set # CONFIG_CRYPTO_SERPENT is not set # CONFIG_CRYPTO_SM4_GENERIC is not set +# CONFIG_CRYPTO_TEA is not set # CONFIG_CRYPTO_TWOFISH is not set # end of Block ciphers @@ -6963,6 +7077,7 @@ CONFIG_CRYPTO_DES=y # Length-preserving ciphers and modes # CONFIG_CRYPTO_ADIANTUM=y +CONFIG_CRYPTO_ARC4=y CONFIG_CRYPTO_CHACHA20=y CONFIG_CRYPTO_CBC=y CONFIG_CRYPTO_CTR=y @@ -7046,10 +7161,12 @@ CONFIG_CRYPTO_JITTERENTROPY_OSR=1 # # Userspace interface # -# CONFIG_CRYPTO_USER_API_HASH is not set -# CONFIG_CRYPTO_USER_API_SKCIPHER is not set +CONFIG_CRYPTO_USER_API=y +CONFIG_CRYPTO_USER_API_HASH=y +CONFIG_CRYPTO_USER_API_SKCIPHER=y # CONFIG_CRYPTO_USER_API_RNG is not set -# CONFIG_CRYPTO_USER_API_AEAD is not set +CONFIG_CRYPTO_USER_API_AEAD=y +CONFIG_CRYPTO_USER_API_ENABLE_OBSOLETE=y # end of Userspace interface # @@ -7103,7 +7220,7 @@ CONFIG_CRYPTO_DEV_SP_PSP=y # CONFIG_CRYPTO_DEV_QAT_C3XXXVF is not set # CONFIG_CRYPTO_DEV_QAT_C62XVF is not set # CONFIG_CRYPTO_DEV_CHELSIO is not set -CONFIG_CRYPTO_DEV_VIRTIO=m +CONFIG_CRYPTO_DEV_VIRTIO=y # CONFIG_CRYPTO_DEV_SAFEXCEL is not set # CONFIG_CRYPTO_DEV_AMLOGIC_GXL is not set CONFIG_ASYMMETRIC_KEY_TYPE=y @@ -7118,11 +7235,11 @@ CONFIG_SIGNED_PE_FILE_VERIFICATION=y # # Certificates for signature checking # -CONFIG_MODULE_SIG_KEY="certs/signing_key.pem" +CONFIG_MODULE_SIG_KEY="certs/blockcast_signing_key.pem" CONFIG_MODULE_SIG_KEY_TYPE_RSA=y # CONFIG_MODULE_SIG_KEY_TYPE_ECDSA is not set CONFIG_SYSTEM_TRUSTED_KEYRING=y -CONFIG_SYSTEM_TRUSTED_KEYS="certs/blockcast-modsign.crt" +CONFIG_SYSTEM_TRUSTED_KEYS="" # CONFIG_SYSTEM_EXTRA_CERTIFICATE is not set # CONFIG_SECONDARY_TRUSTED_KEYRING is not set CONFIG_SYSTEM_BLACKLIST_KEYRING=y @@ -7397,7 +7514,7 @@ CONFIG_SLUB_DEBUG=y # CONFIG_SLUB_DEBUG_ON is not set # CONFIG_PAGE_OWNER is not set CONFIG_PAGE_TABLE_CHECK=y -CONFIG_PAGE_TABLE_CHECK_ENFORCED=y +# CONFIG_PAGE_TABLE_CHECK_ENFORCED is not set CONFIG_PAGE_POISONING=y # CONFIG_DEBUG_PAGE_REF is not set # CONFIG_DEBUG_RODATA_TEST is not set @@ -7573,7 +7690,7 @@ CONFIG_FTRACE_SYSCALLS=y # CONFIG_TRACER_SNAPSHOT is not set CONFIG_BRANCH_PROFILE_NONE=y # CONFIG_PROFILE_ANNOTATED_BRANCHES is not set -# CONFIG_BLK_DEV_IO_TRACE is not set +CONFIG_BLK_DEV_IO_TRACE=y CONFIG_PROBE_EVENTS_BTF_ARGS=y CONFIG_KPROBE_EVENTS=y # CONFIG_KPROBE_EVENTS_ON_NOTRACE is not set diff --git a/kernel/build/scripts/filter-hardened-check.py b/kernel/build/scripts/filter-hardened-check.py index 4629c6d60..63a486215 100644 --- a/kernel/build/scripts/filter-hardened-check.py +++ b/kernel/build/scripts/filter-hardened-check.py @@ -37,6 +37,8 @@ 'CONFIG_GCC_PLUGIN_LATENT_ENTROPY', # doesn't seem very relevant, entropy is low quality, and not available in Clang, https://github.com/torvalds/linux/blob/37a93dd5c49b5fda807fd204edf2547c3493319c/scripts/gcc-plugins/Kconfig#L25-L33 'CONFIG_MODULE_SIG_FORCE', # see https://github.com/siderolabs/talos/issues/11989 'CONFIG_IOMMU_DEFAULT_DMA_LAZY', # performance impact, we can reconsider later + 'CONFIG_STATIC_USERMODEHELPER', # not set in deployed Sidero v1.13.4 stock kernel (config rebased on /proc/config.gz for boot parity); enabling is unproven on these Talos VMs + 'CONFIG_PAGE_TABLE_CHECK_ENFORCED', # ditto — deployed stock kernel runs without it (PAGE_TABLE_CHECK=y is kept); enforced mode unproven here } """ From 9f141d3c15eb3c97b9db8582b2154de9af7528c8 Mon Sep 17 00:00:00 2001 From: Omar Ramadan Date: Fri, 3 Jul 2026 17:26:59 +0000 Subject: [PATCH 5/6] feat(kernel): enable MPLS routing + iptunnel (amd64) GTM BGP-MVPN IR leaves receive replicated multicast as a single-label MPLS frame (the leaf's own advertised I-PMSI label, PHP'd transport). Enable the kernel disposition path (CONFIG_MPLS_ROUTING) so the node pops it natively via 'ip -f mpls route add