kconfig-hardened-check.git
2 years agoRequire GCC for the GCC plugins (part II)
Alexander Popov [Sat, 20 Aug 2022 10:07:31 +0000 (13:07 +0300)]
Require GCC for the GCC plugins (part II)

The current result on arm64_full_hardened_5.17_clang.config (clang 12):

[+] Special report mode: show_fail
[+] Kconfig file to check: my/arm64_full_hardened_5.17_clang.config
[+] Detected architecture: ARM64
[+] Detected kernel version: 5.17
=========================================================================================================================
              option name               | type  |desired val | decision |      reason      | check result
=========================================================================================================================
CONFIG_GCC_PLUGINS                      |kconfig|     y      |defconfig | self_protection  | FAIL: CONFIG_CC_IS_GCC not "y"
CONFIG_STACKPROTECTOR_PER_TASK          |kconfig|     y      |defconfig | self_protection  | FAIL: not found
CONFIG_FORTIFY_SOURCE                   |kconfig|     y      |   kspp   | self_protection  | FAIL: not found
CONFIG_GCC_PLUGIN_LATENT_ENTROPY        |kconfig|     y      |   kspp   | self_protection  | FAIL: CONFIG_CC_IS_GCC not "y"
CONFIG_ZERO_CALL_USED_REGS              |kconfig|     y      |   kspp   | self_protection  | FAIL: not found
CONFIG_GCC_PLUGIN_RANDSTRUCT            |kconfig|     y      |   kspp   | self_protection  | FAIL: CONFIG_CC_IS_GCC not "y"
CONFIG_GCC_PLUGIN_STACKLEAK             |kconfig|     y      |   kspp   | self_protection  | FAIL: CONFIG_CC_IS_GCC not "y"
CONFIG_GCC_PLUGIN_RANDSTRUCT_PERFORMANCE|kconfig| is not set |  clipos  | self_protection  | FAIL: CONFIG_CC_IS_GCC not "y"
CONFIG_STACKLEAK_METRICS                |kconfig| is not set |  clipos  | self_protection  | FAIL: CONFIG_CC_IS_GCC not "y"
CONFIG_STACKLEAK_RUNTIME_DISABLE        |kconfig| is not set |  clipos  | self_protection  | FAIL: CONFIG_CC_IS_GCC not "y"

CONFIG_STACKPROTECTOR_PER_TASK, CONFIG_FORTIFY_SOURCE and CONFIG_ZERO_CALL_USED_REGS
will be supported for clang in future (WIP).

2 years agoRequire GCC for the GCC plugins
Alexander Popov [Sat, 20 Aug 2022 09:43:05 +0000 (12:43 +0300)]
Require GCC for the GCC plugins

2 years agoIntroduce cc_is_gcc and cc_is_clang
Alexander Popov [Sat, 20 Aug 2022 09:28:33 +0000 (12:28 +0300)]
Introduce cc_is_gcc and cc_is_clang

Use empty decision and reason for such kind of checks

2 years agoNo, the 'page_alloc.shuffle' should be set anyway
Alexander Popov [Sat, 20 Aug 2022 08:52:46 +0000 (11:52 +0300)]
No, the 'page_alloc.shuffle' should be set anyway

2 years agoDrop the comment about slub_debug=FZ
Alexander Popov [Sat, 20 Aug 2022 08:42:50 +0000 (11:42 +0300)]
Drop the comment about slub_debug=FZ

These are very slow debugging features

2 years agoAdd the debugfs check
Alexander Popov [Wed, 17 Aug 2022 06:33:00 +0000 (09:33 +0300)]
Add the debugfs check

Don't normalize this option value since the Linux kernel
doesn't use kstrtobool() for it.

2 years agoImprove the comments
Alexander Popov [Wed, 17 Aug 2022 06:11:42 +0000 (09:11 +0300)]
Improve the comments

2 years agoAdd the 'page_alloc.shuffle' check
Alexander Popov [Wed, 17 Aug 2022 05:40:44 +0000 (08:40 +0300)]
Add the 'page_alloc.shuffle' check

2 years agoAdd more values for the normalization
Alexander Popov [Sun, 14 Aug 2022 23:53:26 +0000 (02:53 +0300)]
Add more values for the normalization

2 years agoImplement the normalization of cmdline options
Alexander Popov [Sun, 14 Aug 2022 22:26:32 +0000 (01:26 +0300)]
Implement the normalization of cmdline options

2 years agoDescribe the meaning of the checks
Alexander Popov [Sun, 14 Aug 2022 11:02:22 +0000 (14:02 +0300)]
Describe the meaning of the checks

Don't add CmdlineChecks in add_kconfig_checks() to avoid wrong results
when the tool doesn't check the cmdline.

A common pattern for checking the 'param_x' cmdline parameter
that __overrides__ the 'PARAM_X_DEFAULT' kconfig option:
  l += [OR(CmdlineCheck(reason, decision, 'param_x', '1'),
           AND(KconfigCheck(reason, decision, 'PARAM_X_DEFAULT_ON', 'y'),
               CmdlineCheck(reason, decision, 'param_x, 'is not set')))]

Here we don't check the kconfig options or minimal kernel version
required for the cmdline parameters. That would make the checks
very complex and not give a 100% guarantee anyway.

2 years agoCheck the 'rodata' cmdline parameter on the arches except ARM64
Alexander Popov [Sat, 13 Aug 2022 23:16:18 +0000 (02:16 +0300)]
Check the 'rodata' cmdline parameter on the arches except ARM64

2 years agoCheck hardened_usercopy in the cmdline
Alexander Popov [Sat, 13 Aug 2022 19:58:05 +0000 (22:58 +0300)]
Check hardened_usercopy in the cmdline

2 years agoAdd the comment about vm.mmap_min_addr sysctl (for future reference)
Alexander Popov [Sat, 13 Aug 2022 19:50:00 +0000 (22:50 +0300)]
Add the comment about vm.mmap_min_addr sysctl (for future reference)

2 years agoSECURITY_DMESG_RESTRICT is more about cutting attack surface
Alexander Popov [Sat, 13 Aug 2022 19:31:15 +0000 (22:31 +0300)]
SECURITY_DMESG_RESTRICT is more about cutting attack surface

2 years agoImprove the slab_common.usercopy_fallback check
Alexander Popov [Thu, 21 Jul 2022 19:26:41 +0000 (22:26 +0300)]
Improve the slab_common.usercopy_fallback check

Having HARDENED_USERCOPY_FALLBACK disabled is not enough.

2 years agoAdd the slab_common.usercopy_fallback check
Alexander Popov [Thu, 21 Jul 2022 19:00:36 +0000 (22:00 +0300)]
Add the slab_common.usercopy_fallback check

2 years agoImprove the STACKPROTECTOR check
Alexander Popov [Thu, 21 Jul 2022 10:09:50 +0000 (13:09 +0300)]
Improve the STACKPROTECTOR check

The Linux kernel 4.16-4.17 has a weird STACKPROTECTOR configuration:
CC_STACKPROTECTOR_NONE -- stackprotector is disabled;
CC_STACKPROTECTOR_REGULAR -- similar to current STACKPROTECTOR;
CC_STACKPROTECTOR_STRONG -- similar to current STACKPROTECTOR_STRONG;
CC_STACKPROTECTOR_AUTO -- the best stack-protector that compiler provides.
These options are mutually exclusive.

Let's improve the STACKPROTECTOR check:
- Add CC_STACKPROTECTOR_REGULAR as a valid alternative name of this option;
- Add CC_STACKPROTECTOR_STRONG to avoid false negative result;
- Add CC_STACKPROTECTOR_AUTO hoping that it enables at least STACKPROTECTOR.

The STACKPROTECTOR_STRONG check still requires explicit configuration, not
CC_STACKPROTECTOR_AUTO.

Thanks to @izh1979 for the idea

2 years agoDon't mention LKDTM
Alexander Popov [Thu, 21 Jul 2022 06:27:47 +0000 (09:27 +0300)]
Don't mention LKDTM

I can't recommend disabling it, because LKDTM is used to test the kernel
hardening features.

But I cant recommend enabling it, because LKDTM contains intentional
memory corruption errors. It's not for production systems.

So let's simply drop the comment about LKDTM.

2 years agoAdd info about the LKDDb project by @cateee
Alexander Popov [Sun, 17 Jul 2022 15:20:52 +0000 (18:20 +0300)]
Add info about the LKDDb project by @cateee

#68

2 years agoCheck ARM64_BTI for userspace hardening
Alexander Popov [Sun, 17 Jul 2022 14:57:19 +0000 (17:57 +0300)]
Check ARM64_BTI for userspace hardening

2 years agoCheck ARM64_PTR_AUTH for userspace hardening
Alexander Popov [Sun, 17 Jul 2022 14:52:56 +0000 (17:52 +0300)]
Check ARM64_PTR_AUTH for userspace hardening

2 years agoAdd rodata check for ARM64
Alexander Popov [Sun, 17 Jul 2022 11:03:33 +0000 (14:03 +0300)]
Add rodata check for ARM64

2 years agoAdd iommu.passthrough check
Alexander Popov [Mon, 11 Jul 2022 06:59:26 +0000 (09:59 +0300)]
Add iommu.passthrough check

2 years agoAdd IOMMU_DEFAULT_PASSTHROUGH check
Alexander Popov [Mon, 11 Jul 2022 06:49:44 +0000 (09:49 +0300)]
Add IOMMU_DEFAULT_PASSTHROUGH check

2 years agoAdd iommu.strict check
Alexander Popov [Mon, 11 Jul 2022 06:25:07 +0000 (09:25 +0300)]
Add iommu.strict check

2 years agoAdd vsyscall check
Alexander Popov [Mon, 11 Jul 2022 05:59:37 +0000 (08:59 +0300)]
Add vsyscall check

2 years agoDon't add CmdlineChecks in add_kconfig_checks() to avoid wrong results
Alexander Popov [Sat, 9 Jul 2022 22:16:03 +0000 (01:16 +0300)]
Don't add CmdlineChecks in add_kconfig_checks() to avoid wrong results

2 years agoAdd slub_debug check
Alexander Popov [Sat, 9 Jul 2022 22:15:21 +0000 (01:15 +0300)]
Add slub_debug check

2 years agoAdd the release badge
Alexander Popov [Fri, 8 Jul 2022 23:48:40 +0000 (02:48 +0300)]
Add the release badge

2 years agoAdd the init_on_free check
Alexander Popov [Mon, 20 Jun 2022 18:08:25 +0000 (21:08 +0300)]
Add the init_on_free check

2 years agoAdd the page_poison check required for PAGE_POISONING_ZERO
Alexander Popov [Mon, 20 Jun 2022 18:01:15 +0000 (21:01 +0300)]
Add the page_poison check required for PAGE_POISONING_ZERO

2 years agoRewrite the slab_nomerge check
Alexander Popov [Mon, 20 Jun 2022 17:33:18 +0000 (20:33 +0300)]
Rewrite the slab_nomerge check

Use the presence check for slab_nomerge.
Also check that slab_merge is not set.

2 years agoRewrite the randomize_kstack_offset check
Alexander Popov [Mon, 20 Jun 2022 17:13:50 +0000 (20:13 +0300)]
Rewrite the randomize_kstack_offset check

Reusing "is not set" for CmdlineCheck is a nice hack.

2 years agoCheck that a kconfig option value is sane
Alexander Popov [Sun, 19 Jun 2022 20:45:41 +0000 (23:45 +0300)]
Check that a kconfig option value is sane

2 years agoAdd a tricky check for init_on_alloc and INIT_ON_ALLOC_DEFAULT_ON
Alexander Popov [Sun, 19 Jun 2022 19:49:03 +0000 (22:49 +0300)]
Add a tricky check for init_on_alloc and INIT_ON_ALLOC_DEFAULT_ON

Nice!

2 years agoMove the add_cmdline_checks() call earlier
Alexander Popov [Sun, 19 Jun 2022 19:38:23 +0000 (22:38 +0300)]
Move the add_cmdline_checks() call earlier

populate_with_data() must be called after all checks have been added.

2 years agoDon't check __name__ in __init__.py (it can't run separately anyway)
Alexander Popov [Wed, 8 Jun 2022 22:54:42 +0000 (01:54 +0300)]
Don't check __name__ in __init__.py (it can't run separately anyway)

2 years agoFix the pylint warning about isinstance
Alexander Popov [Wed, 8 Jun 2022 22:47:07 +0000 (01:47 +0300)]
Fix the pylint warning about isinstance

2 years agoDrop unneeded properties of ComplexOptCheck
Alexander Popov [Wed, 8 Jun 2022 22:32:59 +0000 (01:32 +0300)]
Drop unneeded properties of ComplexOptCheck

Thanks to the coverage info

2 years agoTurn some error conditions into assertions (part 4)
Alexander Popov [Wed, 8 Jun 2022 22:03:19 +0000 (01:03 +0300)]
Turn some error conditions into assertions (part 4)

2 years agoTurn some error conditions into assertions (part 3)
Alexander Popov [Wed, 8 Jun 2022 21:54:00 +0000 (00:54 +0300)]
Turn some error conditions into assertions (part 3)

2 years agoTurn some error conditions into assertions (part 2)
Alexander Popov [Wed, 8 Jun 2022 21:24:36 +0000 (00:24 +0300)]
Turn some error conditions into assertions (part 2)

2 years agoTurn some error conditions into assertions (part 1)
Alexander Popov [Wed, 8 Jun 2022 21:04:15 +0000 (00:04 +0300)]
Turn some error conditions into assertions (part 1)

2 years agoDrop useless checks, the ComplexOptCheck constructor has already checked this
Alexander Popov [Wed, 8 Jun 2022 17:13:42 +0000 (20:13 +0300)]
Drop useless checks, the ComplexOptCheck constructor has already checked this

2 years agogithub actions: Test error handling (part 2)
Alexander Popov [Wed, 8 Jun 2022 16:37:15 +0000 (19:37 +0300)]
github actions: Test error handling (part 2)

And also test the tool without "-l".

2 years agogithub actions: Test error handling (part 1)
Alexander Popov [Wed, 8 Jun 2022 15:17:39 +0000 (18:17 +0300)]
github actions: Test error handling (part 1)

2 years agogithub actions: Collect coverage for error handling (part 1)
Alexander Popov [Mon, 30 May 2022 22:30:42 +0000 (01:30 +0300)]
github actions: Collect coverage for error handling (part 1)

2 years agogithub actions: upgrade to codecov-action@v2
Alexander Popov [Mon, 30 May 2022 22:43:25 +0000 (01:43 +0300)]
github actions: upgrade to codecov-action@v2

2 years agoCheck that --config and --print are not used together
Alexander Popov [Mon, 30 May 2022 21:41:09 +0000 (00:41 +0300)]
Check that --config and --print are not used together

2 years agogithub actions: Collect coverage for cmdline checking
Alexander Popov [Mon, 30 May 2022 21:07:18 +0000 (00:07 +0300)]
github actions: Collect coverage for cmdline checking

2 years agogithub actions: Improve the descriptions
Alexander Popov [Mon, 30 May 2022 16:28:30 +0000 (19:28 +0300)]
github actions: Improve the descriptions

2 years agogithub actions: Improve the test output
Alexander Popov [Mon, 30 May 2022 22:54:11 +0000 (01:54 +0300)]
github actions: Improve the test output

2 years agoDrop dash-separated values from setup.cfg
Alexander Popov [Mon, 30 May 2022 16:07:09 +0000 (19:07 +0300)]
Drop dash-separated values from setup.cfg

2 years agogithub actions: Add testing with python 3.9
Alexander Popov [Mon, 30 May 2022 16:04:33 +0000 (19:04 +0300)]
github actions: Add testing with python 3.9

2 years agoMerge branch 'cmdline'
Alexander Popov [Sat, 28 May 2022 19:03:53 +0000 (22:03 +0300)]
Merge branch 'cmdline'

This is the feature for #46.

2 years agoChange the example output in README cmdline
Alexander Popov [Sat, 28 May 2022 18:06:10 +0000 (21:06 +0300)]
Change the example output in README

2 years agoDescribe the cmdline checking support in README
Alexander Popov [Sat, 28 May 2022 17:58:57 +0000 (20:58 +0300)]
Describe the cmdline checking support in README

2 years agoAdd the example config of Fedora 34
Alexander Popov [Sat, 28 May 2022 17:48:28 +0000 (20:48 +0300)]
Add the example config of Fedora 34

2 years agoCheck the pti cmdline parameter
Alexander Popov [Sat, 28 May 2022 17:42:35 +0000 (20:42 +0300)]
Check the pti cmdline parameter

2 years agoCheck the slab_nomerge cmdline parameter
Alexander Popov [Sat, 28 May 2022 17:35:12 +0000 (20:35 +0300)]
Check the slab_nomerge cmdline parameter

2 years agoCheck the randomize_kstack_offset cmdline parameter
Alexander Popov [Thu, 31 Mar 2022 17:26:45 +0000 (20:26 +0300)]
Check the randomize_kstack_offset cmdline parameter

2 years agoAdd cmdline file parsing
Alexander Popov [Mon, 28 Mar 2022 09:17:31 +0000 (12:17 +0300)]
Add cmdline file parsing

2 years agoAdd the infrastructure for cmdline checks
Alexander Popov [Sun, 27 Mar 2022 20:46:11 +0000 (23:46 +0300)]
Add the infrastructure for cmdline checks

2 years agoAdd '--cmdline' argument for the tool
Alexander Popov [Sun, 27 Mar 2022 20:30:33 +0000 (23:30 +0300)]
Add '--cmdline' argument for the tool

2 years agoAdd cmdline checks to '--print'
Alexander Popov [Sun, 27 Mar 2022 20:03:02 +0000 (23:03 +0300)]
Add cmdline checks to '--print'

2 years agoAdd the CmdlineCheck class
Alexander Popov [Sun, 27 Mar 2022 18:25:04 +0000 (21:25 +0300)]
Add the CmdlineCheck class

2 years agoAdd the comment about sysrq_always_enabled
Alexander Popov [Sun, 15 May 2022 20:21:25 +0000 (23:21 +0300)]
Add the comment about sysrq_always_enabled

Thanks to @izh1979 for the idea (and for the rodata idea too).

2 years agoAdd the comment about rodata
Alexander Popov [Sun, 15 May 2022 18:45:09 +0000 (21:45 +0300)]
Add the comment about rodata

2 years agoUpdate direct feedback from Linux kernel maintainers (#62)
Alexander Popov [Sun, 8 May 2022 13:21:31 +0000 (16:21 +0300)]
Update direct feedback from Linux kernel maintainers (#62)

2 years agoAdd the comment about arm64.nomte
Alexander Popov [Fri, 6 May 2022 22:21:21 +0000 (01:21 +0300)]
Add the comment about arm64.nomte

Thanks to @izh1979 for the idea.

2 years agoAdd the comment about kernel.randomize_va_space
Alexander Popov [Fri, 6 May 2022 22:21:00 +0000 (01:21 +0300)]
Add the comment about kernel.randomize_va_space

Thanks to @izh1979 for the idea.

2 years agoAdd the KGDB check
Alexander Popov [Fri, 6 May 2022 15:28:44 +0000 (18:28 +0300)]
Add the KGDB check

Thanks to @izh1979 for the idea.

2 years agoAdd RANDOMIZE_MODULE_REGION_FULL for arm64
Alexander Popov [Fri, 6 May 2022 15:20:56 +0000 (18:20 +0300)]
Add RANDOMIZE_MODULE_REGION_FULL for arm64

Thanks to @izh1979 for the idea.

2 years agoUpdate the README v0.5.17
Alexander Popov [Thu, 28 Apr 2022 11:49:52 +0000 (14:49 +0300)]
Update the README

Ready for the release 0.5.17.

2 years agoMerge pull request #62 from evdenis/master
Alexander Popov [Thu, 28 Apr 2022 11:38:31 +0000 (14:38 +0300)]
Merge pull request #62 from evdenis/master

Add BLK_DEV_FD_RAWCMD

Thanks @evdenis!

2 years agoAdd the type property for OptCheck to fix a pylint error
Alexander Popov [Thu, 28 Apr 2022 11:31:00 +0000 (14:31 +0300)]
Add the type property for OptCheck to fix a pylint error

Fix for kconfig_hardened_check/__init__.py:125:68: E1101:
  Instance of 'OptCheck' has no 'type' member (no-member)

2 years agoAdd BLK_DEV_FD_RAWCMD 62/head
Denis Efremov [Wed, 27 Apr 2022 18:09:41 +0000 (21:09 +0300)]
Add BLK_DEV_FD_RAWCMD

See commit torvalds/linux@233087ca0636 ("floppy: disable FDRAWCMD by default")

Signed-off-by: Denis Efremov <efremov@linux.com>
2 years agoAdd the STACKPROTECTOR check from KSPP
Alexander Popov [Fri, 22 Apr 2022 10:13:05 +0000 (13:13 +0300)]
Add the STACKPROTECTOR check from KSPP

Thanks to @izh1979 for the idea.

2 years agoDrop the ARM64_MTE check for userspace hardening
Alexander Popov [Fri, 22 Apr 2022 09:50:34 +0000 (12:50 +0300)]
Drop the ARM64_MTE check for userspace hardening

It is moved to kernel self protection.

Thanks to @izh1979 for the idea.

2 years agoSeparate out checking SECURITY_WRITABLE_HOOKS and SECURITY_SELINUX_DISABLE
Alexander Popov [Fri, 22 Apr 2022 09:34:49 +0000 (12:34 +0300)]
Separate out checking SECURITY_WRITABLE_HOOKS and SECURITY_SELINUX_DISABLE

Thanks to @izh1979 for the idea.
Combining these checks with OR is not correct.

2 years agoFix the arch condition for the SCHED_CORE check
Alexander Popov [Fri, 22 Apr 2022 07:35:10 +0000 (10:35 +0300)]
Fix the arch condition for the SCHED_CORE check

2 years agoAdd the KSPP recommendation of ZERO_CALL_USED_REGS
Alexander Popov [Fri, 22 Apr 2022 07:23:23 +0000 (10:23 +0300)]
Add the KSPP recommendation of ZERO_CALL_USED_REGS

2 years agoDisabling X86_MSR is recommended by KSPP
Alexander Popov [Fri, 22 Apr 2022 07:23:04 +0000 (10:23 +0300)]
Disabling X86_MSR is recommended by KSPP

2 years agoFix the bug in the verdict description for ComplexOptCheck
Alexander Popov [Wed, 20 Apr 2022 16:25:16 +0000 (19:25 +0300)]
Fix the bug in the verdict description for ComplexOptCheck

Before the fix:
CONFIG_EFI_DISABLE_PCI_DMA | kconfig | y | clipos | self_protection | OK: not found

After the fix:
CONFIG_EFI_DISABLE_PCI_DMA | kconfig | y | clipos | self_protection | OK: CONFIG_EFI not found

Also added the assertions preventing similar bugs in future.

2 years agoAdditional check for TYPES_OF_CHECKS
Alexander Popov [Thu, 31 Mar 2022 16:38:25 +0000 (19:38 +0300)]
Additional check for TYPES_OF_CHECKS

2 years agoDrop PresenceCheck; OptCheck without 'expected' parameter can do the job
Alexander Popov [Mon, 28 Mar 2022 12:12:36 +0000 (15:12 +0300)]
Drop PresenceCheck; OptCheck without 'expected' parameter can do the job

2 years agoUpdate the KSPP recommendations in the config_files
Alexander Popov [Wed, 20 Apr 2022 14:59:38 +0000 (17:59 +0300)]
Update the KSPP recommendations in the config_files

2 years agoAdd the KSPP recommendation of SCHED_CORE
Alexander Popov [Wed, 20 Apr 2022 14:42:49 +0000 (17:42 +0300)]
Add the KSPP recommendation of SCHED_CORE

2 years agoAdd the KSPP recommendation of IOMMU_DEFAULT_DMA_STRICT
Alexander Popov [Wed, 20 Apr 2022 14:24:32 +0000 (17:24 +0300)]
Add the KSPP recommendation of IOMMU_DEFAULT_DMA_STRICT

2 years agoAdd the KSPP recommendation of WERROR
Alexander Popov [Wed, 20 Apr 2022 14:16:58 +0000 (17:16 +0300)]
Add the KSPP recommendation of WERROR

2 years agoAdd the KSPP recommendation of KFENCE
Alexander Popov [Wed, 20 Apr 2022 14:13:50 +0000 (17:13 +0300)]
Add the KSPP recommendation of KFENCE

2 years agoNo need in BPF_UNPRIV_DEFAULT_OFF if BPF_SYSCALL is disabled
Alexander Popov [Fri, 8 Apr 2022 21:05:38 +0000 (00:05 +0300)]
No need in BPF_UNPRIV_DEFAULT_OFF if BPF_SYSCALL is disabled

2 years agoMerge branch 'from-martin-rowe'
Alexander Popov [Fri, 8 Apr 2022 16:45:37 +0000 (19:45 +0300)]
Merge branch 'from-martin-rowe'

2 years agoAdd defconfigs for Linux v5.17
Alexander Popov [Thu, 7 Apr 2022 17:20:16 +0000 (20:20 +0300)]
Add defconfigs for Linux v5.17

2 years agoDrop unneeded return values (refactoring)
Alexander Popov [Mon, 28 Mar 2022 09:54:47 +0000 (12:54 +0300)]
Drop unneeded return values (refactoring)

2 years agoUBSAN_SANITIZE_ALL not available on ARM 60/head
Martin Rowe [Sat, 26 Mar 2022 14:20:16 +0000 (00:20 +1000)]
UBSAN_SANITIZE_ALL not available on ARM

ARCH_HAS_UBSAN_SANITIZE_ALL is not selected for arm arch, which
prevents selectiong of CONFIG_UBSAN_SANITIZE_ALL

https://github.com/torvalds/linux/blob/master/arch/arm/Kconfig
https://github.com/torvalds/linux/blob/master/lib/Kconfig.ubsan

2 years agoAdd HARDEN_BRANCH_HISTORY for arm
Alexander Popov [Sun, 20 Mar 2022 21:53:37 +0000 (00:53 +0300)]
Add HARDEN_BRANCH_HISTORY for arm

2 years agoAdd MITIGATE_SPECTRE_BRANCH_HISTORY for arm64
Alexander Popov [Sun, 20 Mar 2022 21:51:30 +0000 (00:51 +0300)]
Add MITIGATE_SPECTRE_BRANCH_HISTORY for arm64

2 years agoTHREAD_INFO_IN_TASK is available for ARM since v5.16
Alexander Popov [Fri, 18 Mar 2022 22:11:27 +0000 (01:11 +0300)]
THREAD_INFO_IN_TASK is available for ARM since v5.16