Commit Graph

62 Commits

Author SHA1 Message Date
Arne Fitzenreiter
09951f8b0f kernel: aarch64: enable pcie-brcmstb and brcm2711-thermal for RPi4
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2021-07-05 07:42:38 +02:00
Arne Fitzenreiter
663ab267ba kernel: update to 5.10.42
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2021-07-05 07:42:38 +02:00
Arne Fitzenreiter
e9692dd548 kernel: update to 5.10.41
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2021-07-05 07:42:38 +02:00
Arne Fitzenreiter
adea4dde18 kernel: update to 5.10.40
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2021-07-05 07:42:38 +02:00
Arne Fitzenreiter
b358af5bfe kernel: update to 5.10.39
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2021-07-05 07:42:38 +02:00
Arne Fitzenreiter
5235ab4817 kernel: update to 5.10.38
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2021-07-05 07:42:38 +02:00
Arne Fitzenreiter
5a27051fc2 kernel: update to 5.10.37
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2021-07-05 07:42:38 +02:00
Arne Fitzenreiter
b75dd327fd kernel: update to 5.10.32
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2021-07-05 07:42:38 +02:00
Arne Fitzenreiter
09ddf00f20 kernel: update to 5.10.25
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2021-07-05 07:42:37 +02:00
Arne Fitzenreiter
9d1bffe083 kernel: arm* disable alg modules
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2021-07-05 07:42:37 +02:00
Arne Fitzenreiter
ca46fa4df4 kernel: arm* oldconfig
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2021-07-05 07:42:37 +02:00
Arne Fitzenreiter
ff5db7732c kernel: arm* enable UAS for USB storage
this is needed for newer USB enclosures to support trim
and get better speed. (already enabled on x86*)

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2021-07-05 07:42:37 +02:00
Arne Fitzenreiter
7d9d6e7b03 kernel: update aarch64 config and rootfiles
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2021-07-05 07:42:37 +02:00
Michael Tremer
5c8b5c3923 kernel: Enable BBR as default TCP congestion algorithm
This will increase throughput since BBR is more modern and adjusted to
the nowadays version of the Internet whereas Cubic is more conservative
and might not always fully saturate the downlink.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2021-07-05 07:42:36 +02:00
Arne Fitzenreiter
10ce44b0c6 kernel: update to 4.14.232
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
Reviewed-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2021-05-16 11:58:42 +00:00
Arne Fitzenreiter
7e27f7cdc1 kernel: update to 4.14.229
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
Reviewed-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2021-04-10 13:40:01 +00:00
Arne Fitzenreiter
2e1bf458e2 kernel: update to 4.14.206
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2020-11-12 09:02:02 +01:00
Arne Fitzenreiter
0163c62dee kernel: aarch64: enable ahci
this is needed to boot on ESXi on arm.

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2020-11-11 11:50:12 +00:00
Arne Fitzenreiter
73f4e7b4c6 kernel: aarch64: disable SSDT_OVERLAYS
this option was visible by enabling ACPI and is enabled by default but adds
an attacking vector.

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2020-09-18 05:23:18 +00:00
Mathew McBride
e29125d52f kernel: enable ACPI support on ARM64
ACPI (with EFI) is used on ARM systems conforming to the
Server Base Boot Requirements (SBBR) and is an optional
on embedded systems (EBBR).

Up to now the ARM64 boards supported by IPFire use U-Boot and
device tree so ACPI was not turned on.

The immediate use case here is to run under virtualization,
using my muvirt project[1] I can run IPFire on our Traverse Ten64
system. For reasons I'll explain separately it is not
currently possible to run stock IPFire on this system.

This change also enables the EFI RTC driver which is presented
by the qemu arm64 virt machine.

Signed-off-by: Mathew McBride <matt@traverse.com.au>

[1] - https://gitlab.com/traversetech/muvirt
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2020-09-17 18:50:35 +00:00
Arne Fitzenreiter
ce9f979c01 kernel: update to 4.14.195
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2020-08-31 06:58:32 +02:00
Arne Fitzenreiter
f3a59d63e2 kernel: update to 4.14.184
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2020-06-12 16:04:48 +02:00
Peter Müller
92e828b3b0 kernel: disable CONFIG_UPROBES
Quoted from #12433:
> Uprobes is the user-space counterpart to kprobes: they enable instrumentation
> applications (such as 'perf probe') to establish unintrusive probes in
> user-space binaries and libraries, by executing handler functions when the
> probes are hit by user-space applications.
>
> ( These probes come in the form of single-byte breakpoints, managed by the
> kernel and kept transparent to the probed application. )

IMHO this can be safely disabled, as there is little if any need to debug
userspace programs _that_ deeply on an IPFire machine.

Fixes: #12433

Cc: Arne Fitzenreiter <arne.fitzenreiter@ipfire.org>
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2020-06-10 15:18:36 +00:00
Peter Müller
3eb393ff2e kernel: enable CONFIG_FORTIFY_SOUCRE on aarch64
Partially fixes: #12369

Cc: Arne Fitzenreiter <arne.fitzenreiter@ipfire.org>
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2020-06-10 15:17:24 +00:00
Peter Müller
4ee87ee248 kernel: enable CONFIG_SLUB_DEBUG on aarch64 and armv5tel
Fixes: #12377

Cc: Arne Fitzenreiter <arne.fitzenreiter@ipfire.org>
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2020-06-10 15:16:57 +00:00
Arne Fitzenreiter
2b51e4aeab Revert "kernel: enable CONFIG_RANDOMIZE_BASE on aarch64"
with enabled CONFIG_RAMDOIZE_BASE the linking of xtables
and maybee other external kernel modules fail on aarch64

This reverts commit 8379ab44b8.
2020-06-10 16:20:34 +02:00
Peter Müller
8379ab44b8 kernel: enable CONFIG_RANDOMIZE_BASE on aarch64
Partially fixes: #12363

Cc: Arne Fitzenreiter <arne.fitzenreiter@ipfire.org>
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2020-06-09 22:19:50 +00:00
Peter Müller
e4d1f96869 kernel: enable CONFIG_HARDENED_USERCOPY on aarch64 and armv5tel
Fixes: #12365

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2020-06-09 15:37:33 +00:00
Peter Müller
7617da3bba kernel: enable CONFIG_SECCOMP on aarch64 and armv5tel
Fixes: #12366

Cc: Arne Fitzenreiter <arne.fitzenreiter@ipfire.org>
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2020-06-08 21:22:44 +00:00
Arne Fitzenreiter
a43b370411 kernel: update to 4.14.183
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2020-06-04 08:37:00 +02:00
Peter Müller
4264e41a61 kernel: enable CONFIG_SCHED_STACK_END_CHECK on x86_64, armv5tel and aarch64
> This option checks for a stack overrun on calls to schedule(). If the stack
> end location is found to be over written always panic as the content of the
> corrupted region can no longer be trusted. This is to ensure no erroneous
> behaviour occurs which could result in data corruption or a sporadic crash at a
> later stage once the region is examined. The runtime overhead introduced is
> minimal.

Fixes: #12376

Cc: Arne Fitzenreiter <arne.fitzenreiter@ipfire.org>
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Acked-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2020-06-02 11:15:34 +00:00
Peter Müller
b5e1ccaee2 kernel: enable CONFIG_DEBUG_WX on aarch64
Since this is described as 'Generate a warning if any W+X mappings are
found at boot.', it most likely does not break anything and can be
safely enabled.

Fixes: #12373

Cc: Arne Fitzenreiter <arne.fitzenreiter@ipfire.org>
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Acked-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2020-06-02 11:14:50 +00:00
Peter Müller
442a7f5ea2 Kernel: drop Memstick support
These are not needed anymore since Sony announced EOL in 2010 and there
is no legitimate use case for such hardware on a firewall system.

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2020-06-02 11:13:14 +00:00
Peter Müller
90ecad4f66 Kernel: drop bluetooth support
The bluetooth addon was recently removed by commit
592be1d206, which is why we do not need to
carry the corresponding kernel modules around anymore.

The second version of this patch correctly updates kernel configuration
files via "make oldconfig" as requested by Arne.

Cc: Arne Fitzenreiter <arne.fitzenreiter@ipfire.org>
Cc: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2020-06-02 11:12:58 +00:00
Arne Fitzenreiter
831ff05d89 kernel: enable and enforce signed kernel modules
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2020-02-06 15:09:52 +01:00
Arne Fitzenreiter
bf671bb2ae kernel: update to 4.14.154
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2019-11-14 21:23:08 +00:00
Michael Tremer
951a9f9ba0 linux+iptables: Drop support for IMQ
This is no longer needed since we are using IFB now

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Daniel Weismüller <daniel.weismueller@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2019-10-21 18:58:08 +00:00
Arne Fitzenreiter
c27fdd8697 Revert "linux+iptables: Drop support for IMQ"
This reverts commit 59b9a6bd22.
2019-10-20 20:20:26 +00:00
Arne Fitzenreiter
596c71d07f kernel: update to 4.14.150
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2019-10-18 23:07:44 +02:00
Michael Tremer
59b9a6bd22 linux+iptables: Drop support for IMQ
This is no longer needed since we are using IFB now

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2019-10-14 18:02:55 +00:00
Arne Fitzenreiter
69cf4f3065 kernel: update to 4.14.146
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2019-09-21 20:44:52 +02:00
Arne Fitzenreiter
3b415347bb kernel: update to 4.14.137
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2019-08-07 20:38:25 +00:00
Arne Fitzenreiter
716f00b116 kernel: update to 4.14.121
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2019-05-21 20:42:51 +02:00
Arne Fitzenreiter
16cb73d901 kernel: update to 4.14.120
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2019-05-17 07:10:52 +02:00
Arne Fitzenreiter
d099196501 kernel: update to 4.14.119
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2019-05-16 14:26:04 +02:00
Arne Fitzenreiter
5fa063f859 kernel: update to 4.14.112
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2019-04-17 22:30:19 +02:00
Arne Fitzenreiter
f2afd5e70d kernel: update to 4.14.111
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2019-04-08 21:47:23 +02:00
Arne Fitzenreiter
aa20f1b277 kernel: update to 4.14.110
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2019-04-05 07:46:34 +02:00
Michael Tremer
48d3cde9ce kernel: Disable some debugging in expactation to increase performance
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2019-04-01 21:58:23 +01:00
Michael Tremer
474a6a5978 kernel: Enable strict checks for /dev/mem
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2019-04-01 21:55:03 +01:00