diff options
Diffstat (limited to 'pkgs/os-specific/linux')
149 files changed, 6914 insertions, 1472 deletions
diff --git a/pkgs/os-specific/linux/acpid/default.nix b/pkgs/os-specific/linux/acpid/default.nix index 7a234b16c913..ad763d2ee298 100644 --- a/pkgs/os-specific/linux/acpid/default.nix +++ b/pkgs/os-specific/linux/acpid/default.nix @@ -1,4 +1,4 @@ -{ stdenv, fetchurl }: +{ stdenv, fetchurl, autoreconfHook }: stdenv.mkDerivation rec { name = "acpid-2.0.29"; @@ -8,6 +8,16 @@ stdenv.mkDerivation rec { sha256 = "1zq38al07z92r2md18zivrzgjqnn7m2wahdpgri6wijwjwkknl2q"; }; + nativeBuildInputs = [ autoreconfHook ]; + + # remove when https://sourceforge.net/p/acpid2/code/merge-requests/1/ is merged + postPatch = '' + substituteInPlace configure.ac \ + --replace "AC_FUNC_MALLOC" "" \ + --replace "AC_FUNC_REALLOC" "" \ + --replace "strrchr strtol" "strrchr strtol malloc realloc" + ''; + meta = with stdenv.lib; { homepage = http://tedfelix.com/linux/acpid-netlink.html; description = "A daemon for delivering ACPI events to userspace programs"; diff --git a/pkgs/os-specific/linux/alsa-firmware/default.nix b/pkgs/os-specific/linux/alsa-firmware/default.nix index 5871d1c6990a..fb312b6bcb00 100644 --- a/pkgs/os-specific/linux/alsa-firmware/default.nix +++ b/pkgs/os-specific/linux/alsa-firmware/default.nix @@ -4,10 +4,7 @@ stdenv.mkDerivation rec { name = "alsa-firmware-1.0.29"; src = fetchurl { - urls = [ - "ftp://ftp.alsa-project.org/pub/firmware/${name}.tar.bz2" - "http://alsa.cybermirror.org/firmware/${name}.tar.bz2" - ]; + url = "mirror://alsa/firmware/${name}.tar.bz2"; sha256 = "0gfcyj5anckjn030wcxx5v2xk2s219nyf99s9m833275b5wz2piw"; }; @@ -28,7 +25,7 @@ stdenv.mkDerivation rec { ''; meta = { - homepage = http://www.alsa-project.org/main/index.php/Main_Page; + homepage = http://www.alsa-project.org/; description = "Soundcard firmwares from the alsa project"; license = stdenv.lib.licenses.gpl2Plus; platforms = stdenv.lib.platforms.linux; diff --git a/pkgs/os-specific/linux/alsa-lib/default.nix b/pkgs/os-specific/linux/alsa-lib/default.nix index c2c612db5422..41b43afc242c 100644 --- a/pkgs/os-specific/linux/alsa-lib/default.nix +++ b/pkgs/os-specific/linux/alsa-lib/default.nix @@ -4,10 +4,7 @@ stdenv.mkDerivation rec { name = "alsa-lib-1.1.6"; src = fetchurl { - urls = [ - "ftp://ftp.alsa-project.org/pub/lib/${name}.tar.bz2" - "http://alsa.cybermirror.org/lib/${name}.tar.bz2" - ]; + url = "mirror://alsa/lib/${name}.tar.bz2"; sha256 = "096pwrnhj36yndldvs2pj4r871zhcgisks0is78f1jkjn9sd4b2z"; }; diff --git a/pkgs/os-specific/linux/alsa-oss/default.nix b/pkgs/os-specific/linux/alsa-oss/default.nix index 5cd937a37928..a13e178e4183 100644 --- a/pkgs/os-specific/linux/alsa-oss/default.nix +++ b/pkgs/os-specific/linux/alsa-oss/default.nix @@ -4,10 +4,7 @@ stdenv.mkDerivation rec { name = "alsa-oss-1.1.6"; src = fetchurl { - urls = [ - "ftp://ftp.alsa-project.org/pub/oss-lib/${name}.tar.bz2" - "http://alsa.cybermirror.org/oss-lib/${name}.tar.bz2" - ]; + url = "mirror://alsa/oss-lib/${name}.tar.bz2"; sha256 = "1sj512wyci5qv8cisps96xngh7y9r5mv18ybqnazy18zwr1zgly3"; }; diff --git a/pkgs/os-specific/linux/alsa-plugins/default.nix b/pkgs/os-specific/linux/alsa-plugins/default.nix index f57f84b293b5..9012f32f31df 100644 --- a/pkgs/os-specific/linux/alsa-plugins/default.nix +++ b/pkgs/os-specific/linux/alsa-plugins/default.nix @@ -4,10 +4,7 @@ stdenv.mkDerivation rec { name = "alsa-plugins-1.1.6"; src = fetchurl { - urls = [ - "ftp://ftp.alsa-project.org/pub/plugins/${name}.tar.bz2" - "http://alsa.cybermirror.org/plugins/${name}.tar.bz2" - ]; + url = "mirror://alsa/plugins/${name}.tar.bz2"; sha256 = "04qcwkisbh0d6lnh0rw1k6n869fbs6zbfq6yvb41rymiwgmk27bg"; }; diff --git a/pkgs/os-specific/linux/alsa-tools/default.nix b/pkgs/os-specific/linux/alsa-tools/default.nix index 67cae46164fc..1ce94d14803c 100644 --- a/pkgs/os-specific/linux/alsa-tools/default.nix +++ b/pkgs/os-specific/linux/alsa-tools/default.nix @@ -7,10 +7,7 @@ stdenv.mkDerivation rec { version = "1.1.6"; src = fetchurl { - urls = [ - "ftp://ftp.alsa-project.org/pub/tools/${name}.tar.bz2" - "http://alsa.cybermirror.org/tools/${name}.tar.bz2" - ]; + url = "mirror://alsa/tools/${name}.tar.bz2"; sha256 = "09rjb6hw1mn9y1jfdfj5djncgc2cr5wfps83k56rf6k4zg14v76n"; }; diff --git a/pkgs/os-specific/linux/alsa-utils/default.nix b/pkgs/os-specific/linux/alsa-utils/default.nix index e2340939fce7..376c42a8f9b8 100644 --- a/pkgs/os-specific/linux/alsa-utils/default.nix +++ b/pkgs/os-specific/linux/alsa-utils/default.nix @@ -2,14 +2,11 @@ stdenv.mkDerivation rec { name = "alsa-utils-${version}"; - version = "1.1.5"; + version = "1.1.6"; src = fetchurl { - urls = [ - "ftp://ftp.alsa-project.org/pub/utils/${name}.tar.bz2" - "http://alsa.cybermirror.org/utils/${name}.tar.bz2" - ]; - sha256 = "1s727md6mb408y2cfwzjkx23abxhampyrjdkgpyygdhxx62x42rj"; + url = "mirror://alsa/utils/${name}.tar.bz2"; + sha256 = "0vnkyymgwj9rfdb11nvab30dnfrylmakdfildxl0y8mj836awp0m"; }; patchPhase = '' @@ -27,7 +24,6 @@ stdenv.mkDerivation rec { meta = { homepage = http://www.alsa-project.org/; description = "ALSA, the Advanced Linux Sound Architecture utils"; - longDescription = '' The Advanced Linux Sound Architecture (ALSA) provides audio and MIDI functionality to the Linux-based operating system. diff --git a/pkgs/os-specific/linux/apparmor/default.nix b/pkgs/os-specific/linux/apparmor/default.nix index c8e58dfbf6fb..cbbe4d5ca462 100644 --- a/pkgs/os-specific/linux/apparmor/default.nix +++ b/pkgs/os-specific/linux/apparmor/default.nix @@ -36,9 +36,7 @@ let substituteInPlace ./common/Make.rules --replace "/usr/share/man" "share/man" ''; - # use 'if c then x else null' to avoid rebuilding - # patches = stdenv.lib.optionals stdenv.hostPlatform.isMusl [ - patches = if stdenv.hostPlatform.isMusl then [ + patches = stdenv.lib.optionals stdenv.hostPlatform.isMusl [ (fetchpatch { url = "https://git.alpinelinux.org/cgit/aports/plain/testing/apparmor/0002-Provide-missing-secure_getenv-and-scandirat-function.patch?id=74b8427cc21f04e32030d047ae92caa618105b53"; name = "0002-Provide-missing-secure_getenv-and-scandirat-function.patch"; @@ -55,7 +53,11 @@ let sha256 = "1m4dx901biqgnr4w4wz8a2z9r9dxyw7wv6m6mqglqwf2lxinqmp4"; }) # (alpine patches {1,4,5,6,8} are needed for apparmor 2.11, but not 2.12) - ] else null; + ]; + + # Set to `true` after the next FIXME gets fixed or this gets some + # common derivation infra. Too much copy-paste to fix one by one. + doCheck = false; # FIXME: convert these to a single multiple-outputs package? @@ -99,6 +101,8 @@ let mv $out/lib/python* $python/lib/ ''; + inherit doCheck; + meta = apparmor-meta "library"; }; @@ -131,6 +135,8 @@ let done ''; + inherit doCheck; + meta = apparmor-meta "user-land utilities"; }; @@ -154,6 +160,8 @@ let makeFlags = ''LANGS= USE_SYSTEM=1''; installFlags = ''DESTDIR=$(out) BINDIR=$(out)/bin''; + inherit doCheck; + meta = apparmor-meta "binary user-land utilities"; }; @@ -177,6 +185,8 @@ let makeFlags = ''LANGS= USE_SYSTEM=1 INCLUDEDIR=${libapparmor}/include''; installFlags = ''DESTDIR=$(out) DISTRO=unknown''; + inherit doCheck; + meta = apparmor-meta "rule parser"; }; @@ -192,6 +202,8 @@ let makeFlags = ''USE_SYSTEM=1''; installFlags = ''DESTDIR=$(out)''; + inherit doCheck; + meta = apparmor-meta "PAM service"; }; @@ -204,6 +216,8 @@ let postPatch = "cd ./profiles"; installFlags = ''DESTDIR=$(out) EXTRAS_DEST=$(out)/share/apparmor/extra-profiles''; + inherit doCheck; + meta = apparmor-meta "profiles"; }; @@ -218,6 +232,8 @@ let cp -R ./kernel-patches/* "$out" ''; + inherit doCheck; + meta = apparmor-meta "kernel patches"; }; diff --git a/pkgs/os-specific/linux/atop/default.nix b/pkgs/os-specific/linux/atop/default.nix index ea4f44f52bbb..7b4ac9e1f3b8 100644 --- a/pkgs/os-specific/linux/atop/default.nix +++ b/pkgs/os-specific/linux/atop/default.nix @@ -5,7 +5,7 @@ stdenv.mkDerivation rec { name = "atop-${version}"; src = fetchurl { - url = "http://www.atoptool.nl/download/atop-${version}.tar.gz"; + url = "https://www.atoptool.nl/download/atop-${version}.tar.gz"; sha256 = "0r5j9q89wpylmg0px5xymxi3jpihw9wq8bh37g3ciymsw1fp5r3k"; }; diff --git a/pkgs/os-specific/linux/audit/default.nix b/pkgs/os-specific/linux/audit/default.nix index 7e14983a6d2b..b7928e38fc98 100644 --- a/pkgs/os-specific/linux/audit/default.nix +++ b/pkgs/os-specific/linux/audit/default.nix @@ -9,7 +9,7 @@ stdenv.mkDerivation rec { name = "audit-2.8.3"; src = fetchurl { - url = "http://people.redhat.com/sgrubb/audit/${name}.tar.gz"; + url = "https://people.redhat.com/sgrubb/audit/${name}.tar.gz"; sha256 = "06lacv9zjn0sf076dydwmvjhdmik3xzhdjvyrkq75917xv54ajbl"; }; diff --git a/pkgs/os-specific/linux/batman-adv/alfred.nix b/pkgs/os-specific/linux/batman-adv/alfred.nix index 9b7484932ebd..a3914067d7d8 100644 --- a/pkgs/os-specific/linux/batman-adv/alfred.nix +++ b/pkgs/os-specific/linux/batman-adv/alfred.nix @@ -1,14 +1,14 @@ { stdenv, fetchurl, pkgconfig, gpsd, libcap, libnl }: let - ver = "2018.0"; + ver = "2018.1"; in stdenv.mkDerivation rec { name = "alfred-${ver}"; src = fetchurl { - url = "http://downloads.open-mesh.org/batman/releases/batman-adv-${ver}/${name}.tar.gz"; - sha256 = "0mzjgjkmgdrrqa6fbpii9q1xqvg3kvwgq2k2kpdf0vy4xxnypky7"; + url = "https://downloads.open-mesh.org/batman/releases/batman-adv-${ver}/${name}.tar.gz"; + sha256 = "0xkd842yp227jzfybjq8c5s7y5c7amm1f5ai80k8wyjwysnad3w0"; }; nativeBuildInputs = [ pkgconfig ]; diff --git a/pkgs/os-specific/linux/batman-adv/batctl.nix b/pkgs/os-specific/linux/batman-adv/batctl.nix index a1a2cff70a83..61d0eb9bdb0c 100644 --- a/pkgs/os-specific/linux/batman-adv/batctl.nix +++ b/pkgs/os-specific/linux/batman-adv/batctl.nix @@ -7,7 +7,7 @@ stdenv.mkDerivation rec { name = "batctl-${ver}"; src = fetchurl { - url = "http://downloads.open-mesh.org/batman/releases/batman-adv-${ver}/${name}.tar.gz"; + url = "https://downloads.open-mesh.org/batman/releases/batman-adv-${ver}/${name}.tar.gz"; sha256 = "0lxm0vb0w1gxyi5k553jgkpmhifc4cykzfybrsk8hvwilq6pv1r7"; }; diff --git a/pkgs/os-specific/linux/bcc/default.nix b/pkgs/os-specific/linux/bcc/default.nix index 2e2c872fb187..4f0a423600f8 100644 --- a/pkgs/os-specific/linux/bcc/default.nix +++ b/pkgs/os-specific/linux/bcc/default.nix @@ -1,9 +1,9 @@ { stdenv, fetchFromGitHub, fetchpatch, makeWrapper, cmake, llvmPackages, kernel -, flex, bison, elfutils, python, pythonPackages, luajit, netperf, iperf, libelf +, flex, bison, elfutils, python, luajit, netperf, iperf, libelf , systemtap }: -stdenv.mkDerivation rec { +python.pkgs.buildPythonApplication rec { version = "0.5.0"; name = "bcc-${version}"; @@ -14,9 +14,11 @@ stdenv.mkDerivation rec { sha256 = "0bb3244xll5sqx0lvrchg71qy2zg0yj6r5h4v5fvrg1fjhaldys9"; }; + format = "other"; + buildInputs = [ llvmPackages.llvm llvmPackages.clang-unwrapped kernel - elfutils python pythonPackages.netaddr luajit netperf iperf + elfutils luajit netperf iperf systemtap.stapBuild ]; @@ -26,18 +28,31 @@ stdenv.mkDerivation rec { url = "https://github.com/iovisor/bcc/commit/bd7fa55bb39b8978dafd0b299e35616061e0a368.patch"; sha256 = "1sgxhsq174iihyk1x08py73q8fh78d7y3c90k5nh8vcw2pf1xbnf"; }) + + # This is needed until we fix + # https://github.com/NixOS/nixpkgs/issues/40427 + ./fix-deadlock-detector-import.patch ]; nativeBuildInputs = [ makeWrapper cmake flex bison ] # libelf is incompatible with elfutils-libelf ++ stdenv.lib.filter (x: x != libelf) kernel.moduleBuildDependencies; - cmakeFlags = - [ "-DBCC_KERNEL_MODULES_DIR=${kernel.dev}/lib/modules" - "-DREVISION=${version}" - "-DENABLE_USDT=ON" - "-DENABLE_CPP_API=ON" - ]; + cmakeFlags = [ + "-DBCC_KERNEL_MODULES_DIR=${kernel.dev}/lib/modules" + "-DREVISION=${version}" + "-DENABLE_USDT=ON" + "-DENABLE_CPP_API=ON" + ]; + + postPatch = '' + substituteAll ${./libbcc-path.patch} ./libbcc-path.patch + patch -p1 < libbcc-path.patch + ''; + + propagatedBuildInputs = [ + python.pkgs.netaddr + ]; postInstall = '' mkdir -p $out/bin $out/share @@ -47,12 +62,17 @@ stdenv.mkDerivation rec { find $out/share/bcc/tools -type f -executable -print0 | \ while IFS= read -r -d ''$'\0' f; do - pythonLibs="$out/lib/python2.7/site-packages:${pythonPackages.netaddr}/lib/${python.libPrefix}/site-packages" - rm -f $out/bin/$(basename $f) - makeWrapper $f $out/bin/$(basename $f) \ - --prefix LD_LIBRARY_PATH : $out/lib \ - --prefix PYTHONPATH : "$pythonLibs" + bin=$out/bin/$(basename $f) + if [ ! -e $bin ]; then + ln -s $f $bin + fi done + + sed -i -e "s!lib=.*!lib=$out/bin!" $out/bin/{java,ruby,node,python}gc + ''; + + postFixup = '' + wrapPythonProgramsIn "$out/share/bcc/tools" "$out $pythonPath" ''; meta = with stdenv.lib; { diff --git a/pkgs/os-specific/linux/bcc/fix-deadlock-detector-import.patch b/pkgs/os-specific/linux/bcc/fix-deadlock-detector-import.patch new file mode 100644 index 000000000000..87ce618a0dd9 --- /dev/null +++ b/pkgs/os-specific/linux/bcc/fix-deadlock-detector-import.patch @@ -0,0 +1,14 @@ +--- source.org/tools/deadlock_detector.py 1980-01-02 00:00:00.000000000 +0000 ++++ source/tools/deadlock_detector.py 2018-05-29 13:57:11.807126673 +0100 +@@ -44,9 +44,8 @@ + # + # 01-Feb-2017 Kenny Yu Created this. + +-from __future__ import ( +- absolute_import, division, unicode_literals, print_function +-) ++from __future__ import absolute_import, division, unicode_literals, print_function ++ + from bcc import BPF + from collections import defaultdict + import argparse diff --git a/pkgs/os-specific/linux/bcc/libbcc-path.patch b/pkgs/os-specific/linux/bcc/libbcc-path.patch new file mode 100644 index 000000000000..187bb3aadd00 --- /dev/null +++ b/pkgs/os-specific/linux/bcc/libbcc-path.patch @@ -0,0 +1,11 @@ +--- source.org/src/python/bcc/libbcc.py 2018-05-13 08:35:06.850522883 +0100 ++++ source/src/python/bcc/libbcc.py 2018-05-13 08:36:24.602733151 +0100 +@@ -14,7 +14,7 @@ + + import ctypes as ct + +-lib = ct.CDLL("libbcc.so.0", use_errno=True) ++lib = ct.CDLL("@out@/lib/libbcc.so.0", use_errno=True) + + # keep in sync with bpf_common.h + lib.bpf_module_create_b.restype = ct.c_void_p diff --git a/pkgs/os-specific/linux/blcr/default.nix b/pkgs/os-specific/linux/blcr/default.nix index ab1a93b3a703..275600d42785 100644 --- a/pkgs/os-specific/linux/blcr/default.nix +++ b/pkgs/os-specific/linux/blcr/default.nix @@ -2,7 +2,6 @@ # BLCR version 0.8.6 should works with linux kernel up to version 3.17.x -assert stdenv.isLinux; assert builtins.compareVersions "3.18" kernel.version == 1; stdenv.mkDerivation { diff --git a/pkgs/os-specific/linux/bluez/default.nix b/pkgs/os-specific/linux/bluez/default.nix index d4595d73d942..b095096caa76 100644 --- a/pkgs/os-specific/linux/bluez/default.nix +++ b/pkgs/os-specific/linux/bluez/default.nix @@ -2,34 +2,36 @@ pythonPackages, readline, udev, libical, systemd, enableWiimote ? false, enableMidi ? false }: -assert stdenv.isLinux; - stdenv.mkDerivation rec { - name = "bluez-5.49"; + name = "bluez-5.50"; src = fetchurl { url = "mirror://kernel/linux/bluetooth/${name}.tar.xz"; - sha256 = "15ffsaz7l3fgdg03l7g1xx9jw7xgs6pc548zxqsxawsca5x1sc1k"; + sha256 = "048r91vx9gs5nwwbah2s0xig04nwk14c5s0vb7qmaqdvighsmz2z"; }; - pythonPath = with pythonPackages; - [ dbus-python pygobject2 pygobject3 recursivePthLoader ]; + pythonPath = with pythonPackages; [ + dbus-python pygobject2 pygobject3 recursivePthLoader + ]; buildInputs = [ - pkgconfig dbus glib alsaLib pythonPackages.python pythonPackages.wrapPython + dbus glib alsaLib pythonPackages.python pythonPackages.wrapPython readline udev libical ]; + nativeBuildInputs = [ pkgconfig ]; + outputs = [ "out" "dev" "test" ]; patches = [ ./bluez-5.37-obexd_without_systemd-1.patch ]; - preConfigure = '' - substituteInPlace tools/hid2hci.rules --replace /sbin/udevadm ${systemd}/bin/udevadm - substituteInPlace tools/hid2hci.rules --replace "hid2hci " "$out/lib/udev/hid2hci " - ''; + postConfigure = '' + substituteInPlace tools/hid2hci.rules \ + --replace /sbin/udevadm ${systemd}/bin/udevadm \ + --replace "hid2hci " "$out/lib/udev/hid2hci " + ''; - configureFlags = [ + configureFlags = (with stdenv.lib; [ "--localstatedir=/var" "--enable-library" "--enable-cups" @@ -40,8 +42,8 @@ stdenv.mkDerivation rec { "--with-systemdsystemunitdir=$(out)/etc/systemd/system" "--with-systemduserunitdir=$(out)/etc/systemd/user" "--with-udevdir=$(out)/lib/udev" - ] ++ stdenv.lib.optional enableWiimote [ "--enable-wiimote" ] - ++ stdenv.lib.optional enableMidi [ "--enable-midi" ]; + ] ++ optional enableWiimote [ "--enable-wiimote" ] + ++ optional enableMidi [ "--enable-midi" ]); # Work around `make install' trying to create /var/lib/bluetooth. installFlags = "statedir=$(TMPDIR)/var/lib/bluetooth"; @@ -73,14 +75,21 @@ stdenv.mkDerivation rec { # Add extra configuration mkdir $out/etc/bluetooth ln -s /etc/bluetooth/main.conf $out/etc/bluetooth/main.conf + + # Add missing tools, ref https://git.archlinux.org/svntogit/packages.git/tree/trunk/PKGBUILD?h=packages/bluez + for files in `find tools/ -type f -perm -755`; do + filename=$(basename $files) + install -Dm755 tools/$filename $out/bin/$filename + done ''; enableParallelBuilding = true; meta = with stdenv.lib; { - homepage = http://www.bluez.org/; - repositories.git = https://git.kernel.org/pub/scm/bluetooth/bluez.git; description = "Bluetooth support for Linux"; + homepage = http://www.bluez.org/; + license = with licenses; [ gpl2 lgpl21 ]; platforms = platforms.linux; + repositories.git = https://git.kernel.org/pub/scm/bluetooth/bluez.git; }; } diff --git a/pkgs/os-specific/linux/busybox/default.nix b/pkgs/os-specific/linux/busybox/default.nix index b844bf72d82a..1a8f7f768626 100644 --- a/pkgs/os-specific/linux/busybox/default.nix +++ b/pkgs/os-specific/linux/busybox/default.nix @@ -33,14 +33,14 @@ let in stdenv.mkDerivation rec { - name = "busybox-1.28.3"; + name = "busybox-1.28.4"; # Note to whoever is updating busybox: please verify that: # nix-build pkgs/stdenv/linux/make-bootstrap-tools.nix -A test # still builds after the update. src = fetchurl { - url = "http://busybox.net/downloads/${name}.tar.bz2"; - sha256 = "0via6faqj9xcyi8r39r4n0wxlk8r2292yk0slzwrdri37w1j43dd"; + url = "https://busybox.net/downloads/${name}.tar.bz2"; + sha256 = "0smfn8hlds6nx8war62kyaykg3n7mxbjjfcpsgz84znwk4v4mhg3"; }; hardeningDisable = [ "format" ] ++ lib.optionals enableStatic [ "fortify" ]; @@ -98,6 +98,8 @@ stdenv.mkDerivation rec { enableParallelBuilding = true; + doCheck = false; # tries to access the net + meta = with stdenv.lib; { description = "Tiny versions of common UNIX utilities in a single small executable"; homepage = https://busybox.net/; diff --git a/pkgs/os-specific/linux/checksec/default.nix b/pkgs/os-specific/linux/checksec/default.nix index 1ef18f703d3f..9b7f69d4ab89 100644 --- a/pkgs/os-specific/linux/checksec/default.nix +++ b/pkgs/os-specific/linux/checksec/default.nix @@ -5,7 +5,7 @@ stdenv.mkDerivation rec { version = "1.5"; src = fetchurl { - url = "http://www.trapkit.de/tools/checksec.sh"; + url = "https://www.trapkit.de/tools/checksec.sh"; sha256 = "0iq9v568mk7g7ksa1939g5f5sx7ffq8s8n2ncvphvlckjgysgf3p"; }; diff --git a/pkgs/os-specific/linux/compsize/default.nix b/pkgs/os-specific/linux/compsize/default.nix new file mode 100644 index 000000000000..a18011836f97 --- /dev/null +++ b/pkgs/os-specific/linux/compsize/default.nix @@ -0,0 +1,30 @@ +{ stdenv, fetchFromGitHub, btrfs-progs }: + +stdenv.mkDerivation rec { + name = "compsize-${version}"; + version = "2018-04-07"; + + src = fetchFromGitHub { + owner = "kilobyte"; + repo = "compsize"; + rev = "903f772e37fc0ac6d6cf94ddbc98c691763c1e62"; + sha256 = "0jps8n0xsdh4mcww5q29rzysbv50iq6rmihxrf99lzgrw0sw5m7k"; + }; + + buildInputs = [ btrfs-progs ]; + + installPhase = '' + mkdir -p $out/bin + mkdir -p $out/share/man/man8 + install -m 0755 compsize $out/bin + install -m 0444 compsize.8 $out/share/man/man8 + ''; + + meta = with stdenv.lib; { + description = "btrfs: Find compression type/ratio on a file or set of files"; + homepage = https://github.com/kilobyte/compsize; + license = licenses.gpl2; + maintainers = with maintainers; [ CrazedProgrammer ]; + platforms = platforms.linux; + }; +} diff --git a/pkgs/os-specific/linux/conntrack-tools/default.nix b/pkgs/os-specific/linux/conntrack-tools/default.nix index 9736d7a8f4bd..755e88b46cbc 100644 --- a/pkgs/os-specific/linux/conntrack-tools/default.nix +++ b/pkgs/os-specific/linux/conntrack-tools/default.nix @@ -4,11 +4,11 @@ stdenv.mkDerivation rec { name = "conntrack-tools-${version}"; - version = "1.4.4"; + version = "1.4.5"; src = fetchurl { - url = "http://www.netfilter.org/projects/conntrack-tools/files/${name}.tar.bz2"; - sha256 = "0v5spmlcw5n6va8z34f82vcpynadb0b54pnjazgpadf0qkyg9jmp"; + url = "https://www.netfilter.org/projects/conntrack-tools/files/${name}.tar.bz2"; + sha256 = "0qm4m78hr6a4fbmnkw5nyjm1pzzhydzx0nz7f96iv1c4fsfdkiin"; }; buildInputs = [ diff --git a/pkgs/os-specific/linux/cpufrequtils/default.nix b/pkgs/os-specific/linux/cpufrequtils/default.nix index 65be409a75e3..e36aaa5e38d0 100644 --- a/pkgs/os-specific/linux/cpufrequtils/default.nix +++ b/pkgs/os-specific/linux/cpufrequtils/default.nix @@ -1,7 +1,5 @@ { stdenv, fetchurl, libtool, gettext }: -assert stdenv.system == "i686-linux" || stdenv.system == "x86_64-linux"; - stdenv.mkDerivation rec { name = "cpufrequtils-008"; diff --git a/pkgs/os-specific/linux/criu/default.nix b/pkgs/os-specific/linux/criu/default.nix index fc7a66dcf1b6..ad9b27f83fa9 100644 --- a/pkgs/os-specific/linux/criu/default.nix +++ b/pkgs/os-specific/linux/criu/default.nix @@ -4,11 +4,11 @@ stdenv.mkDerivation rec { name = "criu-${version}"; - version = "3.8.1"; + version = "3.9"; src = fetchurl { - url = "http://download.openvz.org/criu/${name}.tar.bz2"; - sha256 = "0csyhsc5d6wkcjyvsp6h9x8zxn3zk574s84gfmy3gjagv3nwqd51"; + url = "https://download.openvz.org/criu/${name}.tar.bz2"; + sha256 = "0l71lmklr42pc2bj37pkp7y8va8bx42n9f6i4q4idsx4wrdd75fx"; }; enableParallelBuilding = true; diff --git a/pkgs/os-specific/linux/cryptsetup/default.nix b/pkgs/os-specific/linux/cryptsetup/default.nix index ef8c55853a39..4a64154b585d 100644 --- a/pkgs/os-specific/linux/cryptsetup/default.nix +++ b/pkgs/os-specific/linux/cryptsetup/default.nix @@ -1,23 +1,27 @@ -{ stdenv, fetchurl, devicemapper, openssl, libuuid, pkgconfig, popt -, enablePython ? false, python2 ? null -}: +{ stdenv, fetchurl, devicemapper, json_c, openssl, libuuid, pkgconfig, popt +, enablePython ? false, python2 ? null }: assert enablePython -> python2 != null; stdenv.mkDerivation rec { - name = "cryptsetup-1.7.5"; + name = "cryptsetup-2.0.2"; src = fetchurl { - url = "mirror://kernel/linux/utils/cryptsetup/v1.7/${name}.tar.xz"; - sha256 = "1gail831j826lmpdx2gsc83lp3br6wfnwh3vqwxaa1nn1lfwsc1b"; + url = "mirror://kernel/linux/utils/cryptsetup/v2.0/${name}.tar.xz"; + sha256 = "15wyjfgcqjf0wy5gxnmjj8aah33csv5v6n1hv9c8sxdzygbhb0ag"; }; - configureFlags = [ "--enable-cryptsetup-reencrypt" "--with-crypto_backend=openssl" ] - ++ stdenv.lib.optional enablePython "--enable-python"; + NIX_LDFLAGS = "-lgcc_s"; + + configureFlags = [ + "--disable-kernel_crypto" + "--enable-cryptsetup-reencrypt" + "--with-crypto_backend=openssl" + ] ++ stdenv.lib.optional enablePython "--enable-python"; nativeBuildInputs = [ pkgconfig ]; - buildInputs = [ devicemapper openssl libuuid popt ] - ++ stdenv.lib.optional enablePython python2; + buildInputs = [ devicemapper json_c openssl libuuid popt ] + ++ stdenv.lib.optional enablePython python2; meta = { homepage = https://gitlab.com/cryptsetup/cryptsetup/; diff --git a/pkgs/os-specific/linux/dmraid/default.nix b/pkgs/os-specific/linux/dmraid/default.nix index d39cadf41993..e71d36c5e485 100644 --- a/pkgs/os-specific/linux/dmraid/default.nix +++ b/pkgs/os-specific/linux/dmraid/default.nix @@ -1,17 +1,33 @@ -{ stdenv, fetchurl, devicemapper }: +{ stdenv, fetchurl, fetchpatch, devicemapper }: stdenv.mkDerivation rec { name = "dmraid-1.0.0.rc16"; src = fetchurl { - url = "http://people.redhat.com/~heinzm/sw/dmraid/src/old/${name}.tar.bz2"; + url = "https://people.redhat.com/~heinzm/sw/dmraid/src/old/${name}.tar.bz2"; sha256 = "0m92971gyqp61darxbiri6a48jz3wq3gkp8r2k39320z0i6w8jgq"; }; - patches = [ ./hardening-format.patch ]; + patches = [ ./hardening-format.patch ] + ++ stdenv.lib.optionals stdenv.hostPlatform.isMusl [ + (fetchpatch { + url = "https://raw.githubusercontent.com/void-linux/void-packages/fceed4b8e96b3c1da07babf6f67b6ed1588a28b2/srcpkgs/dmraid/patches/006-musl-libc.patch"; + sha256 = "1j8xda0fpz8lxjxnqdidy7qb866qrzwpbca56yjdg6vf4x21hx6w"; + stripLen = 2; + extraPrefix = "1.0.0.rc16/"; + }) + (fetchpatch { + url = "https://raw.githubusercontent.com/void-linux/void-packages/fceed4b8e96b3c1da07babf6f67b6ed1588a28b2/srcpkgs/dmraid/patches/007-fix-loff_t-musl.patch"; + sha256 = "0msnq39qnzg3b1pdksnz1dgqwa3ak03g41pqh0lw3h7w5rjc016k"; + stripLen = 2; + extraPrefix = "1.0.0.rc16/"; + }) + ]; postPatch = '' sed -i 's/\[\[[^]]*\]\]/[ "''$''${n##*.}" = "so" ]/' */lib/Makefile.in + '' + stdenv.lib.optionalString stdenv.hostPlatform.isMusl '' + NIX_CFLAGS_COMPILE+=" -D_GNU_SOURCE" ''; preConfigure = "cd */"; diff --git a/pkgs/os-specific/linux/dpdk/default.nix b/pkgs/os-specific/linux/dpdk/default.nix index 4bd50fdae40f..13614493f610 100644 --- a/pkgs/os-specific/linux/dpdk/default.nix +++ b/pkgs/os-specific/linux/dpdk/default.nix @@ -1,45 +1,64 @@ -{ stdenv, lib, kernel, fetchurl, pkgconfig, libvirt }: +{ stdenv, lib, kernel, fetchurl, pkgconfig, numactl, shared ? false }: -assert lib.versionAtLeast kernel.version "3.18"; +let -stdenv.mkDerivation rec { - name = "dpdk-${version}-${kernel.version}"; - version = "17.05.1"; + kver = kernel.modDirVersion or null; + + mod = kernel != null; + +in stdenv.mkDerivation rec { + name = "dpdk-${version}" + lib.optionalString mod "-${kernel.version}"; + version = "17.11.2"; src = fetchurl { - url = "http://fast.dpdk.org/rel/dpdk-${version}.tar.xz"; - sha256 = "1w3nx5cqf8z600bdlbwz7brmdb5yn233qrqvv24kbmmxhbwp7qld"; + url = "https://fast.dpdk.org/rel/dpdk-${version}.tar.xz"; + sha256 = "19m5l3jkrns8r1zbjb6ry18w50ff36kbl5b5g6pfcp9p57sfisd2"; }; - nativeBuildInputs = [ pkgconfig ] ++ kernel.moduleBuildDependencies; - buildInputs = [ libvirt ]; + nativeBuildInputs = [ pkgconfig ]; + buildInputs = [ numactl ] ++ lib.optional mod kernel.moduleBuildDependencies; - RTE_KERNELDIR = "${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"; + RTE_KERNELDIR = if mod then "${kernel.dev}/lib/modules/${kver}/build" else "/var/empty"; RTE_TARGET = "x86_64-native-linuxapp-gcc"; # we need sse3 instructions to build - NIX_CFLAGS_COMPILE = [ "-march=core2" ]; - - enableParallelBuilding = true; - outputs = [ "out" "kmod" ]; - + NIX_CFLAGS_COMPILE = [ "-msse3" ]; hardeningDisable = [ "pic" ]; + postPatch = '' + cat >>config/defconfig_$RTE_TARGET <<EOF +# Build static or shared libraries. +CONFIG_RTE_BUILD_SHARED_LIB=${if shared then "y" else "n"} +EOF + '' + lib.optionalString (!mod) '' + cat >>config/defconfig_$RTE_TARGET <<EOF +# Do not build kernel modules. +CONFIG_RTE_EAL_IGB_UIO=n +CONFIG_RTE_KNI_KMOD=n +EOF + ''; + configurePhase = '' make T=${RTE_TARGET} config ''; - installPhase = '' - make install-runtime DESTDIR=$out prefix= includedir=/include datadir=/ - make install-sdk DESTDIR=$out prefix= includedir=/include datadir=/ - make install-kmod DESTDIR=$kmod - ''; + installTargets = [ "install-runtime" "install-sdk" "install-kmod" ]; # skip install-doc + + installFlags = [ + "prefix=$(out)" + ] ++ lib.optionals mod [ + "kerneldir=$(kmod)/lib/modules/${kver}" + ]; + + outputs = [ "out" ] ++ lib.optional mod "kmod"; + + enableParallelBuilding = true; - meta = with stdenv.lib; { + meta = with lib; { description = "Set of libraries and drivers for fast packet processing"; homepage = http://dpdk.org/; license = with licenses; [ lgpl21 gpl2 bsd2 ]; platforms = [ "x86_64-linux" ]; - maintainers = [ maintainers.domenkozar ]; + maintainers = with maintainers; [ domenkozar orivej ]; }; } diff --git a/pkgs/os-specific/linux/drbd/default.nix b/pkgs/os-specific/linux/drbd/default.nix index 971eef6a8b52..8d18d5980207 100644 --- a/pkgs/os-specific/linux/drbd/default.nix +++ b/pkgs/os-specific/linux/drbd/default.nix @@ -1,7 +1,5 @@ { stdenv, fetchurl, flex, systemd, perl }: -assert stdenv.isLinux; - stdenv.mkDerivation rec { name = "drbd-8.4.4"; diff --git a/pkgs/os-specific/linux/eventstat/default.nix b/pkgs/os-specific/linux/eventstat/default.nix index e2647112f1b2..8d96a503c766 100644 --- a/pkgs/os-specific/linux/eventstat/default.nix +++ b/pkgs/os-specific/linux/eventstat/default.nix @@ -2,10 +2,10 @@ stdenv.mkDerivation rec { name = "eventstat-${version}"; - version = "0.04.03"; + version = "0.04.04"; src = fetchzip { url = "http://kernel.ubuntu.com/~cking/tarballs/eventstat/eventstat-${version}.tar.gz"; - sha256 = "0yv7rpdg07rihw8iilvigib963nxf16mn26hzlb6qd1wv54k6dbr"; + sha256 = "034xpdr3ip4w9k713wjc45x66k3nz6wg9wkzmchrjifxk4dldbd8"; }; buildInputs = [ ncurses ]; installFlags = [ "DESTDIR=$(out)" ]; diff --git a/pkgs/os-specific/linux/firejail/default.nix b/pkgs/os-specific/linux/firejail/default.nix index 1c7ebce9f877..9f2374e75a88 100644 --- a/pkgs/os-specific/linux/firejail/default.nix +++ b/pkgs/os-specific/linux/firejail/default.nix @@ -3,11 +3,11 @@ let s = # Generated upstream information rec { baseName="firejail"; - version="0.9.52"; + version="0.9.54"; name="${baseName}-${version}"; - hash="0w8l8z4j7iph8fp7rchhnfsrik3f00f9v5xr191fp38fphzcj56s"; - url="https://vorboss.dl.sourceforge.net/project/firejail/firejail/firejail-0.9.52.tar.xz"; - sha256="0w8l8z4j7iph8fp7rchhnfsrik3f00f9v5xr191fp38fphzcj56s"; + hash="0mkpqlhi1vxiwd1pmlsk02vpydy1gj61k1gi3zlz6qw84xa6i6ff"; + url="https://vorboss.dl.sourceforge.net/project/firejail/firejail/firejail-0.9.54.tar.xz"; + sha256="0mkpqlhi1vxiwd1pmlsk02vpydy1gj61k1gi3zlz6qw84xa6i6ff"; }; buildInputs = [ which diff --git a/pkgs/os-specific/linux/firmware/b43-firmware-cutter/default.nix b/pkgs/os-specific/linux/firmware/b43-firmware-cutter/default.nix index 224239a4affd..8aa78e65dec1 100644 --- a/pkgs/os-specific/linux/firmware/b43-firmware-cutter/default.nix +++ b/pkgs/os-specific/linux/firmware/b43-firmware-cutter/default.nix @@ -4,7 +4,7 @@ stdenv.mkDerivation rec { name = "b43-fwcutter-019"; src = fetchurl { - url = "http://bues.ch/b43/fwcutter/${name}.tar.bz2"; + url = "https://bues.ch/b43/fwcutter/${name}.tar.bz2"; sha256 = "1ki1f5fy3yrw843r697f8mqqdz0pbsbqnvg4yzkhibpn1lqqbsnn"; }; diff --git a/pkgs/os-specific/linux/firmware/intel2200BGFirmware/default.nix b/pkgs/os-specific/linux/firmware/intel2200BGFirmware/default.nix index e8ab77a509ff..bf8bcf387261 100644 --- a/pkgs/os-specific/linux/firmware/intel2200BGFirmware/default.nix +++ b/pkgs/os-specific/linux/firmware/intel2200BGFirmware/default.nix @@ -6,7 +6,7 @@ stdenv.mkDerivation { name = "intel2200BGFirmware-${version}"; src = fetchurl { - url = "http://src.fedoraproject.org/repo/pkgs/ipw2200-firmware/ipw2200-fw-${version}.tgz/eaba788643c7cc7483dd67ace70f6e99/ipw2200-fw-${version}.tgz"; + url = "https://src.fedoraproject.org/repo/pkgs/ipw2200-firmware/ipw2200-fw-${version}.tgz/eaba788643c7cc7483dd67ace70f6e99/ipw2200-fw-${version}.tgz"; sha256 = "c6818c11c18cc030d55ff83f64b2bad8feef485e7742f84f94a61d811a6258bd"; }; diff --git a/pkgs/os-specific/linux/firmware/raspberrypi/default.nix b/pkgs/os-specific/linux/firmware/raspberrypi/default.nix index d00f1b148374..344d224df948 100644 --- a/pkgs/os-specific/linux/firmware/raspberrypi/default.nix +++ b/pkgs/os-specific/linux/firmware/raspberrypi/default.nix @@ -2,13 +2,13 @@ stdenv.mkDerivation rec { name = "raspberrypi-firmware-${version}"; - version = "1.20180328"; + version = "1.20180417"; src = fetchFromGitHub { owner = "raspberrypi"; repo = "firmware"; rev = version; - sha256 = "19h4lv11idy268pyrq21c5gsff77d5xr9xjkpmzfpcq34gjh3x21"; + sha256 = "17mnnhni0wgdnc3mw60nfhcj9v6p5dwcqkwnbpvzczab3r2hziji"; }; installPhase = '' diff --git a/pkgs/os-specific/linux/fnotifystat/default.nix b/pkgs/os-specific/linux/fnotifystat/default.nix index d49d01158229..eb87d8aa7251 100644 --- a/pkgs/os-specific/linux/fnotifystat/default.nix +++ b/pkgs/os-specific/linux/fnotifystat/default.nix @@ -2,10 +2,10 @@ stdenv.mkDerivation rec { name = "fnotifystat-${version}"; - version = "0.02.00"; + version = "0.02.01"; src = fetchurl { url = "http://kernel.ubuntu.com/~cking/tarballs/fnotifystat/fnotifystat-${version}.tar.gz"; - sha256 = "0sfzmggfhhhp3vxn1s61b5bacr2hz6r7y699n3nysdciaa2scgdq"; + sha256 = "18p6rqb3bhs2ih6mnp57j0cyawjm0iwky6y3ays54alkxqaz8gmx"; }; installFlags = [ "DESTDIR=$(out)" ]; postInstall = '' diff --git a/pkgs/os-specific/linux/forkstat/default.nix b/pkgs/os-specific/linux/forkstat/default.nix index bf7bc8a4546a..bde2cbbafa65 100644 --- a/pkgs/os-specific/linux/forkstat/default.nix +++ b/pkgs/os-specific/linux/forkstat/default.nix @@ -2,10 +2,10 @@ stdenv.mkDerivation rec { name = "forkstat-${version}"; - version = "0.02.02"; + version = "0.02.03"; src = fetchurl { url = "http://kernel.ubuntu.com/~cking/tarballs/forkstat/forkstat-${version}.tar.gz"; - sha256 = "02iqi4xjg2hl4paw88fz9jb88a9p4zprvq3g56cd7jwfx3vmw5a4"; + sha256 = "1dl95ijs9bs9s9i629bi88qmvxjl25ym742gc063bysbp8drban1"; }; installFlags = [ "DESTDIR=$(out)" ]; postInstall = '' diff --git a/pkgs/os-specific/linux/fswebcam/default.nix b/pkgs/os-specific/linux/fswebcam/default.nix index fd37d35623e4..b7f47f12b15b 100644 --- a/pkgs/os-specific/linux/fswebcam/default.nix +++ b/pkgs/os-specific/linux/fswebcam/default.nix @@ -4,7 +4,7 @@ stdenv.mkDerivation rec { name = "fswebcam-20140113"; src = fetchurl { - url = "http://www.sanslogic.co.uk/fswebcam/files/${name}.tar.gz"; + url = "https://www.sanslogic.co.uk/fswebcam/files/${name}.tar.gz"; sha256 = "3ee389f72a7737700d22e0c954720b1e3bbadc8a0daad6426c25489ba9dc3199"; }; diff --git a/pkgs/os-specific/linux/fuse/common.nix b/pkgs/os-specific/linux/fuse/common.nix index 95011653ad01..04a4a1a0e1f1 100644 --- a/pkgs/os-specific/linux/fuse/common.nix +++ b/pkgs/os-specific/linux/fuse/common.nix @@ -1,4 +1,4 @@ -{ version, sha256Hash, maintainers }: +{ version, sha256Hash }: { stdenv, fetchFromGitHub, fetchpatch , fusePackages, utillinux, gettext @@ -28,10 +28,7 @@ in stdenv.mkDerivation rec { url = "https://github.com/libfuse/libfuse/commit/914871b20a901e3e1e981c92bc42b1c93b7ab81b.patch"; sha256 = "1w4j6f1awjrycycpvmlv0x5v9gprllh4dnbjxl4dyl2jgbkaw6pa"; }) - ++ stdenv.lib.optional isFuse3 ./fuse3-install.patch - # TODO: Only relevant for 3.2.2 (opened an upstream issue) - ++ stdenv.lib.optional isFuse3 ./fuse3-fix-version.patch; - + ++ stdenv.lib.optional isFuse3 ./fuse3-install.patch; nativeBuildInputs = if isFuse3 then [ meson ninja pkgconfig ] @@ -76,10 +73,10 @@ in stdenv.mkDerivation rec { enableParallelBuilding = true; - meta = { + meta = with stdenv.lib; { inherit (src.meta) homepage; description = "Kernel module and library that allows filesystems to be implemented in user space"; - platforms = stdenv.lib.platforms.linux; - inherit maintainers; + platforms = platforms.linux; + maintainers = [ maintainers.primeos ]; }; } diff --git a/pkgs/os-specific/linux/fuse/default.nix b/pkgs/os-specific/linux/fuse/default.nix index ddf280bbe2f7..f308930f0dc5 100644 --- a/pkgs/os-specific/linux/fuse/default.nix +++ b/pkgs/os-specific/linux/fuse/default.nix @@ -4,17 +4,14 @@ let mkFuse = args: callPackage (import ./common.nix args) { inherit utillinux; }; - maintainers = stdenv.lib.maintainers; in { fuse_2 = mkFuse { version = "2.9.7"; sha256Hash = "1wyjjfb7p4jrkk15zryzv33096a5fmsdyr2p4b00dd819wnly2n2"; - maintainers = [ ]; }; fuse_3 = mkFuse { - version = "3.2.2"; - sha256Hash = "1a0x4vpyg9lc6clwvx995mk0v6jqd37xabzp9rpdir37x814g3wh"; - maintainers = [ maintainers.primeos ]; + version = "3.2.3"; + sha256Hash = "185p1vjcsyzpcdkrcyw06zpapv4jc43qw9i8a4amzpgk1rsgg19d"; }; } diff --git a/pkgs/os-specific/linux/fuse/fuse3-fix-version.patch b/pkgs/os-specific/linux/fuse/fuse3-fix-version.patch deleted file mode 100644 index b6351aab3c01..000000000000 --- a/pkgs/os-specific/linux/fuse/fuse3-fix-version.patch +++ /dev/null @@ -1,8 +0,0 @@ ---- a/meson.build 2018-04-01 01:05:19.612723597 +0200 -+++ b/meson.build 2018-04-01 01:40:58.171109615 +0200 -@@ -1,4 +1,4 @@ --project('libfuse3', 'c', version: '3.2.1', -+project('libfuse3', 'c', version: '3.2.2', - meson_version: '>= 0.38', - default_options: [ 'buildtype=debugoptimized' ]) - diff --git a/pkgs/os-specific/linux/fwts/default.nix b/pkgs/os-specific/linux/fwts/default.nix index c02bfb1615c3..a3d8d0a0eece 100644 --- a/pkgs/os-specific/linux/fwts/default.nix +++ b/pkgs/os-specific/linux/fwts/default.nix @@ -3,11 +3,11 @@ stdenv.mkDerivation rec { name = "fwts-${version}"; - version = "18.03.00"; + version = "18.05.00"; src = fetchzip { url = "http://fwts.ubuntu.com/release/fwts-V${version}.tar.gz"; - sha256 = "1f2gdnaygsj0spd6a559bzf3wii7l59k3sk49rjbbdb9g77nkhg2"; + sha256 = "0ixc82zdv4cfj8g2mwd851fc47cpjj81mwjhn00n5wddb9cxmgkj"; stripRoot = false; }; diff --git a/pkgs/os-specific/linux/hostapd/default.nix b/pkgs/os-specific/linux/hostapd/default.nix index fa4d604b4001..8ae082ba9d4a 100644 --- a/pkgs/os-specific/linux/hostapd/default.nix +++ b/pkgs/os-specific/linux/hostapd/default.nix @@ -62,6 +62,8 @@ stdenv.mkDerivation rec { nativeBuildInputs = [ pkgconfig ]; buildInputs = [ libnl openssl sqlite ]; + outputs = [ "out" "man" ]; + extraConfig = '' CONFIG_DRIVER_WIRED=y CONFIG_LIBNL32=y @@ -103,6 +105,10 @@ stdenv.mkDerivation rec { ''; preInstall = "mkdir -p $out/bin"; + postInstall = '' + install -vD hostapd.8 -t $man/share/man/man8 + install -vD hostapd_cli.1 -t $man/share/man/man1 + ''; meta = { homepage = http://hostap.epitest.fi; diff --git a/pkgs/os-specific/linux/hwdata/default.nix b/pkgs/os-specific/linux/hwdata/default.nix index 15b3903ddd1a..ebf7179d0814 100644 --- a/pkgs/os-specific/linux/hwdata/default.nix +++ b/pkgs/os-specific/linux/hwdata/default.nix @@ -2,17 +2,19 @@ stdenv.mkDerivation rec { name = "hwdata-${version}"; - version = "0.311"; + version = "0.312"; src = fetchurl { - url = "https://github.com/vcrhonek/hwdata/archive/v0.311.tar.gz"; - sha256 = "159av9wvl3biryxd5pgqcwz6wkdaa0ydmcysmzznx939mfv7w18z"; + url = "https://github.com/vcrhonek/hwdata/archive/v0.312.tar.gz"; + sha256 = "04dbxfn40b8vyw49qpkslv20akbqm5hwl3cndmqacp6cik1l0gai"; }; preConfigure = "patchShebangs ./configure"; configureFlags = "--datadir=$(prefix)/data"; + doCheck = false; # this does build machine-specific checks (e.g. enumerates PCI bus) + meta = { homepage = https://github.com/vcrhonek/hwdata; description = "Hardware Database, including Monitors, pci.ids, usb.ids, and video cards"; diff --git a/pkgs/os-specific/linux/i7z/default.nix b/pkgs/os-specific/linux/i7z/default.nix index 6d0c5ae82bcc..48d28036aa4f 100644 --- a/pkgs/os-specific/linux/i7z/default.nix +++ b/pkgs/os-specific/linux/i7z/default.nix @@ -1,4 +1,5 @@ -{ stdenv, fetchurl, qt4, ncurses }: +{ stdenv, lib, fetchurl, ncurses +, withGui ? false, qt4 ? null }: stdenv.mkDerivation rec { name = "i7z-0.27.2"; @@ -8,29 +9,46 @@ stdenv.mkDerivation rec { sha256 = "1wa7ix6m75wl3k2n88sz0x8cckvlzqklja2gvzqfw5rcfdjjvxx7"; }; - buildInputs = [ qt4 ncurses ]; + buildInputs = [ ncurses ] ++ lib.optional withGui qt4; + + enableParallelBuilding = true; buildPhase = '' + runHook preBuild + make - cd GUI - qmake - make clean - make - cd .. + ${lib.optionalString withGui '' + cd GUI + qmake + make clean + make + cd .. + ''} + + runHook postBuild ''; installPhase = '' - mkdir -p $out/sbin + runHook preInstall + + mkdir -p $out/{bin,sbin} make install prefix=$out - install -Dm755 GUI/i7z_GUI $out/sbin/i7z-gui + ${lib.optionalString withGui '' + install -Dm755 GUI/i7z_GUI $out/bin/i7z-gui + ''} + mv $out/sbin/* $out/bin/ + rmdir $out/sbin + + runHook postInstall ''; - meta = { + meta = with lib; { description = "A better i7 (and now i3, i5) reporting tool for Linux"; homepage = https://github.com/ajaiantilal/i7z; repositories.git = https://github.com/ajaiantilal/i7z.git; - license = stdenv.lib.licenses.gpl2; - maintainers = [ stdenv.lib.maintainers.bluescreen303 ]; - platforms = stdenv.lib.platforms.linux; + license = licenses.gpl2; + maintainers = with maintainers; [ bluescreen303 ]; + # broken on ARM + platforms = [ "x86_64-linux" ]; }; } diff --git a/pkgs/os-specific/linux/input-utils/default.nix b/pkgs/os-specific/linux/input-utils/default.nix new file mode 100644 index 000000000000..cd0fc01384bc --- /dev/null +++ b/pkgs/os-specific/linux/input-utils/default.nix @@ -0,0 +1,30 @@ +{ stdenv, fetchurl, linuxHeaders }: + +stdenv.mkDerivation rec { + name = "input-utils-${version}"; + version = "1.3"; + + src = fetchurl { + url = "https://www.kraxel.org/releases/input/input-${version}.tar.gz"; + sha256 = "11w0pp20knx6qpgzmawdbk1nj2z3fzp8yd6nag6s8bcga16w6hli"; + }; + + prePatch = '' + # Use proper include path for kernel include files. + substituteInPlace ./name.sh --replace "/usr/include/linux/" "${linuxHeaders}/include/linux/" + substituteInPlace ./lirc.sh --replace "/usr/include/linux/" "${linuxHeaders}/include/linux/" + ''; + + makeFlags = [ + "prefix=$(out)" + "STRIP=-s" + ]; + + meta = with stdenv.lib; { + description = "Input layer utilities, includes lsinput"; + homepage = https://www.kraxel.org/blog/linux/input/; + license = licenses.gpl2; + maintainers = with maintainers; [ samueldr ]; + platforms = platforms.linux; + }; +} diff --git a/pkgs/os-specific/linux/ioport/default.nix b/pkgs/os-specific/linux/ioport/default.nix index b6c77a930807..56e622df2ce8 100644 --- a/pkgs/os-specific/linux/ioport/default.nix +++ b/pkgs/os-specific/linux/ioport/default.nix @@ -3,7 +3,7 @@ stdenv.mkDerivation { name = "ioport-1.2"; src = fetchurl { - url = "http://people.redhat.com/rjones/ioport/files/ioport-1.2.tar.gz"; + url = "https://people.redhat.com/rjones/ioport/files/ioport-1.2.tar.gz"; sha256 = "1h4d5g78y7kla0zl25jgyrk43wy3m3bygqg0blki357bc55irb3z"; }; buildInputs = [ perl ]; diff --git a/pkgs/os-specific/linux/iproute/default.nix b/pkgs/os-specific/linux/iproute/default.nix index 7d412d7e15d0..3f5ed788bb23 100644 --- a/pkgs/os-specific/linux/iproute/default.nix +++ b/pkgs/os-specific/linux/iproute/default.nix @@ -1,12 +1,12 @@ -{ fetchurl, stdenv, lib, flex, bash, bison, db, iptables, pkgconfig }: +{ fetchurl, stdenv, config, lib, flex, bash, bison, db, iptables, pkgconfig }: stdenv.mkDerivation rec { name = "iproute2-${version}"; - version = "4.16.0"; + version = "4.17.0"; src = fetchurl { url = "mirror://kernel/linux/utils/net/iproute2/${name}.tar.xz"; - sha256 = "02pfalg319jpbjz273ph725br8dnkzpfvi98azi9yd6p1w128p0c"; + sha256 = "0vmynikcamfhakvwyk5dsffy0ymgi5mdqiwybdvqfn1ijaq93abg"; }; preConfigure = '' @@ -26,8 +26,9 @@ stdenv.mkDerivation rec { "HDRDIR=$(TMPDIR)/include/iproute2" # Don't install headers ]; + # enable iproute2 module if you want this folder to be created buildFlags = [ - "CONFDIR=/etc/iproute2" + "CONFDIR=${config.iproute2.confDir or "/run/iproute2"}" ]; installFlags = [ diff --git a/pkgs/os-specific/linux/iptables/default.nix b/pkgs/os-specific/linux/iptables/default.nix index 1668933db809..0c088ac2a4bc 100644 --- a/pkgs/os-specific/linux/iptables/default.nix +++ b/pkgs/os-specific/linux/iptables/default.nix @@ -6,7 +6,7 @@ stdenv.mkDerivation rec { version = "1.6.2"; src = fetchurl { - url = "http://www.netfilter.org/projects/iptables/files/${name}.tar.bz2"; + url = "https://www.netfilter.org/projects/iptables/files/${name}.tar.bz2"; sha256 = "0crp0lvh5m2f15pr8cw97h8yb8zjj10x95zj06j46cr68vx2vl2m"; }; diff --git a/pkgs/os-specific/linux/irqbalance/default.nix b/pkgs/os-specific/linux/irqbalance/default.nix index 76c10f0a06e8..439b2aff6afc 100644 --- a/pkgs/os-specific/linux/irqbalance/default.nix +++ b/pkgs/os-specific/linux/irqbalance/default.nix @@ -2,13 +2,13 @@ stdenv.mkDerivation rec { name = "irqbalance-${version}"; - version = "1.3.0"; + version = "1.4.0"; src = fetchFromGitHub { owner = "irqbalance"; repo = "irqbalance"; rev = "v${version}"; - sha256 = "009777p5v72x4r58skqgaf03qv3app9b8lkxkpxq0226l0x3j4qh"; + sha256 = "05q3cdz2a5zp5s2bdz5a80y9vq7awqw9lbvyvh6vjs9a8vg80hwm"; }; nativeBuildInputs = [ autoreconfHook pkgconfig ]; diff --git a/pkgs/os-specific/linux/iwd/default.nix b/pkgs/os-specific/linux/iwd/default.nix index a1c577d2bb57..792c7bcb0849 100644 --- a/pkgs/os-specific/linux/iwd/default.nix +++ b/pkgs/os-specific/linux/iwd/default.nix @@ -3,17 +3,17 @@ let ell = fetchgit { url = https://git.kernel.org/pub/scm/libs/ell/ell.git; - rev = "0.4"; - sha256 = "0l203n1jnqa2mcifir8ydxhcvbiwlvk89ailm0lida83l9vdlwpv"; + rev = "0.5"; + sha256 = "0xw53bigh99nhacjb67qs1g145fwls7065l8vsrziwzpkyd5s6a8"; }; in stdenv.mkDerivation rec { name = "iwd-${version}"; - version = "0.1"; + version = "0.2"; src = fetchgit { url = https://git.kernel.org/pub/scm/network/wireless/iwd.git; rev = version; - sha256 = "1f8c6xvcvqw8z78mskynd2fkghggcl7vfz8vxzvpx0fkqcprn5n0"; + sha256 = "0khc017s27n6y6c6wbqhmcghzggnagxbi8j36hl5g73y6s44vx42"; }; nativeBuildInputs = [ diff --git a/pkgs/os-specific/linux/kernel/common-config.nix b/pkgs/os-specific/linux/kernel/common-config.nix index 4af5889fd1cd..93732f1c6f84 100644 --- a/pkgs/os-specific/linux/kernel/common-config.nix +++ b/pkgs/os-specific/linux/kernel/common-config.nix @@ -37,7 +37,12 @@ with stdenv.lib; DEBUG_STACKOVERFLOW n SCHEDSTATS n DETECT_HUNG_TASK y - DEBUG_INFO n # Not until we implement a separate debug output + + ${if (features.debug or false) then '' + DEBUG_INFO y + '' else '' + DEBUG_INFO n + ''} ${optionalString (versionOlder version "4.4") '' CPU_NOTIFIER_ERROR_INJECT? n @@ -209,6 +214,11 @@ with stdenv.lib; ${optionalString (versionOlder version "4.3") '' DRM_I915_KMS y ''} + # iGVT-g support + ${optionalString (versionAtLeast version "4.16") '' + DRM_I915_GVT y + DRM_I915_GVT_KVMGT m + ''} # Allow specifying custom EDID on the kernel command line DRM_LOAD_EDID_FIRMWARE y VGA_SWITCHEROO y # Hybrid graphics support @@ -358,7 +368,7 @@ with stdenv.lib; ${optionalString (! stdenv.hostPlatform.isAarch32) (if versionOlder version "3.14" then '' CC_STACKPROTECTOR? y # Detect buffer overflows on the stack - '' else '' + '' else optionalString (versionOlder version "4.18") '' CC_STACKPROTECTOR_REGULAR? y '')} ${optionalString (versionAtLeast version "3.12") '' @@ -453,6 +463,7 @@ with stdenv.lib; PPP_FILTER y REGULATOR y # Voltage and Current Regulator Support RC_DEVICES? y # Enable IR devices + RT2800USB_RT53XX y RT2800USB_RT55XX y SCHED_AUTOGROUP y CFS_BANDWIDTH y @@ -637,6 +648,11 @@ with stdenv.lib; IRQ_REMAP y ''} + # needed for iwd WPS support (wpa_supplicant replacement) + ${optionalString (versionAtLeast version "4.7") '' + KEY_DH_OPERATIONS y + ''} + # Disable the firmware helper fallback, udev doesn't implement it any more FW_LOADER_USER_HELPER_FALLBACK? n @@ -674,10 +690,12 @@ with stdenv.lib; CRC32_SELFTEST? n CRYPTO_TEST? n - DRM_DEBUG_MM_SELFTEST? n + ${optionalString (versionOlder version "4.18") '' + DRM_DEBUG_MM_SELFTEST? n + LNET_SELFTEST? n + ''} EFI_TEST? n GLOB_SELFTEST? n - LNET_SELFTEST? n LOCK_TORTURE_TEST? n MTD_TESTS? n NOTIFIER_ERROR_INJECTION? n @@ -704,9 +722,5 @@ with stdenv.lib; DEBUG_MEMORY_INIT? y ''} - ${optionalString (features.debug or false) '' - DEBUG_INFO y - ''} - ${extraConfig} '' diff --git a/pkgs/os-specific/linux/kernel/copperhead-4-14.patch b/pkgs/os-specific/linux/kernel/copperhead-4-14.patch new file mode 100644 index 000000000000..78112d164f06 --- /dev/null +++ b/pkgs/os-specific/linux/kernel/copperhead-4-14.patch @@ -0,0 +1,2864 @@ +diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt +index 0380a45ecf4b..39956a3ef645 100644 +--- a/Documentation/admin-guide/kernel-parameters.txt ++++ b/Documentation/admin-guide/kernel-parameters.txt +@@ -490,16 +490,6 @@ + nosocket -- Disable socket memory accounting. + nokmem -- Disable kernel memory accounting. + +- checkreqprot [SELINUX] Set initial checkreqprot flag value. +- Format: { "0" | "1" } +- See security/selinux/Kconfig help text. +- 0 -- check protection applied by kernel (includes +- any implied execute protection). +- 1 -- check protection requested by application. +- Default value is set via a kernel config option. +- Value can be changed at runtime via +- /selinux/checkreqprot. +- + cio_ignore= [S390] + See Documentation/s390/CommonIO for details. + clk_ignore_unused +@@ -2899,6 +2889,11 @@ + the specified number of seconds. This is to be used if + your oopses keep scrolling off the screen. + ++ extra_latent_entropy ++ Enable a very simple form of latent entropy extraction ++ from the first 4GB of memory as the bootmem allocator ++ passes the memory pages to the buddy allocator. ++ + pcbit= [HW,ISDN] + + pcd. [PARIDE] +diff --git a/Documentation/sysctl/kernel.txt b/Documentation/sysctl/kernel.txt +index 694968c7523c..002d86416ef8 100644 +--- a/Documentation/sysctl/kernel.txt ++++ b/Documentation/sysctl/kernel.txt +@@ -91,6 +91,7 @@ show up in /proc/sys/kernel: + - sysctl_writes_strict + - tainted + - threads-max ++- tiocsti_restrict + - unknown_nmi_panic + - watchdog + - watchdog_thresh +@@ -999,6 +1000,26 @@ available RAM pages threads-max is reduced accordingly. + + ============================================================== + ++tiocsti_restrict: ++ ++This toggle indicates whether unprivileged users are prevented ++from using the TIOCSTI ioctl to inject commands into other processes ++which share a tty session. ++ ++When tiocsti_restrict is set to (0) there are no restrictions(accept ++the default restriction of only being able to injection commands into ++one's own tty). When tiocsti_restrict is set to (1), users must ++have CAP_SYS_ADMIN to use the TIOCSTI ioctl. ++ ++When user namespaces are in use, the check for the capability ++CAP_SYS_ADMIN is done against the user namespace that originally ++opened the tty. ++ ++The kernel config option CONFIG_SECURITY_TIOCSTI_RESTRICT sets the ++default value of tiocsti_restrict. ++ ++============================================================== ++ + unknown_nmi_panic: + + The value in this file affects behavior of handling NMI. When the +diff --git a/Makefile b/Makefile +index 787cf6605209..e4fda5330730 100644 +--- a/Makefile ++++ b/Makefile +@@ -710,6 +710,9 @@ endif + KBUILD_CFLAGS += $(stackp-flag) + + ifeq ($(cc-name),clang) ++ifdef CONFIG_LOCAL_INIT ++KBUILD_CFLAGS += -fsanitize=local-init ++endif + KBUILD_CPPFLAGS += $(call cc-option,-Qunused-arguments,) + KBUILD_CFLAGS += $(call cc-disable-warning, unused-variable) + KBUILD_CFLAGS += $(call cc-disable-warning, format-invalid-specifier) +diff --git a/arch/Kconfig b/arch/Kconfig +index 400b9e1b2f27..4637096f7902 100644 +--- a/arch/Kconfig ++++ b/arch/Kconfig +@@ -440,6 +440,11 @@ config GCC_PLUGIN_LATENT_ENTROPY + is some slowdown of the boot process (about 0.5%) and fork and + irq processing. + ++ When extra_latent_entropy is passed on the kernel command line, ++ entropy will be extracted from up to the first 4GB of RAM while the ++ runtime memory allocator is being initialized. This costs even more ++ slowdown of the boot process. ++ + Note that entropy extracted this way is not cryptographically + secure! + +@@ -533,7 +538,7 @@ config CC_STACKPROTECTOR + choice + prompt "Stack Protector buffer overflow detection" + depends on HAVE_CC_STACKPROTECTOR +- default CC_STACKPROTECTOR_NONE ++ default CC_STACKPROTECTOR_STRONG + help + This option turns on the "stack-protector" GCC feature. This + feature puts, at the beginning of functions, a canary value on +@@ -735,7 +740,7 @@ config ARCH_MMAP_RND_BITS + int "Number of bits to use for ASLR of mmap base address" if EXPERT + range ARCH_MMAP_RND_BITS_MIN ARCH_MMAP_RND_BITS_MAX + default ARCH_MMAP_RND_BITS_DEFAULT if ARCH_MMAP_RND_BITS_DEFAULT +- default ARCH_MMAP_RND_BITS_MIN ++ default ARCH_MMAP_RND_BITS_MAX + depends on HAVE_ARCH_MMAP_RND_BITS + help + This value can be used to select the number of bits to use to +@@ -769,7 +774,7 @@ config ARCH_MMAP_RND_COMPAT_BITS + int "Number of bits to use for ASLR of mmap base address for compatible applications" if EXPERT + range ARCH_MMAP_RND_COMPAT_BITS_MIN ARCH_MMAP_RND_COMPAT_BITS_MAX + default ARCH_MMAP_RND_COMPAT_BITS_DEFAULT if ARCH_MMAP_RND_COMPAT_BITS_DEFAULT +- default ARCH_MMAP_RND_COMPAT_BITS_MIN ++ default ARCH_MMAP_RND_COMPAT_BITS_MAX + depends on HAVE_ARCH_MMAP_RND_COMPAT_BITS + help + This value can be used to select the number of bits to use to +@@ -952,6 +957,7 @@ config ARCH_HAS_REFCOUNT + + config REFCOUNT_FULL + bool "Perform full reference count validation at the expense of speed" ++ default y + help + Enabling this switches the refcounting infrastructure from a fast + unchecked atomic_t implementation to a fully state checked +diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig +index 2d5f7aca156d..aa4839a74c6a 100644 +--- a/arch/arm64/Kconfig ++++ b/arch/arm64/Kconfig +@@ -918,6 +918,7 @@ endif + + config ARM64_SW_TTBR0_PAN + bool "Emulate Privileged Access Never using TTBR0_EL1 switching" ++ default y + help + Enabling this option prevents the kernel from accessing + user-space memory directly by pointing TTBR0_EL1 to a reserved +@@ -1044,6 +1045,7 @@ config RANDOMIZE_BASE + bool "Randomize the address of the kernel image" + select ARM64_MODULE_PLTS if MODULES + select RELOCATABLE ++ default y + help + Randomizes the virtual address at which the kernel image is + loaded, as a security feature that deters exploit attempts +diff --git a/arch/arm64/Kconfig.debug b/arch/arm64/Kconfig.debug +index cc6bd559af85..01d5442d4722 100644 +--- a/arch/arm64/Kconfig.debug ++++ b/arch/arm64/Kconfig.debug +@@ -45,6 +45,7 @@ config ARM64_RANDOMIZE_TEXT_OFFSET + config DEBUG_WX + bool "Warn on W+X mappings at boot" + select ARM64_PTDUMP_CORE ++ default y + ---help--- + Generate a warning if any W+X mappings are found at boot. + +diff --git a/arch/arm64/configs/defconfig b/arch/arm64/configs/defconfig +index 34480e9af2e7..26304242250c 100644 +--- a/arch/arm64/configs/defconfig ++++ b/arch/arm64/configs/defconfig +@@ -1,4 +1,3 @@ +-CONFIG_SYSVIPC=y + CONFIG_POSIX_MQUEUE=y + CONFIG_AUDIT=y + CONFIG_NO_HZ_IDLE=y +diff --git a/arch/arm64/include/asm/elf.h b/arch/arm64/include/asm/elf.h +index 33be513ef24c..6f0c0e3ef0dd 100644 +--- a/arch/arm64/include/asm/elf.h ++++ b/arch/arm64/include/asm/elf.h +@@ -114,10 +114,10 @@ + + /* + * This is the base location for PIE (ET_DYN with INTERP) loads. On +- * 64-bit, this is above 4GB to leave the entire 32-bit address ++ * 64-bit, this is raised to 4GB to leave the entire 32-bit address + * space open for things that want to use the area for 32-bit pointers. + */ +-#define ELF_ET_DYN_BASE (2 * TASK_SIZE_64 / 3) ++#define ELF_ET_DYN_BASE 0x100000000UL + + #ifndef __ASSEMBLY__ + +@@ -158,10 +158,10 @@ extern int arch_setup_additional_pages(struct linux_binprm *bprm, + /* 1GB of VA */ + #ifdef CONFIG_COMPAT + #define STACK_RND_MASK (test_thread_flag(TIF_32BIT) ? \ +- 0x7ff >> (PAGE_SHIFT - 12) : \ +- 0x3ffff >> (PAGE_SHIFT - 12)) ++ ((1UL << mmap_rnd_compat_bits) - 1) >> (PAGE_SHIFT - 12) : \ ++ ((1UL << mmap_rnd_bits) - 1) >> (PAGE_SHIFT - 12)) + #else +-#define STACK_RND_MASK (0x3ffff >> (PAGE_SHIFT - 12)) ++#define STACK_RND_MASK (((1UL << mmap_rnd_bits) - 1) >> (PAGE_SHIFT - 12)) + #endif + + #ifdef __AARCH64EB__ +diff --git a/arch/arm64/kernel/process.c b/arch/arm64/kernel/process.c +index 9e773732520c..91359f45b5fc 100644 +--- a/arch/arm64/kernel/process.c ++++ b/arch/arm64/kernel/process.c +@@ -419,9 +419,9 @@ unsigned long arch_align_stack(unsigned long sp) + unsigned long arch_randomize_brk(struct mm_struct *mm) + { + if (is_compat_task()) +- return randomize_page(mm->brk, SZ_32M); ++ return mm->brk + get_random_long() % SZ_32M + PAGE_SIZE; + else +- return randomize_page(mm->brk, SZ_1G); ++ return mm->brk + get_random_long() % SZ_1G + PAGE_SIZE; + } + + /* +diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig +index 7483cd514c32..835a86c45fb0 100644 +--- a/arch/x86/Kconfig ++++ b/arch/x86/Kconfig +@@ -1153,8 +1153,7 @@ config VM86 + default X86_LEGACY_VM86 + + config X86_16BIT +- bool "Enable support for 16-bit segments" if EXPERT +- default y ++ bool "Enable support for 16-bit segments" + depends on MODIFY_LDT_SYSCALL + ---help--- + This option is required by programs like Wine to run 16-bit +@@ -2228,7 +2227,7 @@ config COMPAT_VDSO + choice + prompt "vsyscall table for legacy applications" + depends on X86_64 +- default LEGACY_VSYSCALL_EMULATE ++ default LEGACY_VSYSCALL_NONE + help + Legacy user code that does not know how to find the vDSO expects + to be able to issue three syscalls by calling fixed addresses in +@@ -2318,8 +2317,7 @@ config CMDLINE_OVERRIDE + be set to 'N' under normal conditions. + + config MODIFY_LDT_SYSCALL +- bool "Enable the LDT (local descriptor table)" if EXPERT +- default y ++ bool "Enable the LDT (local descriptor table)" + ---help--- + Linux can allow user programs to install a per-process x86 + Local Descriptor Table (LDT) using the modify_ldt(2) system +diff --git a/arch/x86/Kconfig.debug b/arch/x86/Kconfig.debug +index 6293a8768a91..add82e0f1df3 100644 +--- a/arch/x86/Kconfig.debug ++++ b/arch/x86/Kconfig.debug +@@ -101,6 +101,7 @@ config EFI_PGT_DUMP + config DEBUG_WX + bool "Warn on W+X mappings at boot" + select X86_PTDUMP_CORE ++ default y + ---help--- + Generate a warning if any W+X mappings are found at boot. + +diff --git a/arch/x86/configs/x86_64_defconfig b/arch/x86/configs/x86_64_defconfig +index e32fc1f274d8..d08acc76502a 100644 +--- a/arch/x86/configs/x86_64_defconfig ++++ b/arch/x86/configs/x86_64_defconfig +@@ -1,5 +1,4 @@ + # CONFIG_LOCALVERSION_AUTO is not set +-CONFIG_SYSVIPC=y + CONFIG_POSIX_MQUEUE=y + CONFIG_BSD_PROCESS_ACCT=y + CONFIG_TASKSTATS=y +diff --git a/arch/x86/entry/vdso/vma.c b/arch/x86/entry/vdso/vma.c +index 1911310959f8..bba8dbbc07a8 100644 +--- a/arch/x86/entry/vdso/vma.c ++++ b/arch/x86/entry/vdso/vma.c +@@ -203,55 +203,9 @@ static int map_vdso(const struct vdso_image *image, unsigned long addr) + } + + #ifdef CONFIG_X86_64 +-/* +- * Put the vdso above the (randomized) stack with another randomized +- * offset. This way there is no hole in the middle of address space. +- * To save memory make sure it is still in the same PTE as the stack +- * top. This doesn't give that many random bits. +- * +- * Note that this algorithm is imperfect: the distribution of the vdso +- * start address within a PMD is biased toward the end. +- * +- * Only used for the 64-bit and x32 vdsos. +- */ +-static unsigned long vdso_addr(unsigned long start, unsigned len) +-{ +- unsigned long addr, end; +- unsigned offset; +- +- /* +- * Round up the start address. It can start out unaligned as a result +- * of stack start randomization. +- */ +- start = PAGE_ALIGN(start); +- +- /* Round the lowest possible end address up to a PMD boundary. */ +- end = (start + len + PMD_SIZE - 1) & PMD_MASK; +- if (end >= TASK_SIZE_MAX) +- end = TASK_SIZE_MAX; +- end -= len; +- +- if (end > start) { +- offset = get_random_int() % (((end - start) >> PAGE_SHIFT) + 1); +- addr = start + (offset << PAGE_SHIFT); +- } else { +- addr = start; +- } +- +- /* +- * Forcibly align the final address in case we have a hardware +- * issue that requires alignment for performance reasons. +- */ +- addr = align_vdso_addr(addr); +- +- return addr; +-} +- + static int map_vdso_randomized(const struct vdso_image *image) + { +- unsigned long addr = vdso_addr(current->mm->start_stack, image->size-image->sym_vvar_start); +- +- return map_vdso(image, addr); ++ return map_vdso(image, 0); + } + #endif + +diff --git a/arch/x86/include/asm/elf.h b/arch/x86/include/asm/elf.h +index 3a091cea36c5..0931c05a3348 100644 +--- a/arch/x86/include/asm/elf.h ++++ b/arch/x86/include/asm/elf.h +@@ -249,11 +249,11 @@ extern int force_personality32; + + /* + * This is the base location for PIE (ET_DYN with INTERP) loads. On +- * 64-bit, this is above 4GB to leave the entire 32-bit address ++ * 64-bit, this is raised to 4GB to leave the entire 32-bit address + * space open for things that want to use the area for 32-bit pointers. + */ + #define ELF_ET_DYN_BASE (mmap_is_ia32() ? 0x000400000UL : \ +- (DEFAULT_MAP_WINDOW / 3 * 2)) ++ 0x100000000UL) + + /* This yields a mask that user programs can use to figure out what + instruction set this CPU supports. This could be done in user space, +@@ -312,8 +312,8 @@ extern unsigned long get_mmap_base(int is_legacy); + + #ifdef CONFIG_X86_32 + +-#define __STACK_RND_MASK(is32bit) (0x7ff) +-#define STACK_RND_MASK (0x7ff) ++#define __STACK_RND_MASK(is32bit) ((1UL << mmap_rnd_bits) - 1) ++#define STACK_RND_MASK ((1UL << mmap_rnd_bits) - 1) + + #define ARCH_DLINFO ARCH_DLINFO_IA32 + +@@ -322,7 +322,11 @@ extern unsigned long get_mmap_base(int is_legacy); + #else /* CONFIG_X86_32 */ + + /* 1GB for 64bit, 8MB for 32bit */ +-#define __STACK_RND_MASK(is32bit) ((is32bit) ? 0x7ff : 0x3fffff) ++#ifdef CONFIG_COMPAT ++#define __STACK_RND_MASK(is32bit) ((is32bit) ? (1UL << mmap_rnd_compat_bits) - 1 : (1UL << mmap_rnd_bits) - 1) ++#else ++#define __STACK_RND_MASK(is32bit) ((1UL << mmap_rnd_bits) - 1) ++#endif + #define STACK_RND_MASK __STACK_RND_MASK(mmap_is_ia32()) + + #define ARCH_DLINFO \ +@@ -380,5 +384,4 @@ struct va_alignment { + } ____cacheline_aligned; + + extern struct va_alignment va_align; +-extern unsigned long align_vdso_addr(unsigned long); + #endif /* _ASM_X86_ELF_H */ +diff --git a/arch/x86/include/asm/tlbflush.h b/arch/x86/include/asm/tlbflush.h +index 704f31315dde..bb82b6344a7b 100644 +--- a/arch/x86/include/asm/tlbflush.h ++++ b/arch/x86/include/asm/tlbflush.h +@@ -253,6 +253,7 @@ static inline void cr4_set_bits(unsigned long mask) + unsigned long cr4; + + cr4 = this_cpu_read(cpu_tlbstate.cr4); ++ BUG_ON(cr4 != __read_cr4()); + if ((cr4 | mask) != cr4) { + cr4 |= mask; + this_cpu_write(cpu_tlbstate.cr4, cr4); +@@ -266,6 +267,7 @@ static inline void cr4_clear_bits(unsigned long mask) + unsigned long cr4; + + cr4 = this_cpu_read(cpu_tlbstate.cr4); ++ BUG_ON(cr4 != __read_cr4()); + if ((cr4 & ~mask) != cr4) { + cr4 &= ~mask; + this_cpu_write(cpu_tlbstate.cr4, cr4); +@@ -278,6 +280,7 @@ static inline void cr4_toggle_bits(unsigned long mask) + unsigned long cr4; + + cr4 = this_cpu_read(cpu_tlbstate.cr4); ++ BUG_ON(cr4 != __read_cr4()); + cr4 ^= mask; + this_cpu_write(cpu_tlbstate.cr4, cr4); + __write_cr4(cr4); +@@ -386,6 +389,7 @@ static inline void __native_flush_tlb_global(void) + raw_local_irq_save(flags); + + cr4 = this_cpu_read(cpu_tlbstate.cr4); ++ BUG_ON(cr4 != __read_cr4()); + /* toggle PGE */ + native_write_cr4(cr4 ^ X86_CR4_PGE); + /* write old PGE again and flush TLBs */ +diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c +index 48e98964ecad..a94dc690612f 100644 +--- a/arch/x86/kernel/cpu/common.c ++++ b/arch/x86/kernel/cpu/common.c +@@ -1637,7 +1637,6 @@ void cpu_init(void) + wrmsrl(MSR_KERNEL_GS_BASE, 0); + barrier(); + +- x86_configure_nx(); + x2apic_setup(); + + /* +diff --git a/arch/x86/kernel/process.c b/arch/x86/kernel/process.c +index 988a98f34c66..dc36d2d9078a 100644 +--- a/arch/x86/kernel/process.c ++++ b/arch/x86/kernel/process.c +@@ -40,6 +40,8 @@ + #include <asm/desc.h> + #include <asm/prctl.h> + #include <asm/spec-ctrl.h> ++#include <asm/elf.h> ++#include <linux/sizes.h> + + /* + * per-CPU TSS segments. Threads are completely 'soft' on Linux, +@@ -719,7 +721,10 @@ unsigned long arch_align_stack(unsigned long sp) + + unsigned long arch_randomize_brk(struct mm_struct *mm) + { +- return randomize_page(mm->brk, 0x02000000); ++ if (mmap_is_ia32()) ++ return mm->brk + get_random_long() % SZ_32M + PAGE_SIZE; ++ else ++ return mm->brk + get_random_long() % SZ_1G + PAGE_SIZE; + } + + /* +diff --git a/arch/x86/kernel/sys_x86_64.c b/arch/x86/kernel/sys_x86_64.c +index a63fe77b3217..e1085e76043e 100644 +--- a/arch/x86/kernel/sys_x86_64.c ++++ b/arch/x86/kernel/sys_x86_64.c +@@ -54,13 +54,6 @@ static unsigned long get_align_bits(void) + return va_align.bits & get_align_mask(); + } + +-unsigned long align_vdso_addr(unsigned long addr) +-{ +- unsigned long align_mask = get_align_mask(); +- addr = (addr + align_mask) & ~align_mask; +- return addr | get_align_bits(); +-} +- + static int __init control_va_addr_alignment(char *str) + { + /* guard against enabling this on other CPU families */ +@@ -122,10 +115,7 @@ static void find_start_end(unsigned long addr, unsigned long flags, + } + + *begin = get_mmap_base(1); +- if (in_compat_syscall()) +- *end = task_size_32bit(); +- else +- *end = task_size_64bit(addr > DEFAULT_MAP_WINDOW); ++ *end = get_mmap_base(0); + } + + unsigned long +@@ -206,7 +196,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0, + + info.flags = VM_UNMAPPED_AREA_TOPDOWN; + info.length = len; +- info.low_limit = PAGE_SIZE; ++ info.low_limit = get_mmap_base(1); + info.high_limit = get_mmap_base(0); + + /* +diff --git a/arch/x86/mm/init_32.c b/arch/x86/mm/init_32.c +index 3141e67ec24c..e93173193f60 100644 +--- a/arch/x86/mm/init_32.c ++++ b/arch/x86/mm/init_32.c +@@ -558,7 +558,7 @@ static void __init pagetable_init(void) + permanent_kmaps_init(pgd_base); + } + +-pteval_t __supported_pte_mask __read_mostly = ~(_PAGE_NX | _PAGE_GLOBAL); ++pteval_t __supported_pte_mask __ro_after_init = ~(_PAGE_NX | _PAGE_GLOBAL); + EXPORT_SYMBOL_GPL(__supported_pte_mask); + + /* user-defined highmem size */ +@@ -865,7 +865,7 @@ int arch_remove_memory(u64 start, u64 size) + #endif + #endif + +-int kernel_set_to_readonly __read_mostly; ++int kernel_set_to_readonly __ro_after_init; + + void set_kernel_text_rw(void) + { +@@ -917,12 +917,11 @@ void mark_rodata_ro(void) + unsigned long start = PFN_ALIGN(_text); + unsigned long size = PFN_ALIGN(_etext) - start; + ++ kernel_set_to_readonly = 1; + set_pages_ro(virt_to_page(start), size >> PAGE_SHIFT); + printk(KERN_INFO "Write protecting the kernel text: %luk\n", + size >> 10); + +- kernel_set_to_readonly = 1; +- + #ifdef CONFIG_CPA_DEBUG + printk(KERN_INFO "Testing CPA: Reverting %lx-%lx\n", + start, start+size); +diff --git a/arch/x86/mm/init_64.c b/arch/x86/mm/init_64.c +index 642357aff216..8bbf93ce3cd2 100644 +--- a/arch/x86/mm/init_64.c ++++ b/arch/x86/mm/init_64.c +@@ -65,7 +65,7 @@ + * around without checking the pgd every time. + */ + +-pteval_t __supported_pte_mask __read_mostly = ~0; ++pteval_t __supported_pte_mask __ro_after_init = ~0; + EXPORT_SYMBOL_GPL(__supported_pte_mask); + + int force_personality32; +@@ -1185,7 +1185,7 @@ void __init mem_init(void) + mem_init_print_info(NULL); + } + +-int kernel_set_to_readonly; ++int kernel_set_to_readonly __ro_after_init; + + void set_kernel_text_rw(void) + { +@@ -1234,9 +1234,8 @@ void mark_rodata_ro(void) + + printk(KERN_INFO "Write protecting the kernel read-only data: %luk\n", + (end - start) >> 10); +- set_memory_ro(start, (end - start) >> PAGE_SHIFT); +- + kernel_set_to_readonly = 1; ++ set_memory_ro(start, (end - start) >> PAGE_SHIFT); + + /* + * The rodata/data/bss/brk section (but not the kernel text!) +diff --git a/block/blk-softirq.c b/block/blk-softirq.c +index 01e2b353a2b9..9aeddca4a29f 100644 +--- a/block/blk-softirq.c ++++ b/block/blk-softirq.c +@@ -20,7 +20,7 @@ static DEFINE_PER_CPU(struct list_head, blk_cpu_done); + * Softirq action handler - move entries to local list and loop over them + * while passing them to the queue registered handler. + */ +-static __latent_entropy void blk_done_softirq(struct softirq_action *h) ++static __latent_entropy void blk_done_softirq(void) + { + struct list_head *cpu_list, local_list; + +diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c +index 473f150d6b22..65a65f9824ed 100644 +--- a/drivers/ata/libata-core.c ++++ b/drivers/ata/libata-core.c +@@ -5141,7 +5141,7 @@ void ata_qc_free(struct ata_queued_cmd *qc) + struct ata_port *ap; + unsigned int tag; + +- WARN_ON_ONCE(qc == NULL); /* ata_qc_from_tag _might_ return NULL */ ++ BUG_ON(qc == NULL); /* ata_qc_from_tag _might_ return NULL */ + ap = qc->ap; + + qc->flags = 0; +@@ -5158,7 +5158,7 @@ void __ata_qc_complete(struct ata_queued_cmd *qc) + struct ata_port *ap; + struct ata_link *link; + +- WARN_ON_ONCE(qc == NULL); /* ata_qc_from_tag _might_ return NULL */ ++ BUG_ON(qc == NULL); /* ata_qc_from_tag _might_ return NULL */ + WARN_ON_ONCE(!(qc->flags & ATA_QCFLAG_ACTIVE)); + ap = qc->ap; + link = qc->dev->link; +diff --git a/drivers/char/Kconfig b/drivers/char/Kconfig +index c28dca0c613d..d4813f0d25ca 100644 +--- a/drivers/char/Kconfig ++++ b/drivers/char/Kconfig +@@ -9,7 +9,6 @@ source "drivers/tty/Kconfig" + + config DEVMEM + bool "/dev/mem virtual device support" +- default y + help + Say Y here if you want to support the /dev/mem device. + The /dev/mem device is used to access areas of physical +@@ -568,7 +567,6 @@ config TELCLOCK + config DEVPORT + bool "/dev/port character device" + depends on ISA || PCI +- default y + help + Say Y here if you want to support the /dev/port device. The /dev/port + device is similar to /dev/mem, but for I/O ports. +diff --git a/drivers/media/dvb-frontends/cx24116.c b/drivers/media/dvb-frontends/cx24116.c +index e105532bfba8..e07d52bb9b62 100644 +--- a/drivers/media/dvb-frontends/cx24116.c ++++ b/drivers/media/dvb-frontends/cx24116.c +@@ -1462,7 +1462,7 @@ static int cx24116_tune(struct dvb_frontend *fe, bool re_tune, + return cx24116_read_status(fe, status); + } + +-static int cx24116_get_algo(struct dvb_frontend *fe) ++static enum dvbfe_algo cx24116_get_algo(struct dvb_frontend *fe) + { + return DVBFE_ALGO_HW; + } +diff --git a/drivers/media/dvb-frontends/cx24117.c b/drivers/media/dvb-frontends/cx24117.c +index d37cb7762bd6..97e0feff0ede 100644 +--- a/drivers/media/dvb-frontends/cx24117.c ++++ b/drivers/media/dvb-frontends/cx24117.c +@@ -1555,7 +1555,7 @@ static int cx24117_tune(struct dvb_frontend *fe, bool re_tune, + return cx24117_read_status(fe, status); + } + +-static int cx24117_get_algo(struct dvb_frontend *fe) ++static enum dvbfe_algo cx24117_get_algo(struct dvb_frontend *fe) + { + return DVBFE_ALGO_HW; + } +diff --git a/drivers/media/dvb-frontends/cx24120.c b/drivers/media/dvb-frontends/cx24120.c +index 7f11dcc94d85..01da670760ba 100644 +--- a/drivers/media/dvb-frontends/cx24120.c ++++ b/drivers/media/dvb-frontends/cx24120.c +@@ -1491,7 +1491,7 @@ static int cx24120_tune(struct dvb_frontend *fe, bool re_tune, + return cx24120_read_status(fe, status); + } + +-static int cx24120_get_algo(struct dvb_frontend *fe) ++static enum dvbfe_algo cx24120_get_algo(struct dvb_frontend *fe) + { + return DVBFE_ALGO_HW; + } +diff --git a/drivers/media/dvb-frontends/cx24123.c b/drivers/media/dvb-frontends/cx24123.c +index 1d59d1d3bd82..41cd0e9ea199 100644 +--- a/drivers/media/dvb-frontends/cx24123.c ++++ b/drivers/media/dvb-frontends/cx24123.c +@@ -1005,7 +1005,7 @@ static int cx24123_tune(struct dvb_frontend *fe, + return retval; + } + +-static int cx24123_get_algo(struct dvb_frontend *fe) ++static enum dvbfe_algo cx24123_get_algo(struct dvb_frontend *fe) + { + return DVBFE_ALGO_HW; + } +diff --git a/drivers/media/dvb-frontends/cxd2820r_core.c b/drivers/media/dvb-frontends/cxd2820r_core.c +index f6ebbb47b9b2..3e0d8cbd76da 100644 +--- a/drivers/media/dvb-frontends/cxd2820r_core.c ++++ b/drivers/media/dvb-frontends/cxd2820r_core.c +@@ -403,7 +403,7 @@ static enum dvbfe_search cxd2820r_search(struct dvb_frontend *fe) + return DVBFE_ALGO_SEARCH_ERROR; + } + +-static int cxd2820r_get_frontend_algo(struct dvb_frontend *fe) ++static enum dvbfe_algo cxd2820r_get_frontend_algo(struct dvb_frontend *fe) + { + return DVBFE_ALGO_CUSTOM; + } +diff --git a/drivers/media/dvb-frontends/mb86a20s.c b/drivers/media/dvb-frontends/mb86a20s.c +index e8ac8c3e2ec0..e0f4ba8302d1 100644 +--- a/drivers/media/dvb-frontends/mb86a20s.c ++++ b/drivers/media/dvb-frontends/mb86a20s.c +@@ -2055,7 +2055,7 @@ static void mb86a20s_release(struct dvb_frontend *fe) + kfree(state); + } + +-static int mb86a20s_get_frontend_algo(struct dvb_frontend *fe) ++static enum dvbfe_algo mb86a20s_get_frontend_algo(struct dvb_frontend *fe) + { + return DVBFE_ALGO_HW; + } +diff --git a/drivers/media/dvb-frontends/s921.c b/drivers/media/dvb-frontends/s921.c +index 274544a3ae0e..9ef9b9bc1bd2 100644 +--- a/drivers/media/dvb-frontends/s921.c ++++ b/drivers/media/dvb-frontends/s921.c +@@ -464,7 +464,7 @@ static int s921_tune(struct dvb_frontend *fe, + return rc; + } + +-static int s921_get_algo(struct dvb_frontend *fe) ++static enum dvbfe_algo s921_get_algo(struct dvb_frontend *fe) + { + return DVBFE_ALGO_HW; + } +diff --git a/drivers/media/pci/bt8xx/dst.c b/drivers/media/pci/bt8xx/dst.c +index 7166d2279465..fa682f9fdc4b 100644 +--- a/drivers/media/pci/bt8xx/dst.c ++++ b/drivers/media/pci/bt8xx/dst.c +@@ -1657,7 +1657,7 @@ static int dst_tune_frontend(struct dvb_frontend* fe, + return 0; + } + +-static int dst_get_tuning_algo(struct dvb_frontend *fe) ++static enum dvbfe_algo dst_get_tuning_algo(struct dvb_frontend *fe) + { + return dst_algo ? DVBFE_ALGO_HW : DVBFE_ALGO_SW; + } +diff --git a/drivers/media/pci/pt1/va1j5jf8007s.c b/drivers/media/pci/pt1/va1j5jf8007s.c +index f75f69556be7..d913a6050e8c 100644 +--- a/drivers/media/pci/pt1/va1j5jf8007s.c ++++ b/drivers/media/pci/pt1/va1j5jf8007s.c +@@ -98,7 +98,7 @@ static int va1j5jf8007s_read_snr(struct dvb_frontend *fe, u16 *snr) + return 0; + } + +-static int va1j5jf8007s_get_frontend_algo(struct dvb_frontend *fe) ++static enum dvbfe_algo va1j5jf8007s_get_frontend_algo(struct dvb_frontend *fe) + { + return DVBFE_ALGO_HW; + } +diff --git a/drivers/media/pci/pt1/va1j5jf8007t.c b/drivers/media/pci/pt1/va1j5jf8007t.c +index 63fda79a75c0..4115c3ccd4a8 100644 +--- a/drivers/media/pci/pt1/va1j5jf8007t.c ++++ b/drivers/media/pci/pt1/va1j5jf8007t.c +@@ -88,7 +88,7 @@ static int va1j5jf8007t_read_snr(struct dvb_frontend *fe, u16 *snr) + return 0; + } + +-static int va1j5jf8007t_get_frontend_algo(struct dvb_frontend *fe) ++static enum dvbfe_algo va1j5jf8007t_get_frontend_algo(struct dvb_frontend *fe) + { + return DVBFE_ALGO_HW; + } +diff --git a/drivers/misc/lkdtm_core.c b/drivers/misc/lkdtm_core.c +index 981b3ef71e47..9883da1da383 100644 +--- a/drivers/misc/lkdtm_core.c ++++ b/drivers/misc/lkdtm_core.c +@@ -78,7 +78,7 @@ static irqreturn_t jp_handle_irq_event(unsigned int irq, + return 0; + } + +-static void jp_tasklet_action(struct softirq_action *a) ++static void jp_tasklet_action(void) + { + lkdtm_handler(); + jprobe_return(); +diff --git a/drivers/tty/Kconfig b/drivers/tty/Kconfig +index b811442c5ce6..4f62a63cbcb1 100644 +--- a/drivers/tty/Kconfig ++++ b/drivers/tty/Kconfig +@@ -122,7 +122,6 @@ config UNIX98_PTYS + + config LEGACY_PTYS + bool "Legacy (BSD) PTY support" +- default y + ---help--- + A pseudo terminal (PTY) is a software device consisting of two + halves: a master and a slave. The slave device behaves identical to +diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c +index 562d31073f9a..2184b9b5485f 100644 +--- a/drivers/tty/tty_io.c ++++ b/drivers/tty/tty_io.c +@@ -171,6 +171,7 @@ static void free_tty_struct(struct tty_struct *tty) + put_device(tty->dev); + kfree(tty->write_buf); + tty->magic = 0xDEADDEAD; ++ put_user_ns(tty->owner_user_ns); + kfree(tty); + } + +@@ -2154,11 +2155,19 @@ static int tty_fasync(int fd, struct file *filp, int on) + * FIXME: may race normal receive processing + */ + ++int tiocsti_restrict = IS_ENABLED(CONFIG_SECURITY_TIOCSTI_RESTRICT); ++ + static int tiocsti(struct tty_struct *tty, char __user *p) + { + char ch, mbz = 0; + struct tty_ldisc *ld; + ++ if (tiocsti_restrict && ++ !ns_capable(tty->owner_user_ns, CAP_SYS_ADMIN)) { ++ dev_warn_ratelimited(tty->dev, ++ "Denied TIOCSTI ioctl for non-privileged process\n"); ++ return -EPERM; ++ } + if ((current->signal->tty != tty) && !capable(CAP_SYS_ADMIN)) + return -EPERM; + if (get_user(ch, p)) +@@ -2841,6 +2850,7 @@ struct tty_struct *alloc_tty_struct(struct tty_driver *driver, int idx) + tty->index = idx; + tty_line_name(driver, idx, tty->name); + tty->dev = tty_get_device(tty); ++ tty->owner_user_ns = get_user_ns(current_user_ns()); + + return tty; + } +diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c +index 442be7f312f6..788557d5c454 100644 +--- a/drivers/usb/core/hub.c ++++ b/drivers/usb/core/hub.c +@@ -38,6 +38,8 @@ + #define USB_VENDOR_GENESYS_LOGIC 0x05e3 + #define HUB_QUIRK_CHECK_PORT_AUTOSUSPEND 0x01 + ++extern int deny_new_usb; ++ + /* Protect struct usb_device->state and ->children members + * Note: Both are also protected by ->dev.sem, except that ->state can + * change to USB_STATE_NOTATTACHED even when the semaphore isn't held. */ +@@ -4806,6 +4808,12 @@ static void hub_port_connect(struct usb_hub *hub, int port1, u16 portstatus, + goto done; + return; + } ++ ++ if (deny_new_usb) { ++ dev_err(&port_dev->dev, "denied insert of USB device on port %d\n", port1); ++ goto done; ++ } ++ + if (hub_is_superspeed(hub->hdev)) + unit_load = 150; + else +diff --git a/fs/exec.c b/fs/exec.c +index 0da4d748b4e6..69fcee853363 100644 +--- a/fs/exec.c ++++ b/fs/exec.c +@@ -62,6 +62,7 @@ + #include <linux/oom.h> + #include <linux/compat.h> + #include <linux/vmalloc.h> ++#include <linux/random.h> + + #include <linux/uaccess.h> + #include <asm/mmu_context.h> +@@ -321,6 +322,8 @@ static int __bprm_mm_init(struct linux_binprm *bprm) + arch_bprm_mm_init(mm, vma); + up_write(&mm->mmap_sem); + bprm->p = vma->vm_end - sizeof(void *); ++ if (randomize_va_space) ++ bprm->p ^= get_random_int() & ~PAGE_MASK; + return 0; + err: + up_write(&mm->mmap_sem); +diff --git a/fs/namei.c b/fs/namei.c +index 0b46b858cd42..3ae8e72341da 100644 +--- a/fs/namei.c ++++ b/fs/namei.c +@@ -902,8 +902,8 @@ static inline void put_link(struct nameidata *nd) + path_put(&last->link); + } + +-int sysctl_protected_symlinks __read_mostly = 0; +-int sysctl_protected_hardlinks __read_mostly = 0; ++int sysctl_protected_symlinks __read_mostly = 1; ++int sysctl_protected_hardlinks __read_mostly = 1; + + /** + * may_follow_link - Check symlink following for unsafe situations +diff --git a/fs/nfs/Kconfig b/fs/nfs/Kconfig +index 5f93cfacb3d1..cea0d7d3b23e 100644 +--- a/fs/nfs/Kconfig ++++ b/fs/nfs/Kconfig +@@ -195,4 +195,3 @@ config NFS_DEBUG + bool + depends on NFS_FS && SUNRPC_DEBUG + select CRC32 +- default y +diff --git a/fs/pipe.c b/fs/pipe.c +index 8ef7d7bef775..b82f305ec13d 100644 +--- a/fs/pipe.c ++++ b/fs/pipe.c +@@ -38,7 +38,7 @@ unsigned int pipe_max_size = 1048576; + /* + * Minimum pipe size, as required by POSIX + */ +-unsigned int pipe_min_size = PAGE_SIZE; ++unsigned int pipe_min_size __read_only = PAGE_SIZE; + + /* Maximum allocatable pages per user. Hard limit is unset by default, soft + * matches default values. +diff --git a/fs/proc/Kconfig b/fs/proc/Kconfig +index 1ade1206bb89..60b0f76dec47 100644 +--- a/fs/proc/Kconfig ++++ b/fs/proc/Kconfig +@@ -39,7 +39,6 @@ config PROC_KCORE + config PROC_VMCORE + bool "/proc/vmcore support" + depends on PROC_FS && CRASH_DUMP +- default y + help + Exports the dump image of crashed kernel in ELF format. + +diff --git a/fs/stat.c b/fs/stat.c +index 873785dae022..d3c2ada8b9c7 100644 +--- a/fs/stat.c ++++ b/fs/stat.c +@@ -40,8 +40,13 @@ void generic_fillattr(struct inode *inode, struct kstat *stat) + stat->gid = inode->i_gid; + stat->rdev = inode->i_rdev; + stat->size = i_size_read(inode); +- stat->atime = inode->i_atime; +- stat->mtime = inode->i_mtime; ++ if (is_sidechannel_device(inode) && !capable_noaudit(CAP_MKNOD)) { ++ stat->atime = inode->i_ctime; ++ stat->mtime = inode->i_ctime; ++ } else { ++ stat->atime = inode->i_atime; ++ stat->mtime = inode->i_mtime; ++ } + stat->ctime = inode->i_ctime; + stat->blksize = i_blocksize(inode); + stat->blocks = inode->i_blocks; +@@ -75,9 +80,14 @@ int vfs_getattr_nosec(const struct path *path, struct kstat *stat, + stat->result_mask |= STATX_BASIC_STATS; + request_mask &= STATX_ALL; + query_flags &= KSTAT_QUERY_FLAGS; +- if (inode->i_op->getattr) +- return inode->i_op->getattr(path, stat, request_mask, +- query_flags); ++ if (inode->i_op->getattr) { ++ int retval = inode->i_op->getattr(path, stat, request_mask, query_flags); ++ if (!retval && is_sidechannel_device(inode) && !capable_noaudit(CAP_MKNOD)) { ++ stat->atime = stat->ctime; ++ stat->mtime = stat->ctime; ++ } ++ return retval; ++ } + + generic_fillattr(inode, stat); + return 0; +diff --git a/include/linux/cache.h b/include/linux/cache.h +index 750621e41d1c..e7157c18c62c 100644 +--- a/include/linux/cache.h ++++ b/include/linux/cache.h +@@ -31,6 +31,8 @@ + #define __ro_after_init __attribute__((__section__(".data..ro_after_init"))) + #endif + ++#define __read_only __ro_after_init ++ + #ifndef ____cacheline_aligned + #define ____cacheline_aligned __attribute__((__aligned__(SMP_CACHE_BYTES))) + #endif +diff --git a/include/linux/capability.h b/include/linux/capability.h +index f640dcbc880c..2b4f5d651f19 100644 +--- a/include/linux/capability.h ++++ b/include/linux/capability.h +@@ -207,6 +207,7 @@ extern bool has_capability_noaudit(struct task_struct *t, int cap); + extern bool has_ns_capability_noaudit(struct task_struct *t, + struct user_namespace *ns, int cap); + extern bool capable(int cap); ++extern bool capable_noaudit(int cap); + extern bool ns_capable(struct user_namespace *ns, int cap); + extern bool ns_capable_noaudit(struct user_namespace *ns, int cap); + #else +@@ -232,6 +233,10 @@ static inline bool capable(int cap) + { + return true; + } ++static inline bool capable_noaudit(int cap) ++{ ++ return true; ++} + static inline bool ns_capable(struct user_namespace *ns, int cap) + { + return true; +diff --git a/include/linux/fs.h b/include/linux/fs.h +index cc613f20e5a6..7606596d6c2e 100644 +--- a/include/linux/fs.h ++++ b/include/linux/fs.h +@@ -3392,4 +3392,15 @@ static inline bool dir_relax_shared(struct inode *inode) + extern bool path_noexec(const struct path *path); + extern void inode_nohighmem(struct inode *inode); + ++extern int device_sidechannel_restrict; ++ ++static inline bool is_sidechannel_device(const struct inode *inode) ++{ ++ umode_t mode; ++ if (!device_sidechannel_restrict) ++ return false; ++ mode = inode->i_mode; ++ return ((S_ISCHR(mode) || S_ISBLK(mode)) && (mode & (S_IROTH | S_IWOTH))); ++} ++ + #endif /* _LINUX_FS_H */ +diff --git a/include/linux/fsnotify.h b/include/linux/fsnotify.h +index bdaf22582f6e..326ff15d4637 100644 +--- a/include/linux/fsnotify.h ++++ b/include/linux/fsnotify.h +@@ -181,6 +181,9 @@ static inline void fsnotify_access(struct file *file) + struct inode *inode = path->dentry->d_inode; + __u32 mask = FS_ACCESS; + ++ if (is_sidechannel_device(inode)) ++ return; ++ + if (S_ISDIR(inode->i_mode)) + mask |= FS_ISDIR; + +@@ -199,6 +202,9 @@ static inline void fsnotify_modify(struct file *file) + struct inode *inode = path->dentry->d_inode; + __u32 mask = FS_MODIFY; + ++ if (is_sidechannel_device(inode)) ++ return; ++ + if (S_ISDIR(inode->i_mode)) + mask |= FS_ISDIR; + +diff --git a/include/linux/gfp.h b/include/linux/gfp.h +index b041f94678de..a5e0175c79e0 100644 +--- a/include/linux/gfp.h ++++ b/include/linux/gfp.h +@@ -518,9 +518,9 @@ extern struct page *alloc_pages_vma(gfp_t gfp_mask, int order, + extern unsigned long __get_free_pages(gfp_t gfp_mask, unsigned int order); + extern unsigned long get_zeroed_page(gfp_t gfp_mask); + +-void *alloc_pages_exact(size_t size, gfp_t gfp_mask); ++void *alloc_pages_exact(size_t size, gfp_t gfp_mask) __attribute__((alloc_size(1))); + void free_pages_exact(void *virt, size_t size); +-void * __meminit alloc_pages_exact_nid(int nid, size_t size, gfp_t gfp_mask); ++void * __meminit alloc_pages_exact_nid(int nid, size_t size, gfp_t gfp_mask) __attribute__((alloc_size(1))); + + #define __get_free_page(gfp_mask) \ + __get_free_pages((gfp_mask), 0) +diff --git a/include/linux/highmem.h b/include/linux/highmem.h +index 776f90f3a1cd..3f5c47000059 100644 +--- a/include/linux/highmem.h ++++ b/include/linux/highmem.h +@@ -191,6 +191,13 @@ static inline void clear_highpage(struct page *page) + kunmap_atomic(kaddr); + } + ++static inline void verify_zero_highpage(struct page *page) ++{ ++ void *kaddr = kmap_atomic(page); ++ BUG_ON(memchr_inv(kaddr, 0, PAGE_SIZE)); ++ kunmap_atomic(kaddr); ++} ++ + static inline void zero_user_segments(struct page *page, + unsigned start1, unsigned end1, + unsigned start2, unsigned end2) +diff --git a/include/linux/interrupt.h b/include/linux/interrupt.h +index 69c238210325..ee487ea4f48f 100644 +--- a/include/linux/interrupt.h ++++ b/include/linux/interrupt.h +@@ -485,7 +485,7 @@ extern const char * const softirq_to_name[NR_SOFTIRQS]; + + struct softirq_action + { +- void (*action)(struct softirq_action *); ++ void (*action)(void); + }; + + asmlinkage void do_softirq(void); +@@ -500,7 +500,7 @@ static inline void do_softirq_own_stack(void) + } + #endif + +-extern void open_softirq(int nr, void (*action)(struct softirq_action *)); ++extern void __init open_softirq(int nr, void (*action)(void)); + extern void softirq_init(void); + extern void __raise_softirq_irqoff(unsigned int nr); + +diff --git a/include/linux/kobject_ns.h b/include/linux/kobject_ns.h +index df32d2508290..c992d130b94d 100644 +--- a/include/linux/kobject_ns.h ++++ b/include/linux/kobject_ns.h +@@ -46,7 +46,7 @@ struct kobj_ns_type_operations { + void (*drop_ns)(void *); + }; + +-int kobj_ns_type_register(const struct kobj_ns_type_operations *ops); ++int __init kobj_ns_type_register(const struct kobj_ns_type_operations *ops); + int kobj_ns_type_registered(enum kobj_ns_type type); + const struct kobj_ns_type_operations *kobj_child_ns_ops(struct kobject *parent); + const struct kobj_ns_type_operations *kobj_ns_ops(struct kobject *kobj); +diff --git a/include/linux/mm.h b/include/linux/mm.h +index f23215854c80..98df98c44cc0 100644 +--- a/include/linux/mm.h ++++ b/include/linux/mm.h +@@ -525,7 +525,7 @@ static inline int is_vmalloc_or_module_addr(const void *x) + } + #endif + +-extern void *kvmalloc_node(size_t size, gfp_t flags, int node); ++extern void *kvmalloc_node(size_t size, gfp_t flags, int node) __attribute__((alloc_size(1))); + static inline void *kvmalloc(size_t size, gfp_t flags) + { + return kvmalloc_node(size, flags, NUMA_NO_NODE); +diff --git a/include/linux/percpu.h b/include/linux/percpu.h +index 296bbe49d5d1..b26652c9a98d 100644 +--- a/include/linux/percpu.h ++++ b/include/linux/percpu.h +@@ -129,7 +129,7 @@ extern int __init pcpu_page_first_chunk(size_t reserved_size, + pcpu_fc_populate_pte_fn_t populate_pte_fn); + #endif + +-extern void __percpu *__alloc_reserved_percpu(size_t size, size_t align); ++extern void __percpu *__alloc_reserved_percpu(size_t size, size_t align) __attribute__((alloc_size(1))); + extern bool __is_kernel_percpu_address(unsigned long addr, unsigned long *can_addr); + extern bool is_kernel_percpu_address(unsigned long addr); + +@@ -137,8 +137,8 @@ extern bool is_kernel_percpu_address(unsigned long addr); + extern void __init setup_per_cpu_areas(void); + #endif + +-extern void __percpu *__alloc_percpu_gfp(size_t size, size_t align, gfp_t gfp); +-extern void __percpu *__alloc_percpu(size_t size, size_t align); ++extern void __percpu *__alloc_percpu_gfp(size_t size, size_t align, gfp_t gfp) __attribute__((alloc_size(1))); ++extern void __percpu *__alloc_percpu(size_t size, size_t align) __attribute__((alloc_size(1))); + extern void free_percpu(void __percpu *__pdata); + extern phys_addr_t per_cpu_ptr_to_phys(void *addr); + +diff --git a/include/linux/perf_event.h b/include/linux/perf_event.h +index 8e22f24ded6a..b7fecdfa6de5 100644 +--- a/include/linux/perf_event.h ++++ b/include/linux/perf_event.h +@@ -1165,6 +1165,11 @@ extern int perf_cpu_time_max_percent_handler(struct ctl_table *table, int write, + int perf_event_max_stack_handler(struct ctl_table *table, int write, + void __user *buffer, size_t *lenp, loff_t *ppos); + ++static inline bool perf_paranoid_any(void) ++{ ++ return sysctl_perf_event_paranoid > 2; ++} ++ + static inline bool perf_paranoid_tracepoint_raw(void) + { + return sysctl_perf_event_paranoid > -1; +diff --git a/include/linux/slab.h b/include/linux/slab.h +index ae5ed6492d54..fd0786124504 100644 +--- a/include/linux/slab.h ++++ b/include/linux/slab.h +@@ -146,8 +146,8 @@ void memcg_destroy_kmem_caches(struct mem_cgroup *); + /* + * Common kmalloc functions provided by all allocators + */ +-void * __must_check __krealloc(const void *, size_t, gfp_t); +-void * __must_check krealloc(const void *, size_t, gfp_t); ++void * __must_check __krealloc(const void *, size_t, gfp_t) __attribute__((alloc_size(2))); ++void * __must_check krealloc(const void *, size_t, gfp_t) __attribute((alloc_size(2))); + void kfree(const void *); + void kzfree(const void *); + size_t ksize(const void *); +@@ -324,7 +324,7 @@ static __always_inline int kmalloc_index(size_t size) + } + #endif /* !CONFIG_SLOB */ + +-void *__kmalloc(size_t size, gfp_t flags) __assume_kmalloc_alignment __malloc; ++void *__kmalloc(size_t size, gfp_t flags) __assume_kmalloc_alignment __malloc __attribute__((alloc_size(1))); + void *kmem_cache_alloc(struct kmem_cache *, gfp_t flags) __assume_slab_alignment __malloc; + void kmem_cache_free(struct kmem_cache *, void *); + +@@ -348,7 +348,7 @@ static __always_inline void kfree_bulk(size_t size, void **p) + } + + #ifdef CONFIG_NUMA +-void *__kmalloc_node(size_t size, gfp_t flags, int node) __assume_kmalloc_alignment __malloc; ++void *__kmalloc_node(size_t size, gfp_t flags, int node) __assume_kmalloc_alignment __malloc __attribute__((alloc_size(1))); + void *kmem_cache_alloc_node(struct kmem_cache *, gfp_t flags, int node) __assume_slab_alignment __malloc; + #else + static __always_inline void *__kmalloc_node(size_t size, gfp_t flags, int node) +@@ -473,7 +473,7 @@ static __always_inline void *kmalloc_large(size_t size, gfp_t flags) + * for general use, and so are not documented here. For a full list of + * potential flags, always refer to linux/gfp.h. + */ +-static __always_inline void *kmalloc(size_t size, gfp_t flags) ++static __always_inline __attribute__((alloc_size(1))) void *kmalloc(size_t size, gfp_t flags) + { + if (__builtin_constant_p(size)) { + if (size > KMALLOC_MAX_CACHE_SIZE) +@@ -513,7 +513,7 @@ static __always_inline int kmalloc_size(int n) + return 0; + } + +-static __always_inline void *kmalloc_node(size_t size, gfp_t flags, int node) ++static __always_inline __attribute__((alloc_size(1))) void *kmalloc_node(size_t size, gfp_t flags, int node) + { + #ifndef CONFIG_SLOB + if (__builtin_constant_p(size) && +diff --git a/include/linux/slub_def.h b/include/linux/slub_def.h +index 39fa09bcde23..0b7a48cd883b 100644 +--- a/include/linux/slub_def.h ++++ b/include/linux/slub_def.h +@@ -120,6 +120,11 @@ struct kmem_cache { + unsigned long random; + #endif + ++#ifdef CONFIG_SLAB_CANARY ++ unsigned long random_active; ++ unsigned long random_inactive; ++#endif ++ + #ifdef CONFIG_NUMA + /* + * Defragmentation by allocating from a remote node. +diff --git a/include/linux/string.h b/include/linux/string.h +index cfd83eb2f926..b9ecb42c762d 100644 +--- a/include/linux/string.h ++++ b/include/linux/string.h +@@ -234,10 +234,16 @@ void __read_overflow2(void) __compiletime_error("detected read beyond size of ob + void __read_overflow3(void) __compiletime_error("detected read beyond size of object passed as 3rd parameter"); + void __write_overflow(void) __compiletime_error("detected write beyond size of object passed as 1st parameter"); + ++#ifdef CONFIG_FORTIFY_SOURCE_STRICT_STRING ++#define __string_size(p) __builtin_object_size(p, 1) ++#else ++#define __string_size(p) __builtin_object_size(p, 0) ++#endif ++ + #if !defined(__NO_FORTIFY) && defined(__OPTIMIZE__) && defined(CONFIG_FORTIFY_SOURCE) + __FORTIFY_INLINE char *strncpy(char *p, const char *q, __kernel_size_t size) + { +- size_t p_size = __builtin_object_size(p, 0); ++ size_t p_size = __string_size(p); + if (__builtin_constant_p(size) && p_size < size) + __write_overflow(); + if (p_size < size) +@@ -247,7 +253,7 @@ __FORTIFY_INLINE char *strncpy(char *p, const char *q, __kernel_size_t size) + + __FORTIFY_INLINE char *strcat(char *p, const char *q) + { +- size_t p_size = __builtin_object_size(p, 0); ++ size_t p_size = __string_size(p); + if (p_size == (size_t)-1) + return __builtin_strcat(p, q); + if (strlcat(p, q, p_size) >= p_size) +@@ -258,7 +264,7 @@ __FORTIFY_INLINE char *strcat(char *p, const char *q) + __FORTIFY_INLINE __kernel_size_t strlen(const char *p) + { + __kernel_size_t ret; +- size_t p_size = __builtin_object_size(p, 0); ++ size_t p_size = __string_size(p); + + /* Work around gcc excess stack consumption issue */ + if (p_size == (size_t)-1 || +@@ -273,7 +279,7 @@ __FORTIFY_INLINE __kernel_size_t strlen(const char *p) + extern __kernel_size_t __real_strnlen(const char *, __kernel_size_t) __RENAME(strnlen); + __FORTIFY_INLINE __kernel_size_t strnlen(const char *p, __kernel_size_t maxlen) + { +- size_t p_size = __builtin_object_size(p, 0); ++ size_t p_size = __string_size(p); + __kernel_size_t ret = __real_strnlen(p, maxlen < p_size ? maxlen : p_size); + if (p_size <= ret && maxlen != ret) + fortify_panic(__func__); +@@ -285,8 +291,8 @@ extern size_t __real_strlcpy(char *, const char *, size_t) __RENAME(strlcpy); + __FORTIFY_INLINE size_t strlcpy(char *p, const char *q, size_t size) + { + size_t ret; +- size_t p_size = __builtin_object_size(p, 0); +- size_t q_size = __builtin_object_size(q, 0); ++ size_t p_size = __string_size(p); ++ size_t q_size = __string_size(q); + if (p_size == (size_t)-1 && q_size == (size_t)-1) + return __real_strlcpy(p, q, size); + ret = strlen(q); +@@ -306,8 +312,8 @@ __FORTIFY_INLINE size_t strlcpy(char *p, const char *q, size_t size) + __FORTIFY_INLINE char *strncat(char *p, const char *q, __kernel_size_t count) + { + size_t p_len, copy_len; +- size_t p_size = __builtin_object_size(p, 0); +- size_t q_size = __builtin_object_size(q, 0); ++ size_t p_size = __string_size(p); ++ size_t q_size = __string_size(q); + if (p_size == (size_t)-1 && q_size == (size_t)-1) + return __builtin_strncat(p, q, count); + p_len = strlen(p); +@@ -420,8 +426,8 @@ __FORTIFY_INLINE void *kmemdup(const void *p, size_t size, gfp_t gfp) + /* defined after fortified strlen and memcpy to reuse them */ + __FORTIFY_INLINE char *strcpy(char *p, const char *q) + { +- size_t p_size = __builtin_object_size(p, 0); +- size_t q_size = __builtin_object_size(q, 0); ++ size_t p_size = __string_size(p); ++ size_t q_size = __string_size(q); + if (p_size == (size_t)-1 && q_size == (size_t)-1) + return __builtin_strcpy(p, q); + memcpy(p, q, strlen(q) + 1); +diff --git a/include/linux/tty.h b/include/linux/tty.h +index 1dd587ba6d88..9a9a04fb641d 100644 +--- a/include/linux/tty.h ++++ b/include/linux/tty.h +@@ -13,6 +13,7 @@ + #include <uapi/linux/tty.h> + #include <linux/rwsem.h> + #include <linux/llist.h> ++#include <linux/user_namespace.h> + + + /* +@@ -335,6 +336,7 @@ struct tty_struct { + /* If the tty has a pending do_SAK, queue it here - akpm */ + struct work_struct SAK_work; + struct tty_port *port; ++ struct user_namespace *owner_user_ns; + } __randomize_layout; + + /* Each of a tty's open files has private_data pointing to tty_file_private */ +@@ -344,6 +346,8 @@ struct tty_file_private { + struct list_head list; + }; + ++extern int tiocsti_restrict; ++ + /* tty magic number */ + #define TTY_MAGIC 0x5401 + +diff --git a/include/linux/vmalloc.h b/include/linux/vmalloc.h +index 1e5d8c392f15..66d0e49c9987 100644 +--- a/include/linux/vmalloc.h ++++ b/include/linux/vmalloc.h +@@ -68,19 +68,19 @@ static inline void vmalloc_init(void) + } + #endif + +-extern void *vmalloc(unsigned long size); +-extern void *vzalloc(unsigned long size); +-extern void *vmalloc_user(unsigned long size); +-extern void *vmalloc_node(unsigned long size, int node); +-extern void *vzalloc_node(unsigned long size, int node); +-extern void *vmalloc_exec(unsigned long size); +-extern void *vmalloc_32(unsigned long size); +-extern void *vmalloc_32_user(unsigned long size); +-extern void *__vmalloc(unsigned long size, gfp_t gfp_mask, pgprot_t prot); ++extern void *vmalloc(unsigned long size) __attribute__((alloc_size(1))); ++extern void *vzalloc(unsigned long size) __attribute__((alloc_size(1))); ++extern void *vmalloc_user(unsigned long size) __attribute__((alloc_size(1))); ++extern void *vmalloc_node(unsigned long size, int node) __attribute__((alloc_size(1))); ++extern void *vzalloc_node(unsigned long size, int node) __attribute__((alloc_size(1))); ++extern void *vmalloc_exec(unsigned long size) __attribute__((alloc_size(1))); ++extern void *vmalloc_32(unsigned long size) __attribute__((alloc_size(1))); ++extern void *vmalloc_32_user(unsigned long size) __attribute__((alloc_size(1))); ++extern void *__vmalloc(unsigned long size, gfp_t gfp_mask, pgprot_t prot) __attribute__((alloc_size(1))); + extern void *__vmalloc_node_range(unsigned long size, unsigned long align, + unsigned long start, unsigned long end, gfp_t gfp_mask, + pgprot_t prot, unsigned long vm_flags, int node, +- const void *caller); ++ const void *caller) __attribute__((alloc_size(1))); + #ifndef CONFIG_MMU + extern void *__vmalloc_node_flags(unsigned long size, int node, gfp_t flags); + static inline void *__vmalloc_node_flags_caller(unsigned long size, int node, +diff --git a/init/Kconfig b/init/Kconfig +index 46075327c165..0c78750bc76d 100644 +--- a/init/Kconfig ++++ b/init/Kconfig +@@ -309,6 +309,7 @@ config USELIB + config AUDIT + bool "Auditing support" + depends on NET ++ default y + help + Enable auditing infrastructure that can be used with another + kernel subsystem, such as SELinux (which requires this for +@@ -1052,6 +1053,12 @@ config CC_OPTIMIZE_FOR_SIZE + + endchoice + ++config LOCAL_INIT ++ bool "Zero uninitialized locals" ++ help ++ Zero-fill uninitialized local variables, other than variable-length ++ arrays. Requires compiler support. ++ + config SYSCTL + bool + +@@ -1361,8 +1368,7 @@ config SHMEM + which may be appropriate on small systems without swap. + + config AIO +- bool "Enable AIO support" if EXPERT +- default y ++ bool "Enable AIO support" + help + This option enables POSIX asynchronous I/O which may by used + by some high performance threaded applications. Disabling +@@ -1491,7 +1497,7 @@ config VM_EVENT_COUNTERS + + config SLUB_DEBUG + default y +- bool "Enable SLUB debugging support" if EXPERT ++ bool "Enable SLUB debugging support" + depends on SLUB && SYSFS + help + SLUB has extensive debug support features. Disabling these can +@@ -1515,7 +1521,6 @@ config SLUB_MEMCG_SYSFS_ON + + config COMPAT_BRK + bool "Disable heap randomization" +- default y + help + Randomizing heap placement makes heap exploits harder, but it + also breaks ancient binaries (including anything libc5 based). +@@ -1562,7 +1567,6 @@ endchoice + + config SLAB_MERGE_DEFAULT + bool "Allow slab caches to be merged" +- default y + help + For reduced kernel memory fragmentation, slab caches can be + merged when they share the same size and other characteristics. +@@ -1575,9 +1579,9 @@ config SLAB_MERGE_DEFAULT + command line. + + config SLAB_FREELIST_RANDOM +- default n + depends on SLAB || SLUB + bool "SLAB freelist randomization" ++ default y + help + Randomizes the freelist order used on creating new pages. This + security feature reduces the predictability of the kernel slab +@@ -1586,12 +1590,56 @@ config SLAB_FREELIST_RANDOM + config SLAB_FREELIST_HARDENED + bool "Harden slab freelist metadata" + depends on SLUB ++ default y + help + Many kernel heap attacks try to target slab cache metadata and + other infrastructure. This options makes minor performance + sacrifies to harden the kernel slab allocator against common + freelist exploit methods. + ++config SLAB_HARDENED ++ default y ++ depends on SLUB ++ bool "Hardened SLAB infrastructure" ++ help ++ Make minor performance sacrifices to harden the kernel slab ++ allocator. ++ ++config SLAB_CANARY ++ depends on SLUB ++ depends on !SLAB_MERGE_DEFAULT ++ bool "SLAB canaries" ++ default y ++ help ++ Place canaries at the end of kernel slab allocations, sacrificing ++ some performance and memory usage for security. ++ ++ Canaries can detect some forms of heap corruption when allocations ++ are freed and as part of the HARDENED_USERCOPY feature. It provides ++ basic use-after-free detection for HARDENED_USERCOPY. ++ ++ Canaries absorb small overflows (rendering them harmless), mitigate ++ non-NUL terminated C string overflows on 64-bit via a guaranteed zero ++ byte and provide basic double-free detection. ++ ++config SLAB_SANITIZE ++ bool "Sanitize SLAB allocations" ++ depends on SLUB ++ default y ++ help ++ Zero fill slab allocations on free, reducing the lifetime of ++ sensitive data and helping to mitigate use-after-free bugs. ++ ++ For slabs with debug poisoning enabling, this has no impact. ++ ++config SLAB_SANITIZE_VERIFY ++ depends on SLAB_SANITIZE && PAGE_SANITIZE ++ default y ++ bool "Verify sanitized SLAB allocations" ++ help ++ Verify that newly allocated slab allocations are zeroed to detect ++ write-after-free bugs. ++ + config SLUB_CPU_PARTIAL + default y + depends on SLUB && SMP +diff --git a/kernel/audit.c b/kernel/audit.c +index 5b34d3114af4..e57930192ce1 100644 +--- a/kernel/audit.c ++++ b/kernel/audit.c +@@ -1573,6 +1573,9 @@ static int __init audit_enable(char *str) + audit_default = !!simple_strtol(str, NULL, 0); + if (!audit_default) + audit_initialized = AUDIT_DISABLED; ++ else ++ audit_initialized = AUDIT_UNINITIALIZED; ++ + audit_enabled = audit_default; + audit_ever_enabled = !!audit_enabled; + +diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c +index d203a5d6b726..2a6c3e2c57a6 100644 +--- a/kernel/bpf/core.c ++++ b/kernel/bpf/core.c +@@ -539,7 +539,7 @@ void __weak bpf_jit_free(struct bpf_prog *fp) + bpf_prog_unlock_free(fp); + } + +-int bpf_jit_harden __read_mostly; ++int bpf_jit_harden __read_mostly = 2; + + static int bpf_jit_blind_insn(const struct bpf_insn *from, + const struct bpf_insn *aux, +diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c +index 4e933219fec6..0f37db32a2b1 100644 +--- a/kernel/bpf/syscall.c ++++ b/kernel/bpf/syscall.c +@@ -37,7 +37,7 @@ static DEFINE_SPINLOCK(prog_idr_lock); + static DEFINE_IDR(map_idr); + static DEFINE_SPINLOCK(map_idr_lock); + +-int sysctl_unprivileged_bpf_disabled __read_mostly; ++int sysctl_unprivileged_bpf_disabled __read_mostly = 1; + + static const struct bpf_map_ops * const bpf_map_types[] = { + #define BPF_PROG_TYPE(_id, _ops) +diff --git a/kernel/capability.c b/kernel/capability.c +index 1e1c0236f55b..452062fe45ce 100644 +--- a/kernel/capability.c ++++ b/kernel/capability.c +@@ -431,6 +431,12 @@ bool capable(int cap) + return ns_capable(&init_user_ns, cap); + } + EXPORT_SYMBOL(capable); ++ ++bool capable_noaudit(int cap) ++{ ++ return ns_capable_noaudit(&init_user_ns, cap); ++} ++EXPORT_SYMBOL(capable_noaudit); + #endif /* CONFIG_MULTIUSER */ + + /** +diff --git a/kernel/events/core.c b/kernel/events/core.c +index cb8274d7824f..c1b3d232b0a4 100644 +--- a/kernel/events/core.c ++++ b/kernel/events/core.c +@@ -397,8 +397,13 @@ static cpumask_var_t perf_online_mask; + * 0 - disallow raw tracepoint access for unpriv + * 1 - disallow cpu events for unpriv + * 2 - disallow kernel profiling for unpriv ++ * 3 - disallow all unpriv perf event use + */ ++#ifdef CONFIG_SECURITY_PERF_EVENTS_RESTRICT ++int sysctl_perf_event_paranoid __read_mostly = 3; ++#else + int sysctl_perf_event_paranoid __read_mostly = 2; ++#endif + + /* Minimum for 512 kiB + 1 user control page */ + int sysctl_perf_event_mlock __read_mostly = 512 + (PAGE_SIZE / 1024); /* 'free' kiB per user */ +@@ -9941,6 +9946,9 @@ SYSCALL_DEFINE5(perf_event_open, + if (flags & ~PERF_FLAG_ALL) + return -EINVAL; + ++ if (perf_paranoid_any() && !capable(CAP_SYS_ADMIN)) ++ return -EACCES; ++ + err = perf_copy_attr(attr_uptr, &attr); + if (err) + return err; +diff --git a/kernel/fork.c b/kernel/fork.c +index 98c91bd341b4..dbb9540ee61c 100644 +--- a/kernel/fork.c ++++ b/kernel/fork.c +@@ -102,6 +102,11 @@ + + #define CREATE_TRACE_POINTS + #include <trace/events/task.h> ++#ifdef CONFIG_USER_NS ++extern int unprivileged_userns_clone; ++#else ++#define unprivileged_userns_clone 0 ++#endif + + /* + * Minimum number of threads to boot the kernel +@@ -1554,6 +1559,10 @@ static __latent_entropy struct task_struct *copy_process( + if ((clone_flags & (CLONE_NEWUSER|CLONE_FS)) == (CLONE_NEWUSER|CLONE_FS)) + return ERR_PTR(-EINVAL); + ++ if ((clone_flags & CLONE_NEWUSER) && !unprivileged_userns_clone) ++ if (!capable(CAP_SYS_ADMIN)) ++ return ERR_PTR(-EPERM); ++ + /* + * Thread groups must share signals as well, and detached threads + * can only be started up within the thread group. +@@ -2347,6 +2356,12 @@ SYSCALL_DEFINE1(unshare, unsigned long, unshare_flags) + if (unshare_flags & CLONE_NEWNS) + unshare_flags |= CLONE_FS; + ++ if ((unshare_flags & CLONE_NEWUSER) && !unprivileged_userns_clone) { ++ err = -EPERM; ++ if (!capable(CAP_SYS_ADMIN)) ++ goto bad_unshare_out; ++ } ++ + err = check_unshare_flags(unshare_flags); + if (err) + goto bad_unshare_out; +diff --git a/kernel/power/snapshot.c b/kernel/power/snapshot.c +index 0972a8e09d08..00dde7aad47a 100644 +--- a/kernel/power/snapshot.c ++++ b/kernel/power/snapshot.c +@@ -1136,7 +1136,7 @@ void free_basic_memory_bitmaps(void) + + void clear_free_pages(void) + { +-#ifdef CONFIG_PAGE_POISONING_ZERO ++#if defined(CONFIG_PAGE_POISONING_ZERO) || defined(CONFIG_PAGE_SANITIZE) + struct memory_bitmap *bm = free_pages_map; + unsigned long pfn; + +@@ -1153,7 +1153,7 @@ void clear_free_pages(void) + } + memory_bm_position_reset(bm); + pr_info("PM: free pages cleared after restore\n"); +-#endif /* PAGE_POISONING_ZERO */ ++#endif /* PAGE_POISONING_ZERO || PAGE_SANITIZE */ + } + + /** +diff --git a/kernel/rcu/tiny.c b/kernel/rcu/tiny.c +index a64eee0db39e..4d7de378fe4c 100644 +--- a/kernel/rcu/tiny.c ++++ b/kernel/rcu/tiny.c +@@ -164,7 +164,7 @@ static void __rcu_process_callbacks(struct rcu_ctrlblk *rcp) + } + } + +-static __latent_entropy void rcu_process_callbacks(struct softirq_action *unused) ++static __latent_entropy void rcu_process_callbacks(void) + { + __rcu_process_callbacks(&rcu_sched_ctrlblk); + __rcu_process_callbacks(&rcu_bh_ctrlblk); +diff --git a/kernel/rcu/tree.c b/kernel/rcu/tree.c +index 3e3650e94ae6..7ecd7a5d04b3 100644 +--- a/kernel/rcu/tree.c ++++ b/kernel/rcu/tree.c +@@ -2918,7 +2918,7 @@ __rcu_process_callbacks(struct rcu_state *rsp) + /* + * Do RCU core processing for the current CPU. + */ +-static __latent_entropy void rcu_process_callbacks(struct softirq_action *unused) ++static __latent_entropy void rcu_process_callbacks(void) + { + struct rcu_state *rsp; + +diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c +index 5c09ddf8c832..f5db6ece105a 100644 +--- a/kernel/sched/fair.c ++++ b/kernel/sched/fair.c +@@ -8986,7 +8986,7 @@ static void nohz_idle_balance(struct rq *this_rq, enum cpu_idle_type idle) { } + * run_rebalance_domains is triggered when needed from the scheduler tick. + * Also triggered for nohz idle balancing (with nohz_balancing_kick set). + */ +-static __latent_entropy void run_rebalance_domains(struct softirq_action *h) ++static __latent_entropy void run_rebalance_domains(void) + { + struct rq *this_rq = this_rq(); + enum cpu_idle_type idle = this_rq->idle_balance ? +diff --git a/kernel/softirq.c b/kernel/softirq.c +index e89c3b0cff6d..0d3ebd520931 100644 +--- a/kernel/softirq.c ++++ b/kernel/softirq.c +@@ -53,7 +53,7 @@ irq_cpustat_t irq_stat[NR_CPUS] ____cacheline_aligned; + EXPORT_SYMBOL(irq_stat); + #endif + +-static struct softirq_action softirq_vec[NR_SOFTIRQS] __cacheline_aligned_in_smp; ++static struct softirq_action softirq_vec[NR_SOFTIRQS] __ro_after_init __aligned(PAGE_SIZE); + + DEFINE_PER_CPU(struct task_struct *, ksoftirqd); + +@@ -281,7 +281,7 @@ asmlinkage __visible void __softirq_entry __do_softirq(void) + kstat_incr_softirqs_this_cpu(vec_nr); + + trace_softirq_entry(vec_nr); +- h->action(h); ++ h->action(); + trace_softirq_exit(vec_nr); + if (unlikely(prev_count != preempt_count())) { + pr_err("huh, entered softirq %u %s %p with preempt_count %08x, exited with %08x?\n", +@@ -444,7 +444,7 @@ void __raise_softirq_irqoff(unsigned int nr) + or_softirq_pending(1UL << nr); + } + +-void open_softirq(int nr, void (*action)(struct softirq_action *)) ++void __init open_softirq(int nr, void (*action)(void)) + { + softirq_vec[nr].action = action; + } +@@ -486,7 +486,7 @@ void __tasklet_hi_schedule(struct tasklet_struct *t) + } + EXPORT_SYMBOL(__tasklet_hi_schedule); + +-static __latent_entropy void tasklet_action(struct softirq_action *a) ++static __latent_entropy void tasklet_action(void) + { + struct tasklet_struct *list; + +@@ -522,7 +522,7 @@ static __latent_entropy void tasklet_action(struct softirq_action *a) + } + } + +-static __latent_entropy void tasklet_hi_action(struct softirq_action *a) ++static __latent_entropy void tasklet_hi_action(void) + { + struct tasklet_struct *list; + +diff --git a/kernel/sysctl.c b/kernel/sysctl.c +index 069550540a39..822783a174aa 100644 +--- a/kernel/sysctl.c ++++ b/kernel/sysctl.c +@@ -66,6 +66,7 @@ + #include <linux/kexec.h> + #include <linux/bpf.h> + #include <linux/mount.h> ++#include <linux/tty.h> + + #include <linux/uaccess.h> + #include <asm/processor.h> +@@ -98,12 +99,19 @@ + #if defined(CONFIG_SYSCTL) + + /* External variables not in a header file. */ ++#if IS_ENABLED(CONFIG_USB) ++int deny_new_usb __read_mostly = 0; ++EXPORT_SYMBOL(deny_new_usb); ++#endif + extern int suid_dumpable; + #ifdef CONFIG_COREDUMP + extern int core_uses_pid; + extern char core_pattern[]; + extern unsigned int core_pipe_limit; + #endif ++#ifdef CONFIG_USER_NS ++extern int unprivileged_userns_clone; ++#endif + extern int pid_max; + extern int pid_max_min, pid_max_max; + extern int percpu_pagelist_fraction; +@@ -115,40 +123,43 @@ extern int sysctl_nr_trim_pages; + + /* Constants used for minimum and maximum */ + #ifdef CONFIG_LOCKUP_DETECTOR +-static int sixty = 60; ++static int sixty __read_only = 60; + #endif + +-static int __maybe_unused neg_one = -1; ++static int __maybe_unused neg_one __read_only = -1; + + static int zero; +-static int __maybe_unused one = 1; +-static int __maybe_unused two = 2; +-static int __maybe_unused four = 4; +-static unsigned long one_ul = 1; +-static int one_hundred = 100; +-static int one_thousand = 1000; ++static int __maybe_unused one __read_only = 1; ++static int __maybe_unused two __read_only = 2; ++static int __maybe_unused four __read_only = 4; ++static unsigned long one_ul __read_only = 1; ++static int one_hundred __read_only = 100; ++static int one_thousand __read_only = 1000; + #ifdef CONFIG_PRINTK +-static int ten_thousand = 10000; ++static int ten_thousand __read_only = 10000; + #endif + #ifdef CONFIG_PERF_EVENTS +-static int six_hundred_forty_kb = 640 * 1024; ++static int six_hundred_forty_kb __read_only = 640 * 1024; + #endif + + /* this is needed for the proc_doulongvec_minmax of vm_dirty_bytes */ +-static unsigned long dirty_bytes_min = 2 * PAGE_SIZE; ++static unsigned long dirty_bytes_min __read_only = 2 * PAGE_SIZE; + + /* this is needed for the proc_dointvec_minmax for [fs_]overflow UID and GID */ +-static int maxolduid = 65535; +-static int minolduid; ++static int maxolduid __read_only = 65535; ++static int minolduid __read_only; + +-static int ngroups_max = NGROUPS_MAX; ++static int ngroups_max __read_only = NGROUPS_MAX; + static const int cap_last_cap = CAP_LAST_CAP; + + /*this is needed for proc_doulongvec_minmax of sysctl_hung_task_timeout_secs */ + #ifdef CONFIG_DETECT_HUNG_TASK +-static unsigned long hung_task_timeout_max = (LONG_MAX/HZ); ++static unsigned long hung_task_timeout_max __read_only = (LONG_MAX/HZ); + #endif + ++int device_sidechannel_restrict __read_mostly = 1; ++EXPORT_SYMBOL(device_sidechannel_restrict); ++ + #ifdef CONFIG_INOTIFY_USER + #include <linux/inotify.h> + #endif +@@ -286,19 +297,19 @@ static struct ctl_table sysctl_base_table[] = { + }; + + #ifdef CONFIG_SCHED_DEBUG +-static int min_sched_granularity_ns = 100000; /* 100 usecs */ +-static int max_sched_granularity_ns = NSEC_PER_SEC; /* 1 second */ +-static int min_wakeup_granularity_ns; /* 0 usecs */ +-static int max_wakeup_granularity_ns = NSEC_PER_SEC; /* 1 second */ ++static int min_sched_granularity_ns __read_only = 100000; /* 100 usecs */ ++static int max_sched_granularity_ns __read_only = NSEC_PER_SEC; /* 1 second */ ++static int min_wakeup_granularity_ns __read_only; /* 0 usecs */ ++static int max_wakeup_granularity_ns __read_only = NSEC_PER_SEC; /* 1 second */ + #ifdef CONFIG_SMP +-static int min_sched_tunable_scaling = SCHED_TUNABLESCALING_NONE; +-static int max_sched_tunable_scaling = SCHED_TUNABLESCALING_END-1; ++static int min_sched_tunable_scaling __read_only = SCHED_TUNABLESCALING_NONE; ++static int max_sched_tunable_scaling __read_only = SCHED_TUNABLESCALING_END-1; + #endif /* CONFIG_SMP */ + #endif /* CONFIG_SCHED_DEBUG */ + + #ifdef CONFIG_COMPACTION +-static int min_extfrag_threshold; +-static int max_extfrag_threshold = 1000; ++static int min_extfrag_threshold __read_only; ++static int max_extfrag_threshold __read_only = 1000; + #endif + + static struct ctl_table kern_table[] = { +@@ -512,6 +523,15 @@ static struct ctl_table kern_table[] = { + .proc_handler = proc_dointvec, + }, + #endif ++#ifdef CONFIG_USER_NS ++ { ++ .procname = "unprivileged_userns_clone", ++ .data = &unprivileged_userns_clone, ++ .maxlen = sizeof(int), ++ .mode = 0644, ++ .proc_handler = proc_dointvec, ++ }, ++#endif + #ifdef CONFIG_PROC_SYSCTL + { + .procname = "tainted", +@@ -853,6 +873,37 @@ static struct ctl_table kern_table[] = { + .extra1 = &zero, + .extra2 = &two, + }, ++#endif ++#if defined CONFIG_TTY ++ { ++ .procname = "tiocsti_restrict", ++ .data = &tiocsti_restrict, ++ .maxlen = sizeof(int), ++ .mode = 0644, ++ .proc_handler = proc_dointvec_minmax_sysadmin, ++ .extra1 = &zero, ++ .extra2 = &one, ++ }, ++#endif ++ { ++ .procname = "device_sidechannel_restrict", ++ .data = &device_sidechannel_restrict, ++ .maxlen = sizeof(int), ++ .mode = 0644, ++ .proc_handler = proc_dointvec_minmax_sysadmin, ++ .extra1 = &zero, ++ .extra2 = &one, ++ }, ++#if IS_ENABLED(CONFIG_USB) ++ { ++ .procname = "deny_new_usb", ++ .data = &deny_new_usb, ++ .maxlen = sizeof(int), ++ .mode = 0644, ++ .proc_handler = proc_dointvec_minmax_sysadmin, ++ .extra1 = &zero, ++ .extra2 = &one, ++ }, + #endif + { + .procname = "ngroups_max", +diff --git a/kernel/time/timer.c b/kernel/time/timer.c +index 9fe525f410bf..6a85b0e1292e 100644 +--- a/kernel/time/timer.c ++++ b/kernel/time/timer.c +@@ -1624,7 +1624,7 @@ static inline void __run_timers(struct timer_base *base) + /* + * This function runs timers and the timer-tq in bottom half context. + */ +-static __latent_entropy void run_timer_softirq(struct softirq_action *h) ++static __latent_entropy void run_timer_softirq(void) + { + struct timer_base *base = this_cpu_ptr(&timer_bases[BASE_STD]); + +diff --git a/kernel/user_namespace.c b/kernel/user_namespace.c +index c490f1e4313b..dd03bd39d7bf 100644 +--- a/kernel/user_namespace.c ++++ b/kernel/user_namespace.c +@@ -24,6 +24,9 @@ + #include <linux/projid.h> + #include <linux/fs_struct.h> + ++/* sysctl */ ++int unprivileged_userns_clone; ++ + static struct kmem_cache *user_ns_cachep __read_mostly; + static DEFINE_MUTEX(userns_state_mutex); + +diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug +index 62d0e25c054c..3953072277eb 100644 +--- a/lib/Kconfig.debug ++++ b/lib/Kconfig.debug +@@ -937,6 +937,7 @@ endmenu # "Debug lockups and hangs" + + config PANIC_ON_OOPS + bool "Panic on Oops" ++ default y + help + Say Y here to enable the kernel to panic when it oopses. This + has the same effect as setting oops=panic on the kernel command +@@ -946,7 +947,7 @@ config PANIC_ON_OOPS + anything erroneous after an oops which could result in data + corruption or other issues. + +- Say N if unsure. ++ Say Y if unsure. + + config PANIC_ON_OOPS_VALUE + int +@@ -1319,6 +1320,7 @@ config DEBUG_BUGVERBOSE + config DEBUG_LIST + bool "Debug linked list manipulation" + depends on DEBUG_KERNEL || BUG_ON_DATA_CORRUPTION ++ default y + help + Enable this to turn on extended checks in the linked-list + walking routines. +@@ -1932,6 +1934,7 @@ config MEMTEST + config BUG_ON_DATA_CORRUPTION + bool "Trigger a BUG when data corruption is detected" + select DEBUG_LIST ++ default y + help + Select this option if the kernel should BUG when it encounters + data corruption in kernel memory structures when they get checked +@@ -1952,7 +1955,7 @@ config STRICT_DEVMEM + bool "Filter access to /dev/mem" + depends on MMU && DEVMEM + depends on ARCH_HAS_DEVMEM_IS_ALLOWED +- default y if TILE || PPC ++ default y + ---help--- + If this option is disabled, you allow userspace (root) access to all + of memory, including kernel and userspace memory. Accidental +@@ -1971,6 +1974,7 @@ config STRICT_DEVMEM + config IO_STRICT_DEVMEM + bool "Filter I/O access to /dev/mem" + depends on STRICT_DEVMEM ++ default y + ---help--- + If this option is disabled, you allow userspace (root) access to all + io-memory regardless of whether a driver is actively using that +diff --git a/lib/irq_poll.c b/lib/irq_poll.c +index 86a709954f5a..6f15787fcb1b 100644 +--- a/lib/irq_poll.c ++++ b/lib/irq_poll.c +@@ -75,7 +75,7 @@ void irq_poll_complete(struct irq_poll *iop) + } + EXPORT_SYMBOL(irq_poll_complete); + +-static void __latent_entropy irq_poll_softirq(struct softirq_action *h) ++static void __latent_entropy irq_poll_softirq(void) + { + struct list_head *list = this_cpu_ptr(&blk_cpu_iopoll); + int rearm = 0, budget = irq_poll_budget; +diff --git a/lib/kobject.c b/lib/kobject.c +index 34f847252c02..4fda329de614 100644 +--- a/lib/kobject.c ++++ b/lib/kobject.c +@@ -956,9 +956,9 @@ EXPORT_SYMBOL_GPL(kset_create_and_add); + + + static DEFINE_SPINLOCK(kobj_ns_type_lock); +-static const struct kobj_ns_type_operations *kobj_ns_ops_tbl[KOBJ_NS_TYPES]; ++static const struct kobj_ns_type_operations *kobj_ns_ops_tbl[KOBJ_NS_TYPES] __ro_after_init; + +-int kobj_ns_type_register(const struct kobj_ns_type_operations *ops) ++int __init kobj_ns_type_register(const struct kobj_ns_type_operations *ops) + { + enum kobj_ns_type type = ops->type; + int error; +diff --git a/lib/nlattr.c b/lib/nlattr.c +index 3d8295c85505..3fa3b3409d69 100644 +--- a/lib/nlattr.c ++++ b/lib/nlattr.c +@@ -341,6 +341,8 @@ int nla_memcpy(void *dest, const struct nlattr *src, int count) + { + int minlen = min_t(int, count, nla_len(src)); + ++ BUG_ON(minlen < 0); ++ + memcpy(dest, nla_data(src), minlen); + if (count > minlen) + memset(dest + minlen, 0, count - minlen); +diff --git a/lib/vsprintf.c b/lib/vsprintf.c +index 86c3385b9eb3..c482070e379b 100644 +--- a/lib/vsprintf.c ++++ b/lib/vsprintf.c +@@ -1591,7 +1591,7 @@ char *device_node_string(char *buf, char *end, struct device_node *dn, + return widen_string(buf, buf - buf_start, end, spec); + } + +-int kptr_restrict __read_mostly; ++int kptr_restrict __read_mostly = 2; + + /* + * Show a '%p' thing. A kernel extension is that the '%p' is followed +diff --git a/mm/Kconfig b/mm/Kconfig +index 59efbd3337e0..c070e14ec83d 100644 +--- a/mm/Kconfig ++++ b/mm/Kconfig +@@ -319,7 +319,8 @@ config KSM + config DEFAULT_MMAP_MIN_ADDR + int "Low address space to protect from user allocation" + depends on MMU +- default 4096 ++ default 32768 if ARM || (ARM64 && COMPAT) ++ default 65536 + help + This is the portion of low virtual memory which should be protected + from userspace allocation. Keeping a user from writing to low pages +diff --git a/mm/mmap.c b/mm/mmap.c +index 11f96fad5271..632e7f9a710e 100644 +--- a/mm/mmap.c ++++ b/mm/mmap.c +@@ -220,6 +220,13 @@ SYSCALL_DEFINE1(brk, unsigned long, brk) + + newbrk = PAGE_ALIGN(brk); + oldbrk = PAGE_ALIGN(mm->brk); ++ /* properly handle unaligned min_brk as an empty heap */ ++ if (min_brk & ~PAGE_MASK) { ++ if (brk == min_brk) ++ newbrk -= PAGE_SIZE; ++ if (mm->brk == min_brk) ++ oldbrk -= PAGE_SIZE; ++ } + if (oldbrk == newbrk) + goto set_brk; + +diff --git a/mm/page_alloc.c b/mm/page_alloc.c +index 1d7693c35424..8963a3b4d37c 100644 +--- a/mm/page_alloc.c ++++ b/mm/page_alloc.c +@@ -67,6 +67,7 @@ + #include <linux/ftrace.h> + #include <linux/lockdep.h> + #include <linux/nmi.h> ++#include <linux/random.h> + + #include <asm/sections.h> + #include <asm/tlbflush.h> +@@ -98,6 +99,15 @@ int _node_numa_mem_[MAX_NUMNODES]; + DEFINE_MUTEX(pcpu_drain_mutex); + DEFINE_PER_CPU(struct work_struct, pcpu_drain); + ++bool __meminitdata extra_latent_entropy; ++ ++static int __init setup_extra_latent_entropy(char *str) ++{ ++ extra_latent_entropy = true; ++ return 0; ++} ++early_param("extra_latent_entropy", setup_extra_latent_entropy); ++ + #ifdef CONFIG_GCC_PLUGIN_LATENT_ENTROPY + volatile unsigned long latent_entropy __latent_entropy; + EXPORT_SYMBOL(latent_entropy); +@@ -1063,6 +1073,13 @@ static __always_inline bool free_pages_prepare(struct page *page, + debug_check_no_obj_freed(page_address(page), + PAGE_SIZE << order); + } ++ ++ if (IS_ENABLED(CONFIG_PAGE_SANITIZE)) { ++ int i; ++ for (i = 0; i < (1 << order); i++) ++ clear_highpage(page + i); ++ } ++ + arch_free_page(page, order); + kernel_poison_pages(page, 1 << order, 0); + kernel_map_pages(page, 1 << order, 0); +@@ -1278,6 +1295,21 @@ static void __init __free_pages_boot_core(struct page *page, unsigned int order) + __ClearPageReserved(p); + set_page_count(p, 0); + ++ if (extra_latent_entropy && !PageHighMem(page) && page_to_pfn(page) < 0x100000) { ++ unsigned long hash = 0; ++ size_t index, end = PAGE_SIZE * nr_pages / sizeof hash; ++ const unsigned long *data = lowmem_page_address(page); ++ ++ for (index = 0; index < end; index++) ++ hash ^= hash + data[index]; ++#ifdef CONFIG_GCC_PLUGIN_LATENT_ENTROPY ++ latent_entropy ^= hash; ++ add_device_randomness((const void *)&latent_entropy, sizeof(latent_entropy)); ++#else ++ add_device_randomness((const void *)&hash, sizeof(hash)); ++#endif ++ } ++ + page_zone(page)->managed_pages += nr_pages; + set_page_refcounted(page); + __free_pages(page, order); +@@ -1718,8 +1750,8 @@ static inline int check_new_page(struct page *page) + + static inline bool free_pages_prezeroed(void) + { +- return IS_ENABLED(CONFIG_PAGE_POISONING_ZERO) && +- page_poisoning_enabled(); ++ return IS_ENABLED(CONFIG_PAGE_SANITIZE) || ++ (IS_ENABLED(CONFIG_PAGE_POISONING_ZERO) && page_poisoning_enabled()); + } + + #ifdef CONFIG_DEBUG_VM +@@ -1776,6 +1808,11 @@ static void prep_new_page(struct page *page, unsigned int order, gfp_t gfp_flags + + post_alloc_hook(page, order, gfp_flags); + ++ if (IS_ENABLED(CONFIG_PAGE_SANITIZE_VERIFY)) { ++ for (i = 0; i < (1 << order); i++) ++ verify_zero_highpage(page + i); ++ } ++ + if (!free_pages_prezeroed() && (gfp_flags & __GFP_ZERO)) + for (i = 0; i < (1 << order); i++) + clear_highpage(page + i); +diff --git a/mm/slab.h b/mm/slab.h +index 485d9fbb8802..436461588804 100644 +--- a/mm/slab.h ++++ b/mm/slab.h +@@ -311,7 +311,11 @@ static inline bool is_root_cache(struct kmem_cache *s) + static inline bool slab_equal_or_root(struct kmem_cache *s, + struct kmem_cache *p) + { ++#ifdef CONFIG_SLAB_HARDENED ++ return p == s; ++#else + return true; ++#endif + } + + static inline const char *cache_name(struct kmem_cache *s) +@@ -363,18 +367,26 @@ static inline struct kmem_cache *cache_from_obj(struct kmem_cache *s, void *x) + * to not do even the assignment. In that case, slab_equal_or_root + * will also be a constant. + */ +- if (!memcg_kmem_enabled() && ++ if (!IS_ENABLED(CONFIG_SLAB_HARDENED) && ++ !memcg_kmem_enabled() && + !unlikely(s->flags & SLAB_CONSISTENCY_CHECKS)) + return s; + + page = virt_to_head_page(x); ++#ifdef CONFIG_SLAB_HARDENED ++ BUG_ON(!PageSlab(page)); ++#endif + cachep = page->slab_cache; + if (slab_equal_or_root(cachep, s)) + return cachep; + + pr_err("%s: Wrong slab cache. %s but object is from %s\n", + __func__, s->name, cachep->name); ++#ifdef CONFIG_BUG_ON_DATA_CORRUPTION ++ BUG_ON(1); ++#else + WARN_ON_ONCE(1); ++#endif + return s; + } + +@@ -399,7 +411,7 @@ static inline size_t slab_ksize(const struct kmem_cache *s) + * back there or track user information then we can + * only use the space before that information. + */ +- if (s->flags & (SLAB_TYPESAFE_BY_RCU | SLAB_STORE_USER)) ++ if ((s->flags & (SLAB_TYPESAFE_BY_RCU | SLAB_STORE_USER)) || IS_ENABLED(CONFIG_SLAB_CANARY)) + return s->inuse; + /* + * Else we can use all the padding etc for the allocation +diff --git a/mm/slab_common.c b/mm/slab_common.c +index 65212caa1f2a..d8bf8a75f445 100644 +--- a/mm/slab_common.c ++++ b/mm/slab_common.c +@@ -26,10 +26,10 @@ + + #include "slab.h" + +-enum slab_state slab_state; ++enum slab_state slab_state __ro_after_init; + LIST_HEAD(slab_caches); + DEFINE_MUTEX(slab_mutex); +-struct kmem_cache *kmem_cache; ++struct kmem_cache *kmem_cache __ro_after_init; + + static LIST_HEAD(slab_caches_to_rcu_destroy); + static void slab_caches_to_rcu_destroy_workfn(struct work_struct *work); +@@ -49,7 +49,7 @@ static DECLARE_WORK(slab_caches_to_rcu_destroy_work, + /* + * Merge control. If this is set then no merging of slab caches will occur. + */ +-static bool slab_nomerge = !IS_ENABLED(CONFIG_SLAB_MERGE_DEFAULT); ++static bool slab_nomerge __ro_after_init = !IS_ENABLED(CONFIG_SLAB_MERGE_DEFAULT); + + static int __init setup_slab_nomerge(char *str) + { +@@ -927,7 +927,7 @@ EXPORT_SYMBOL(kmalloc_dma_caches); + * of two cache sizes there. The size of larger slabs can be determined using + * fls. + */ +-static s8 size_index[24] = { ++static s8 size_index[24] __ro_after_init = { + 3, /* 8 */ + 4, /* 16 */ + 5, /* 24 */ +diff --git a/mm/slub.c b/mm/slub.c +index 41c01690d116..591dd60d37f3 100644 +--- a/mm/slub.c ++++ b/mm/slub.c +@@ -125,6 +125,16 @@ static inline int kmem_cache_debug(struct kmem_cache *s) + #endif + } + ++static inline bool has_sanitize(struct kmem_cache *s) ++{ ++ return IS_ENABLED(CONFIG_SLAB_SANITIZE) && !(s->flags & (SLAB_TYPESAFE_BY_RCU | SLAB_POISON)); ++} ++ ++static inline bool has_sanitize_verify(struct kmem_cache *s) ++{ ++ return IS_ENABLED(CONFIG_SLAB_SANITIZE_VERIFY) && has_sanitize(s); ++} ++ + void *fixup_red_left(struct kmem_cache *s, void *p) + { + if (kmem_cache_debug(s) && s->flags & SLAB_RED_ZONE) +@@ -297,6 +307,35 @@ static inline void set_freepointer(struct kmem_cache *s, void *object, void *fp) + *(void **)freeptr_addr = freelist_ptr(s, fp, freeptr_addr); + } + ++#ifdef CONFIG_SLAB_CANARY ++static inline unsigned long *get_canary(struct kmem_cache *s, void *object) ++{ ++ if (s->offset) ++ return object + s->offset + sizeof(void *); ++ return object + s->inuse; ++} ++ ++static inline unsigned long get_canary_value(const void *canary, unsigned long value) ++{ ++ return (value ^ (unsigned long)canary) & CANARY_MASK; ++} ++ ++static inline void set_canary(struct kmem_cache *s, void *object, unsigned long value) ++{ ++ unsigned long *canary = get_canary(s, object); ++ *canary = get_canary_value(canary, value); ++} ++ ++static inline void check_canary(struct kmem_cache *s, void *object, unsigned long value) ++{ ++ unsigned long *canary = get_canary(s, object); ++ BUG_ON(*canary != get_canary_value(canary, value)); ++} ++#else ++#define set_canary(s, object, value) ++#define check_canary(s, object, value) ++#endif ++ + /* Loop over all objects in a slab */ + #define for_each_object(__p, __s, __addr, __objects) \ + for (__p = fixup_red_left(__s, __addr); \ +@@ -484,13 +523,13 @@ static inline void *restore_red_left(struct kmem_cache *s, void *p) + * Debug settings: + */ + #if defined(CONFIG_SLUB_DEBUG_ON) +-static int slub_debug = DEBUG_DEFAULT_FLAGS; ++static int slub_debug __ro_after_init = DEBUG_DEFAULT_FLAGS; + #else +-static int slub_debug; ++static int slub_debug __ro_after_init; + #endif + +-static char *slub_debug_slabs; +-static int disable_higher_order_debug; ++static char *slub_debug_slabs __ro_after_init; ++static int disable_higher_order_debug __ro_after_init; + + /* + * slub is about to manipulate internal object metadata. This memory lies +@@ -550,6 +589,9 @@ static struct track *get_track(struct kmem_cache *s, void *object, + else + p = object + s->inuse; + ++ if (IS_ENABLED(CONFIG_SLAB_CANARY)) ++ p = (void *)p + sizeof(void *); ++ + return p + alloc; + } + +@@ -688,6 +730,9 @@ static void print_trailer(struct kmem_cache *s, struct page *page, u8 *p) + else + off = s->inuse; + ++ if (IS_ENABLED(CONFIG_SLAB_CANARY)) ++ off += sizeof(void *); ++ + if (s->flags & SLAB_STORE_USER) + off += 2 * sizeof(struct track); + +@@ -817,6 +862,9 @@ static int check_pad_bytes(struct kmem_cache *s, struct page *page, u8 *p) + /* Freepointer is placed after the object. */ + off += sizeof(void *); + ++ if (IS_ENABLED(CONFIG_SLAB_CANARY)) ++ off += sizeof(void *); ++ + if (s->flags & SLAB_STORE_USER) + /* We also have user information there */ + off += 2 * sizeof(struct track); +@@ -1416,8 +1464,9 @@ static void setup_object(struct kmem_cache *s, struct page *page, + void *object) + { + setup_object_debug(s, page, object); ++ set_canary(s, object, s->random_inactive); + kasan_init_slab_obj(s, object); +- if (unlikely(s->ctor)) { ++ if (unlikely(s->ctor) && !has_sanitize_verify(s)) { + kasan_unpoison_object_data(s, object); + s->ctor(object); + kasan_poison_object_data(s, object); +@@ -2717,9 +2766,21 @@ static __always_inline void *slab_alloc_node(struct kmem_cache *s, + stat(s, ALLOC_FASTPATH); + } + +- if (unlikely(gfpflags & __GFP_ZERO) && object) ++ if (has_sanitize_verify(s) && object) { ++ size_t offset = s->offset ? 0 : sizeof(void *); ++ BUG_ON(memchr_inv(object + offset, 0, s->object_size - offset)); ++ if (s->ctor) ++ s->ctor(object); ++ if (unlikely(gfpflags & __GFP_ZERO) && offset) ++ memset(object, 0, sizeof(void *)); ++ } else if (unlikely(gfpflags & __GFP_ZERO) && object) + memset(object, 0, s->object_size); + ++ if (object) { ++ check_canary(s, object, s->random_inactive); ++ set_canary(s, object, s->random_active); ++ } ++ + slab_post_alloc_hook(s, gfpflags, 1, &object); + + return object; +@@ -2926,6 +2987,27 @@ static __always_inline void do_slab_free(struct kmem_cache *s, + void *tail_obj = tail ? : head; + struct kmem_cache_cpu *c; + unsigned long tid; ++ bool sanitize = has_sanitize(s); ++ ++ if (IS_ENABLED(CONFIG_SLAB_CANARY) || sanitize) { ++ __maybe_unused int offset = s->offset ? 0 : sizeof(void *); ++ void *x = head; ++ ++ while (1) { ++ check_canary(s, x, s->random_active); ++ set_canary(s, x, s->random_inactive); ++ ++ if (sanitize) { ++ memset(x + offset, 0, s->object_size - offset); ++ if (!IS_ENABLED(CONFIG_SLAB_SANITIZE_VERIFY) && s->ctor) ++ s->ctor(x); ++ } ++ if (x == tail_obj) ++ break; ++ x = get_freepointer(s, x); ++ } ++ } ++ + redo: + /* + * Determine the currently cpus per cpu slab. +@@ -3104,7 +3186,7 @@ int kmem_cache_alloc_bulk(struct kmem_cache *s, gfp_t flags, size_t size, + void **p) + { + struct kmem_cache_cpu *c; +- int i; ++ int i, k; + + /* memcg and kmem_cache debug support */ + s = slab_pre_alloc_hook(s, flags); +@@ -3141,13 +3223,29 @@ int kmem_cache_alloc_bulk(struct kmem_cache *s, gfp_t flags, size_t size, + local_irq_enable(); + + /* Clear memory outside IRQ disabled fastpath loop */ +- if (unlikely(flags & __GFP_ZERO)) { ++ if (has_sanitize_verify(s)) { ++ int j; ++ ++ for (j = 0; j < i; j++) { ++ size_t offset = s->offset ? 0 : sizeof(void *); ++ BUG_ON(memchr_inv(p[j] + offset, 0, s->object_size - offset)); ++ if (s->ctor) ++ s->ctor(p[j]); ++ if (unlikely(flags & __GFP_ZERO) && offset) ++ memset(p[j], 0, sizeof(void *)); ++ } ++ } else if (unlikely(flags & __GFP_ZERO)) { + int j; + + for (j = 0; j < i; j++) + memset(p[j], 0, s->object_size); + } + ++ for (k = 0; k < i; k++) { ++ check_canary(s, p[k], s->random_inactive); ++ set_canary(s, p[k], s->random_active); ++ } ++ + /* memcg and kmem_cache debug support */ + slab_post_alloc_hook(s, flags, size, p); + return i; +@@ -3179,9 +3277,9 @@ EXPORT_SYMBOL(kmem_cache_alloc_bulk); + * and increases the number of allocations possible without having to + * take the list_lock. + */ +-static int slub_min_order; +-static int slub_max_order = PAGE_ALLOC_COSTLY_ORDER; +-static int slub_min_objects; ++static int slub_min_order __ro_after_init; ++static int slub_max_order __ro_after_init = PAGE_ALLOC_COSTLY_ORDER; ++static int slub_min_objects __ro_after_init; + + /* + * Calculate the order of allocation given an slab object size. +@@ -3351,6 +3449,7 @@ static void early_kmem_cache_node_alloc(int node) + init_object(kmem_cache_node, n, SLUB_RED_ACTIVE); + init_tracking(kmem_cache_node, n); + #endif ++ set_canary(kmem_cache_node, n, kmem_cache_node->random_active); + kasan_kmalloc(kmem_cache_node, n, sizeof(struct kmem_cache_node), + GFP_KERNEL); + init_kmem_cache_node(n); +@@ -3507,6 +3606,9 @@ static int calculate_sizes(struct kmem_cache *s, int forced_order) + size += sizeof(void *); + } + ++ if (IS_ENABLED(CONFIG_SLAB_CANARY)) ++ size += sizeof(void *); ++ + #ifdef CONFIG_SLUB_DEBUG + if (flags & SLAB_STORE_USER) + /* +@@ -3577,6 +3679,10 @@ static int kmem_cache_open(struct kmem_cache *s, unsigned long flags) + #ifdef CONFIG_SLAB_FREELIST_HARDENED + s->random = get_random_long(); + #endif ++#ifdef CONFIG_SLAB_CANARY ++ s->random_active = get_random_long(); ++ s->random_inactive = get_random_long(); ++#endif + + if (need_reserve_slab_rcu && (s->flags & SLAB_TYPESAFE_BY_RCU)) + s->reserved = sizeof(struct rcu_head); +@@ -3841,6 +3947,8 @@ const char *__check_heap_object(const void *ptr, unsigned long n, + offset -= s->red_left_pad; + } + ++ check_canary(s, (void *)ptr - offset, s->random_active); ++ + /* Allow address range falling entirely within object size. */ + if (offset <= object_size && n <= object_size - offset) + return NULL; +@@ -3859,7 +3967,11 @@ static size_t __ksize(const void *object) + page = virt_to_head_page(object); + + if (unlikely(!PageSlab(page))) { ++#ifdef CONFIG_BUG_ON_DATA_CORRUPTION ++ BUG_ON(!PageCompound(page)); ++#else + WARN_ON(!PageCompound(page)); ++#endif + return PAGE_SIZE << compound_order(page); + } + +@@ -4724,7 +4836,7 @@ enum slab_stat_type { + #define SO_TOTAL (1 << SL_TOTAL) + + #ifdef CONFIG_MEMCG +-static bool memcg_sysfs_enabled = IS_ENABLED(CONFIG_SLUB_MEMCG_SYSFS_ON); ++static bool memcg_sysfs_enabled __ro_after_init = IS_ENABLED(CONFIG_SLUB_MEMCG_SYSFS_ON); + + static int __init setup_slub_memcg_sysfs(char *str) + { +diff --git a/mm/swap.c b/mm/swap.c +index a77d68f2c1b6..d1f1d75f4d1f 100644 +--- a/mm/swap.c ++++ b/mm/swap.c +@@ -92,6 +92,13 @@ static void __put_compound_page(struct page *page) + if (!PageHuge(page)) + __page_cache_release(page); + dtor = get_compound_page_dtor(page); ++ if (!PageHuge(page)) ++ BUG_ON(dtor != free_compound_page ++#ifdef CONFIG_TRANSPARENT_HUGEPAGE ++ && dtor != free_transhuge_page ++#endif ++ ); ++ + (*dtor)(page); + } + +diff --git a/net/core/dev.c b/net/core/dev.c +index 6ca771f2f25b..6da2c9c3e6a5 100644 +--- a/net/core/dev.c ++++ b/net/core/dev.c +@@ -4095,7 +4095,7 @@ int netif_rx_ni(struct sk_buff *skb) + } + EXPORT_SYMBOL(netif_rx_ni); + +-static __latent_entropy void net_tx_action(struct softirq_action *h) ++static __latent_entropy void net_tx_action(void) + { + struct softnet_data *sd = this_cpu_ptr(&softnet_data); + +@@ -5609,7 +5609,7 @@ static int napi_poll(struct napi_struct *n, struct list_head *repoll) + return work; + } + +-static __latent_entropy void net_rx_action(struct softirq_action *h) ++static __latent_entropy void net_rx_action(void) + { + struct softnet_data *sd = this_cpu_ptr(&softnet_data); + unsigned long time_limit = jiffies + +diff --git a/net/ipv4/Kconfig b/net/ipv4/Kconfig +index f48fe6fc7e8c..d78c52835c08 100644 +--- a/net/ipv4/Kconfig ++++ b/net/ipv4/Kconfig +@@ -261,6 +261,7 @@ config IP_PIMSM_V2 + + config SYN_COOKIES + bool "IP: TCP syncookie support" ++ default y + ---help--- + Normal TCP/IP networking is open to an attack known as "SYN + flooding". This denial-of-service attack prevents legitimate remote +diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c +index 54deaa1066cf..211f97bd5ee3 100644 +--- a/scripts/mod/modpost.c ++++ b/scripts/mod/modpost.c +@@ -37,6 +37,7 @@ static int vmlinux_section_warnings = 1; + static int warn_unresolved = 0; + /* How a symbol is exported */ + static int sec_mismatch_count = 0; ++static int writable_fptr_count = 0; + static int sec_mismatch_verbose = 1; + static int sec_mismatch_fatal = 0; + /* ignore missing files */ +@@ -965,6 +966,7 @@ enum mismatch { + ANY_EXIT_TO_ANY_INIT, + EXPORT_TO_INIT_EXIT, + EXTABLE_TO_NON_TEXT, ++ DATA_TO_TEXT + }; + + /** +@@ -1091,6 +1093,12 @@ static const struct sectioncheck sectioncheck[] = { + .good_tosec = {ALL_TEXT_SECTIONS , NULL}, + .mismatch = EXTABLE_TO_NON_TEXT, + .handler = extable_mismatch_handler, ++}, ++/* Do not reference code from writable data */ ++{ ++ .fromsec = { DATA_SECTIONS, NULL }, ++ .bad_tosec = { ALL_TEXT_SECTIONS, NULL }, ++ .mismatch = DATA_TO_TEXT + } + }; + +@@ -1240,10 +1248,10 @@ static Elf_Sym *find_elf_symbol(struct elf_info *elf, Elf64_Sword addr, + continue; + if (ELF_ST_TYPE(sym->st_info) == STT_SECTION) + continue; +- if (sym->st_value == addr) +- return sym; + /* Find a symbol nearby - addr are maybe negative */ + d = sym->st_value - addr; ++ if (d == 0) ++ return sym; + if (d < 0) + d = addr - sym->st_value; + if (d < distance) { +@@ -1402,7 +1410,11 @@ static void report_sec_mismatch(const char *modname, + char *prl_from; + char *prl_to; + +- sec_mismatch_count++; ++ if (mismatch->mismatch == DATA_TO_TEXT) ++ writable_fptr_count++; ++ else ++ sec_mismatch_count++; ++ + if (!sec_mismatch_verbose) + return; + +@@ -1526,6 +1538,14 @@ static void report_sec_mismatch(const char *modname, + fatal("There's a special handler for this mismatch type, " + "we should never get here."); + break; ++ case DATA_TO_TEXT: ++#if 0 ++ fprintf(stderr, ++ "The %s %s:%s references\n" ++ "the %s %s:%s%s\n", ++ from, fromsec, fromsym, to, tosec, tosym, to_p); ++#endif ++ break; + } + fprintf(stderr, "\n"); + } +@@ -2539,6 +2559,14 @@ int main(int argc, char **argv) + } + } + free(buf.p); ++ if (writable_fptr_count) { ++ if (!sec_mismatch_verbose) { ++ warn("modpost: Found %d writable function pointer(s).\n" ++ "To see full details build your kernel with:\n" ++ "'make CONFIG_DEBUG_SECTION_MISMATCH=y'\n", ++ writable_fptr_count); ++ } ++ } + + return err; + } +diff --git a/security/Kconfig b/security/Kconfig +index 87f2a6f842fd..7bdbb7edf5bf 100644 +--- a/security/Kconfig ++++ b/security/Kconfig +@@ -8,7 +8,7 @@ source security/keys/Kconfig + + config SECURITY_DMESG_RESTRICT + bool "Restrict unprivileged access to the kernel syslog" +- default n ++ default y + help + This enforces restrictions on unprivileged users reading the kernel + syslog via dmesg(8). +@@ -18,10 +18,34 @@ config SECURITY_DMESG_RESTRICT + + If you are unsure how to answer this question, answer N. + ++config SECURITY_PERF_EVENTS_RESTRICT ++ bool "Restrict unprivileged use of performance events" ++ depends on PERF_EVENTS ++ default y ++ help ++ If you say Y here, the kernel.perf_event_paranoid sysctl ++ will be set to 3 by default, and no unprivileged use of the ++ perf_event_open syscall will be permitted unless it is ++ changed. ++ ++config SECURITY_TIOCSTI_RESTRICT ++ bool "Restrict unprivileged use of tiocsti command injection" ++ default y ++ help ++ This enforces restrictions on unprivileged users injecting commands ++ into other processes which share a tty session using the TIOCSTI ++ ioctl. This option makes TIOCSTI use require CAP_SYS_ADMIN. ++ ++ If this option is not selected, no restrictions will be enforced ++ unless the tiocsti_restrict sysctl is explicitly set to (1). ++ ++ If you are unsure how to answer this question, answer N. ++ + config SECURITY + bool "Enable different security models" + depends on SYSFS + depends on MULTIUSER ++ default y + help + This allows you to choose different security modules to be + configured into your kernel. +@@ -48,6 +72,7 @@ config SECURITYFS + config SECURITY_NETWORK + bool "Socket and Networking Security Hooks" + depends on SECURITY ++ default y + help + This enables the socket and networking security hooks. + If enabled, a security module can use these hooks to +@@ -155,6 +180,7 @@ config HARDENED_USERCOPY + depends on HAVE_HARDENED_USERCOPY_ALLOCATOR + select BUG + imply STRICT_DEVMEM ++ default y + help + This option checks for obviously wrong memory regions when + copying memory to/from the kernel (via copy_to_user() and +@@ -178,10 +204,36 @@ config HARDENED_USERCOPY_PAGESPAN + config FORTIFY_SOURCE + bool "Harden common str/mem functions against buffer overflows" + depends on ARCH_HAS_FORTIFY_SOURCE ++ default y + help + Detect overflows of buffers in common string and memory functions + where the compiler can determine and validate the buffer sizes. + ++config FORTIFY_SOURCE_STRICT_STRING ++ bool "Harden common functions against buffer overflows" ++ depends on FORTIFY_SOURCE ++ depends on EXPERT ++ help ++ Perform stricter overflow checks catching overflows within objects ++ for common C string functions rather than only between objects. ++ ++ This is not yet intended for production use, only bug finding. ++ ++config PAGE_SANITIZE ++ bool "Sanitize pages" ++ default y ++ help ++ Zero fill page allocations on free, reducing the lifetime of ++ sensitive data and helping to mitigate use-after-free bugs. ++ ++config PAGE_SANITIZE_VERIFY ++ bool "Verify sanitized pages" ++ depends on PAGE_SANITIZE ++ default y ++ help ++ Verify that newly allocated pages are zeroed to detect ++ write-after-free bugs. ++ + config STATIC_USERMODEHELPER + bool "Force all usermode helper calls through a single binary" + help +diff --git a/security/selinux/Kconfig b/security/selinux/Kconfig +index 8af7a690eb40..6539694b0fd3 100644 +--- a/security/selinux/Kconfig ++++ b/security/selinux/Kconfig +@@ -2,7 +2,7 @@ config SECURITY_SELINUX + bool "NSA SELinux Support" + depends on SECURITY_NETWORK && AUDIT && NET && INET + select NETWORK_SECMARK +- default n ++ default y + help + This selects NSA Security-Enhanced Linux (SELinux). + You will also need a policy configuration and a labeled filesystem. +@@ -79,23 +79,3 @@ config SECURITY_SELINUX_AVC_STATS + This option collects access vector cache statistics to + /selinux/avc/cache_stats, which may be monitored via + tools such as avcstat. +- +-config SECURITY_SELINUX_CHECKREQPROT_VALUE +- int "NSA SELinux checkreqprot default value" +- depends on SECURITY_SELINUX +- range 0 1 +- default 0 +- help +- This option sets the default value for the 'checkreqprot' flag +- that determines whether SELinux checks the protection requested +- by the application or the protection that will be applied by the +- kernel (including any implied execute for read-implies-exec) for +- mmap and mprotect calls. If this option is set to 0 (zero), +- SELinux will default to checking the protection that will be applied +- by the kernel. If this option is set to 1 (one), SELinux will +- default to checking the protection requested by the application. +- The checkreqprot flag may be changed from the default via the +- 'checkreqprot=' boot parameter. It may also be changed at runtime +- via /selinux/checkreqprot if authorized by policy. +- +- If you are unsure how to answer this question, answer 0. +diff --git a/security/selinux/include/objsec.h b/security/selinux/include/objsec.h +index 1649cd18eb0b..067f35559aa7 100644 +--- a/security/selinux/include/objsec.h ++++ b/security/selinux/include/objsec.h +@@ -150,6 +150,6 @@ struct pkey_security_struct { + u32 sid; /* SID of pkey */ + }; + +-extern unsigned int selinux_checkreqprot; ++extern const unsigned int selinux_checkreqprot; + + #endif /* _SELINUX_OBJSEC_H_ */ +diff --git a/security/selinux/selinuxfs.c b/security/selinux/selinuxfs.c +index 00eed842c491..8f7b8d7e6f91 100644 +--- a/security/selinux/selinuxfs.c ++++ b/security/selinux/selinuxfs.c +@@ -41,16 +41,7 @@ + #include "objsec.h" + #include "conditional.h" + +-unsigned int selinux_checkreqprot = CONFIG_SECURITY_SELINUX_CHECKREQPROT_VALUE; +- +-static int __init checkreqprot_setup(char *str) +-{ +- unsigned long checkreqprot; +- if (!kstrtoul(str, 0, &checkreqprot)) +- selinux_checkreqprot = checkreqprot ? 1 : 0; +- return 1; +-} +-__setup("checkreqprot=", checkreqprot_setup); ++const unsigned int selinux_checkreqprot; + + static DEFINE_MUTEX(sel_mutex); + +@@ -610,10 +601,9 @@ static ssize_t sel_write_checkreqprot(struct file *file, const char __user *buf, + return PTR_ERR(page); + + length = -EINVAL; +- if (sscanf(page, "%u", &new_value) != 1) ++ if (sscanf(page, "%u", &new_value) != 1 || new_value) + goto out; + +- selinux_checkreqprot = new_value ? 1 : 0; + length = count; + out: + kfree(page); +diff --git a/security/yama/Kconfig b/security/yama/Kconfig +index 96b27405558a..485c1b85c325 100644 +--- a/security/yama/Kconfig ++++ b/security/yama/Kconfig +@@ -1,7 +1,7 @@ + config SECURITY_YAMA + bool "Yama support" + depends on SECURITY +- default n ++ default y + help + This selects Yama, which extends DAC support with additional + system-wide security settings beyond regular Linux discretionary diff --git a/pkgs/os-specific/linux/kernel/copperhead-4-16.patch b/pkgs/os-specific/linux/kernel/copperhead-4-16.patch new file mode 100644 index 000000000000..f0a4bc940347 --- /dev/null +++ b/pkgs/os-specific/linux/kernel/copperhead-4-16.patch @@ -0,0 +1,2571 @@ +diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt +index 9824d049367e..6ff72316ff0a 100644 +--- a/Documentation/admin-guide/kernel-parameters.txt ++++ b/Documentation/admin-guide/kernel-parameters.txt +@@ -496,16 +496,6 @@ + nosocket -- Disable socket memory accounting. + nokmem -- Disable kernel memory accounting. + +- checkreqprot [SELINUX] Set initial checkreqprot flag value. +- Format: { "0" | "1" } +- See security/selinux/Kconfig help text. +- 0 -- check protection applied by kernel (includes +- any implied execute protection). +- 1 -- check protection requested by application. +- Default value is set via a kernel config option. +- Value can be changed at runtime via +- /selinux/checkreqprot. +- + cio_ignore= [S390] + See Documentation/s390/CommonIO for details. + clk_ignore_unused +@@ -2946,6 +2936,11 @@ + the specified number of seconds. This is to be used if + your oopses keep scrolling off the screen. + ++ extra_latent_entropy ++ Enable a very simple form of latent entropy extraction ++ from the first 4GB of memory as the bootmem allocator ++ passes the memory pages to the buddy allocator. ++ + pcbit= [HW,ISDN] + + pcd. [PARIDE] +diff --git a/Makefile b/Makefile +index ded9e8480d74..2e948bb78142 100644 +--- a/Makefile ++++ b/Makefile +@@ -734,6 +734,9 @@ endif + endif + + ifeq ($(cc-name),clang) ++ifdef CONFIG_LOCAL_INIT ++KBUILD_CFLAGS += -fsanitize=local-init ++endif + KBUILD_CPPFLAGS += $(call cc-option,-Qunused-arguments,) + KBUILD_CFLAGS += $(call cc-disable-warning, format-invalid-specifier) + KBUILD_CFLAGS += $(call cc-disable-warning, gnu) +diff --git a/arch/Kconfig b/arch/Kconfig +index 76c0b54443b1..63a2d30f807f 100644 +--- a/arch/Kconfig ++++ b/arch/Kconfig +@@ -454,6 +454,11 @@ config GCC_PLUGIN_LATENT_ENTROPY + is some slowdown of the boot process (about 0.5%) and fork and + irq processing. + ++ When extra_latent_entropy is passed on the kernel command line, ++ entropy will be extracted from up to the first 4GB of RAM while the ++ runtime memory allocator is being initialized. This costs even more ++ slowdown of the boot process. ++ + Note that entropy extracted this way is not cryptographically + secure! + +@@ -747,7 +752,7 @@ config ARCH_MMAP_RND_BITS + int "Number of bits to use for ASLR of mmap base address" if EXPERT + range ARCH_MMAP_RND_BITS_MIN ARCH_MMAP_RND_BITS_MAX + default ARCH_MMAP_RND_BITS_DEFAULT if ARCH_MMAP_RND_BITS_DEFAULT +- default ARCH_MMAP_RND_BITS_MIN ++ default ARCH_MMAP_RND_BITS_MAX + depends on HAVE_ARCH_MMAP_RND_BITS + help + This value can be used to select the number of bits to use to +@@ -781,7 +786,7 @@ config ARCH_MMAP_RND_COMPAT_BITS + int "Number of bits to use for ASLR of mmap base address for compatible applications" if EXPERT + range ARCH_MMAP_RND_COMPAT_BITS_MIN ARCH_MMAP_RND_COMPAT_BITS_MAX + default ARCH_MMAP_RND_COMPAT_BITS_DEFAULT if ARCH_MMAP_RND_COMPAT_BITS_DEFAULT +- default ARCH_MMAP_RND_COMPAT_BITS_MIN ++ default ARCH_MMAP_RND_COMPAT_BITS_MAX + depends on HAVE_ARCH_MMAP_RND_COMPAT_BITS + help + This value can be used to select the number of bits to use to +@@ -968,6 +973,7 @@ config ARCH_HAS_REFCOUNT + + config REFCOUNT_FULL + bool "Perform full reference count validation at the expense of speed" ++ default y + help + Enabling this switches the refcounting infrastructure from a fast + unchecked atomic_t implementation to a fully state checked +diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig +index be665760f2bd..5fb9026c9762 100644 +--- a/arch/arm64/Kconfig ++++ b/arch/arm64/Kconfig +@@ -988,6 +988,7 @@ endif + + config ARM64_SW_TTBR0_PAN + bool "Emulate Privileged Access Never using TTBR0_EL1 switching" ++ default y + help + Enabling this option prevents the kernel from accessing + user-space memory directly by pointing TTBR0_EL1 to a reserved +@@ -1141,6 +1142,7 @@ config RANDOMIZE_BASE + bool "Randomize the address of the kernel image" + select ARM64_MODULE_PLTS if MODULES + select RELOCATABLE ++ default y + help + Randomizes the virtual address at which the kernel image is + loaded, as a security feature that deters exploit attempts +diff --git a/arch/arm64/Kconfig.debug b/arch/arm64/Kconfig.debug +index cc6bd559af85..01d5442d4722 100644 +--- a/arch/arm64/Kconfig.debug ++++ b/arch/arm64/Kconfig.debug +@@ -45,6 +45,7 @@ config ARM64_RANDOMIZE_TEXT_OFFSET + config DEBUG_WX + bool "Warn on W+X mappings at boot" + select ARM64_PTDUMP_CORE ++ default y + ---help--- + Generate a warning if any W+X mappings are found at boot. + +diff --git a/arch/arm64/configs/defconfig b/arch/arm64/configs/defconfig +index 634b373785c4..5b255a6db6a7 100644 +--- a/arch/arm64/configs/defconfig ++++ b/arch/arm64/configs/defconfig +@@ -1,4 +1,3 @@ +-CONFIG_SYSVIPC=y + CONFIG_POSIX_MQUEUE=y + CONFIG_AUDIT=y + CONFIG_NO_HZ_IDLE=y +diff --git a/arch/arm64/include/asm/elf.h b/arch/arm64/include/asm/elf.h +index fac1c4de7898..34786ca166e4 100644 +--- a/arch/arm64/include/asm/elf.h ++++ b/arch/arm64/include/asm/elf.h +@@ -114,10 +114,10 @@ + + /* + * This is the base location for PIE (ET_DYN with INTERP) loads. On +- * 64-bit, this is above 4GB to leave the entire 32-bit address ++ * 64-bit, this is raised to 4GB to leave the entire 32-bit address + * space open for things that want to use the area for 32-bit pointers. + */ +-#define ELF_ET_DYN_BASE (2 * TASK_SIZE_64 / 3) ++#define ELF_ET_DYN_BASE 0x100000000UL + + #ifndef __ASSEMBLY__ + +@@ -158,10 +158,10 @@ extern int arch_setup_additional_pages(struct linux_binprm *bprm, + /* 1GB of VA */ + #ifdef CONFIG_COMPAT + #define STACK_RND_MASK (test_thread_flag(TIF_32BIT) ? \ +- 0x7ff >> (PAGE_SHIFT - 12) : \ +- 0x3ffff >> (PAGE_SHIFT - 12)) ++ ((1UL << mmap_rnd_compat_bits) - 1) >> (PAGE_SHIFT - 12) : \ ++ ((1UL << mmap_rnd_bits) - 1) >> (PAGE_SHIFT - 12)) + #else +-#define STACK_RND_MASK (0x3ffff >> (PAGE_SHIFT - 12)) ++#define STACK_RND_MASK (((1UL << mmap_rnd_bits) - 1) >> (PAGE_SHIFT - 12)) + #endif + + #ifdef __AARCH64EB__ +diff --git a/arch/arm64/kernel/process.c b/arch/arm64/kernel/process.c +index c0da6efe5465..f308b521c114 100644 +--- a/arch/arm64/kernel/process.c ++++ b/arch/arm64/kernel/process.c +@@ -481,9 +481,9 @@ unsigned long arch_align_stack(unsigned long sp) + unsigned long arch_randomize_brk(struct mm_struct *mm) + { + if (is_compat_task()) +- return randomize_page(mm->brk, SZ_32M); ++ return mm->brk + get_random_long() % SZ_32M + PAGE_SIZE; + else +- return randomize_page(mm->brk, SZ_1G); ++ return mm->brk + get_random_long() % SZ_1G + PAGE_SIZE; + } + + /* +diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig +index 0fa71a78ec99..d78d44944374 100644 +--- a/arch/x86/Kconfig ++++ b/arch/x86/Kconfig +@@ -1208,8 +1208,7 @@ config VM86 + default X86_LEGACY_VM86 + + config X86_16BIT +- bool "Enable support for 16-bit segments" if EXPERT +- default y ++ bool "Enable support for 16-bit segments" + depends on MODIFY_LDT_SYSCALL + ---help--- + This option is required by programs like Wine to run 16-bit +@@ -2299,7 +2298,7 @@ config COMPAT_VDSO + choice + prompt "vsyscall table for legacy applications" + depends on X86_64 +- default LEGACY_VSYSCALL_EMULATE ++ default LEGACY_VSYSCALL_NONE + help + Legacy user code that does not know how to find the vDSO expects + to be able to issue three syscalls by calling fixed addresses in +@@ -2380,8 +2379,7 @@ config CMDLINE_OVERRIDE + be set to 'N' under normal conditions. + + config MODIFY_LDT_SYSCALL +- bool "Enable the LDT (local descriptor table)" if EXPERT +- default y ++ bool "Enable the LDT (local descriptor table)" + ---help--- + Linux can allow user programs to install a per-process x86 + Local Descriptor Table (LDT) using the modify_ldt(2) system +diff --git a/arch/x86/Kconfig.debug b/arch/x86/Kconfig.debug +index 192e4d2f9efc..343c2f1b13da 100644 +--- a/arch/x86/Kconfig.debug ++++ b/arch/x86/Kconfig.debug +@@ -101,6 +101,7 @@ config EFI_PGT_DUMP + config DEBUG_WX + bool "Warn on W+X mappings at boot" + select X86_PTDUMP_CORE ++ default y + ---help--- + Generate a warning if any W+X mappings are found at boot. + +diff --git a/arch/x86/configs/x86_64_defconfig b/arch/x86/configs/x86_64_defconfig +index e32fc1f274d8..d08acc76502a 100644 +--- a/arch/x86/configs/x86_64_defconfig ++++ b/arch/x86/configs/x86_64_defconfig +@@ -1,5 +1,4 @@ + # CONFIG_LOCALVERSION_AUTO is not set +-CONFIG_SYSVIPC=y + CONFIG_POSIX_MQUEUE=y + CONFIG_BSD_PROCESS_ACCT=y + CONFIG_TASKSTATS=y +diff --git a/arch/x86/entry/vdso/vma.c b/arch/x86/entry/vdso/vma.c +index 5b8b556dbb12..a569f08b4478 100644 +--- a/arch/x86/entry/vdso/vma.c ++++ b/arch/x86/entry/vdso/vma.c +@@ -204,55 +204,9 @@ static int map_vdso(const struct vdso_image *image, unsigned long addr) + } + + #ifdef CONFIG_X86_64 +-/* +- * Put the vdso above the (randomized) stack with another randomized +- * offset. This way there is no hole in the middle of address space. +- * To save memory make sure it is still in the same PTE as the stack +- * top. This doesn't give that many random bits. +- * +- * Note that this algorithm is imperfect: the distribution of the vdso +- * start address within a PMD is biased toward the end. +- * +- * Only used for the 64-bit and x32 vdsos. +- */ +-static unsigned long vdso_addr(unsigned long start, unsigned len) +-{ +- unsigned long addr, end; +- unsigned offset; +- +- /* +- * Round up the start address. It can start out unaligned as a result +- * of stack start randomization. +- */ +- start = PAGE_ALIGN(start); +- +- /* Round the lowest possible end address up to a PMD boundary. */ +- end = (start + len + PMD_SIZE - 1) & PMD_MASK; +- if (end >= TASK_SIZE_MAX) +- end = TASK_SIZE_MAX; +- end -= len; +- +- if (end > start) { +- offset = get_random_int() % (((end - start) >> PAGE_SHIFT) + 1); +- addr = start + (offset << PAGE_SHIFT); +- } else { +- addr = start; +- } +- +- /* +- * Forcibly align the final address in case we have a hardware +- * issue that requires alignment for performance reasons. +- */ +- addr = align_vdso_addr(addr); +- +- return addr; +-} +- + static int map_vdso_randomized(const struct vdso_image *image) + { +- unsigned long addr = vdso_addr(current->mm->start_stack, image->size-image->sym_vvar_start); +- +- return map_vdso(image, addr); ++ return map_vdso(image, 0); + } + #endif + +diff --git a/arch/x86/include/asm/elf.h b/arch/x86/include/asm/elf.h +index 0d157d2a1e2a..770c8ae97f92 100644 +--- a/arch/x86/include/asm/elf.h ++++ b/arch/x86/include/asm/elf.h +@@ -249,11 +249,11 @@ extern int force_personality32; + + /* + * This is the base location for PIE (ET_DYN with INTERP) loads. On +- * 64-bit, this is above 4GB to leave the entire 32-bit address ++ * 64-bit, this is raised to 4GB to leave the entire 32-bit address + * space open for things that want to use the area for 32-bit pointers. + */ + #define ELF_ET_DYN_BASE (mmap_is_ia32() ? 0x000400000UL : \ +- (DEFAULT_MAP_WINDOW / 3 * 2)) ++ 0x100000000UL) + + /* This yields a mask that user programs can use to figure out what + instruction set this CPU supports. This could be done in user space, +@@ -313,8 +313,8 @@ extern bool mmap_address_hint_valid(unsigned long addr, unsigned long len); + + #ifdef CONFIG_X86_32 + +-#define __STACK_RND_MASK(is32bit) (0x7ff) +-#define STACK_RND_MASK (0x7ff) ++#define __STACK_RND_MASK(is32bit) ((1UL << mmap_rnd_bits) - 1) ++#define STACK_RND_MASK ((1UL << mmap_rnd_bits) - 1) + + #define ARCH_DLINFO ARCH_DLINFO_IA32 + +@@ -323,7 +323,11 @@ extern bool mmap_address_hint_valid(unsigned long addr, unsigned long len); + #else /* CONFIG_X86_32 */ + + /* 1GB for 64bit, 8MB for 32bit */ +-#define __STACK_RND_MASK(is32bit) ((is32bit) ? 0x7ff : 0x3fffff) ++#ifdef CONFIG_COMPAT ++#define __STACK_RND_MASK(is32bit) ((is32bit) ? (1UL << mmap_rnd_compat_bits) - 1 : (1UL << mmap_rnd_bits) - 1) ++#else ++#define __STACK_RND_MASK(is32bit) ((1UL << mmap_rnd_bits) - 1) ++#endif + #define STACK_RND_MASK __STACK_RND_MASK(mmap_is_ia32()) + + #define ARCH_DLINFO \ +@@ -381,5 +385,4 @@ struct va_alignment { + } ____cacheline_aligned; + + extern struct va_alignment va_align; +-extern unsigned long align_vdso_addr(unsigned long); + #endif /* _ASM_X86_ELF_H */ +diff --git a/arch/x86/include/asm/tlbflush.h b/arch/x86/include/asm/tlbflush.h +index 84137c22fdfa..4f197404cab9 100644 +--- a/arch/x86/include/asm/tlbflush.h ++++ b/arch/x86/include/asm/tlbflush.h +@@ -261,6 +261,7 @@ static inline void cr4_set_bits(unsigned long mask) + + local_irq_save(flags); + cr4 = this_cpu_read(cpu_tlbstate.cr4); ++ BUG_ON(cr4 != __read_cr4()); + if ((cr4 | mask) != cr4) + __cr4_set(cr4 | mask); + local_irq_restore(flags); +@@ -273,6 +274,7 @@ static inline void cr4_clear_bits(unsigned long mask) + + local_irq_save(flags); + cr4 = this_cpu_read(cpu_tlbstate.cr4); ++ BUG_ON(cr4 != __read_cr4()); + if ((cr4 & ~mask) != cr4) + __cr4_set(cr4 & ~mask); + local_irq_restore(flags); +@@ -283,6 +285,7 @@ static inline void cr4_toggle_bits_irqsoff(unsigned long mask) + unsigned long cr4; + + cr4 = this_cpu_read(cpu_tlbstate.cr4); ++ BUG_ON(cr4 != __read_cr4()); + __cr4_set(cr4 ^ mask); + } + +@@ -389,6 +392,7 @@ static inline void __native_flush_tlb_global(void) + raw_local_irq_save(flags); + + cr4 = this_cpu_read(cpu_tlbstate.cr4); ++ BUG_ON(cr4 != __read_cr4()); + /* toggle PGE */ + native_write_cr4(cr4 ^ X86_CR4_PGE); + /* write old PGE again and flush TLBs */ +diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c +index 5f74f94244e1..9c9fdb5ef52e 100644 +--- a/arch/x86/kernel/cpu/common.c ++++ b/arch/x86/kernel/cpu/common.c +@@ -1662,7 +1662,6 @@ void cpu_init(void) + wrmsrl(MSR_KERNEL_GS_BASE, 0); + barrier(); + +- x86_configure_nx(); + x2apic_setup(); + + /* +diff --git a/arch/x86/kernel/process.c b/arch/x86/kernel/process.c +index 30ca2d1a9231..bde0a18cd9f9 100644 +--- a/arch/x86/kernel/process.c ++++ b/arch/x86/kernel/process.c +@@ -39,6 +39,8 @@ + #include <asm/desc.h> + #include <asm/prctl.h> + #include <asm/spec-ctrl.h> ++#include <asm/elf.h> ++#include <linux/sizes.h> + + /* + * per-CPU TSS segments. Threads are completely 'soft' on Linux, +@@ -718,7 +720,10 @@ unsigned long arch_align_stack(unsigned long sp) + + unsigned long arch_randomize_brk(struct mm_struct *mm) + { +- return randomize_page(mm->brk, 0x02000000); ++ if (mmap_is_ia32()) ++ return mm->brk + get_random_long() % SZ_32M + PAGE_SIZE; ++ else ++ return mm->brk + get_random_long() % SZ_1G + PAGE_SIZE; + } + + /* +diff --git a/arch/x86/kernel/sys_x86_64.c b/arch/x86/kernel/sys_x86_64.c +index 676774b9bb8d..5ad7a95382b0 100644 +--- a/arch/x86/kernel/sys_x86_64.c ++++ b/arch/x86/kernel/sys_x86_64.c +@@ -54,13 +54,6 @@ static unsigned long get_align_bits(void) + return va_align.bits & get_align_mask(); + } + +-unsigned long align_vdso_addr(unsigned long addr) +-{ +- unsigned long align_mask = get_align_mask(); +- addr = (addr + align_mask) & ~align_mask; +- return addr | get_align_bits(); +-} +- + static int __init control_va_addr_alignment(char *str) + { + /* guard against enabling this on other CPU families */ +@@ -122,10 +115,7 @@ static void find_start_end(unsigned long addr, unsigned long flags, + } + + *begin = get_mmap_base(1); +- if (in_compat_syscall()) +- *end = task_size_32bit(); +- else +- *end = task_size_64bit(addr > DEFAULT_MAP_WINDOW); ++ *end = get_mmap_base(0); + } + + unsigned long +@@ -210,7 +200,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0, + + info.flags = VM_UNMAPPED_AREA_TOPDOWN; + info.length = len; +- info.low_limit = PAGE_SIZE; ++ info.low_limit = get_mmap_base(1); + info.high_limit = get_mmap_base(0); + + /* +diff --git a/arch/x86/mm/init_32.c b/arch/x86/mm/init_32.c +index 396e1f0151ac..6526b19579dc 100644 +--- a/arch/x86/mm/init_32.c ++++ b/arch/x86/mm/init_32.c +@@ -558,7 +558,7 @@ static void __init pagetable_init(void) + permanent_kmaps_init(pgd_base); + } + +-pteval_t __supported_pte_mask __read_mostly = ~(_PAGE_NX | _PAGE_GLOBAL); ++pteval_t __supported_pte_mask __ro_after_init = ~(_PAGE_NX | _PAGE_GLOBAL); + EXPORT_SYMBOL_GPL(__supported_pte_mask); + + /* user-defined highmem size */ +@@ -866,7 +866,7 @@ int arch_remove_memory(u64 start, u64 size, struct vmem_altmap *altmap) + #endif + #endif + +-int kernel_set_to_readonly __read_mostly; ++int kernel_set_to_readonly __ro_after_init; + + void set_kernel_text_rw(void) + { +@@ -918,12 +918,11 @@ void mark_rodata_ro(void) + unsigned long start = PFN_ALIGN(_text); + unsigned long size = PFN_ALIGN(_etext) - start; + ++ kernel_set_to_readonly = 1; + set_pages_ro(virt_to_page(start), size >> PAGE_SHIFT); + printk(KERN_INFO "Write protecting the kernel text: %luk\n", + size >> 10); + +- kernel_set_to_readonly = 1; +- + #ifdef CONFIG_CPA_DEBUG + printk(KERN_INFO "Testing CPA: Reverting %lx-%lx\n", + start, start+size); +diff --git a/arch/x86/mm/init_64.c b/arch/x86/mm/init_64.c +index af11a2890235..b2d28d38c01e 100644 +--- a/arch/x86/mm/init_64.c ++++ b/arch/x86/mm/init_64.c +@@ -65,7 +65,7 @@ + * around without checking the pgd every time. + */ + +-pteval_t __supported_pte_mask __read_mostly = ~0; ++pteval_t __supported_pte_mask __ro_after_init = ~0; + EXPORT_SYMBOL_GPL(__supported_pte_mask); + + int force_personality32; +@@ -1195,7 +1195,7 @@ void __init mem_init(void) + mem_init_print_info(NULL); + } + +-int kernel_set_to_readonly; ++int kernel_set_to_readonly __ro_after_init; + + void set_kernel_text_rw(void) + { +@@ -1244,9 +1244,8 @@ void mark_rodata_ro(void) + + printk(KERN_INFO "Write protecting the kernel read-only data: %luk\n", + (end - start) >> 10); +- set_memory_ro(start, (end - start) >> PAGE_SHIFT); +- + kernel_set_to_readonly = 1; ++ set_memory_ro(start, (end - start) >> PAGE_SHIFT); + + /* + * The rodata/data/bss/brk section (but not the kernel text!) +diff --git a/block/blk-softirq.c b/block/blk-softirq.c +index 01e2b353a2b9..9aeddca4a29f 100644 +--- a/block/blk-softirq.c ++++ b/block/blk-softirq.c +@@ -20,7 +20,7 @@ static DEFINE_PER_CPU(struct list_head, blk_cpu_done); + * Softirq action handler - move entries to local list and loop over them + * while passing them to the queue registered handler. + */ +-static __latent_entropy void blk_done_softirq(struct softirq_action *h) ++static __latent_entropy void blk_done_softirq(void) + { + struct list_head *cpu_list, local_list; + +diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c +index 0df21f046fc6..6f8d9bf71bba 100644 +--- a/drivers/ata/libata-core.c ++++ b/drivers/ata/libata-core.c +@@ -5151,7 +5151,7 @@ void ata_qc_free(struct ata_queued_cmd *qc) + struct ata_port *ap; + unsigned int tag; + +- WARN_ON_ONCE(qc == NULL); /* ata_qc_from_tag _might_ return NULL */ ++ BUG_ON(qc == NULL); /* ata_qc_from_tag _might_ return NULL */ + ap = qc->ap; + + qc->flags = 0; +@@ -5168,7 +5168,7 @@ void __ata_qc_complete(struct ata_queued_cmd *qc) + struct ata_port *ap; + struct ata_link *link; + +- WARN_ON_ONCE(qc == NULL); /* ata_qc_from_tag _might_ return NULL */ ++ BUG_ON(qc == NULL); /* ata_qc_from_tag _might_ return NULL */ + WARN_ON_ONCE(!(qc->flags & ATA_QCFLAG_ACTIVE)); + ap = qc->ap; + link = qc->dev->link; +diff --git a/drivers/char/Kconfig b/drivers/char/Kconfig +index c28dca0c613d..d4813f0d25ca 100644 +--- a/drivers/char/Kconfig ++++ b/drivers/char/Kconfig +@@ -9,7 +9,6 @@ source "drivers/tty/Kconfig" + + config DEVMEM + bool "/dev/mem virtual device support" +- default y + help + Say Y here if you want to support the /dev/mem device. + The /dev/mem device is used to access areas of physical +@@ -568,7 +567,6 @@ config TELCLOCK + config DEVPORT + bool "/dev/port character device" + depends on ISA || PCI +- default y + help + Say Y here if you want to support the /dev/port device. The /dev/port + device is similar to /dev/mem, but for I/O ports. +diff --git a/drivers/tty/Kconfig b/drivers/tty/Kconfig +index b811442c5ce6..4f62a63cbcb1 100644 +--- a/drivers/tty/Kconfig ++++ b/drivers/tty/Kconfig +@@ -122,7 +122,6 @@ config UNIX98_PTYS + + config LEGACY_PTYS + bool "Legacy (BSD) PTY support" +- default y + ---help--- + A pseudo terminal (PTY) is a software device consisting of two + halves: a master and a slave. The slave device behaves identical to +diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c +index 83c58a20d16f..32ef2e3a8482 100644 +--- a/drivers/usb/core/hub.c ++++ b/drivers/usb/core/hub.c +@@ -41,6 +41,8 @@ + #define USB_TP_TRANSMISSION_DELAY 40 /* ns */ + #define USB_TP_TRANSMISSION_DELAY_MAX 65535 /* ns */ + ++extern int deny_new_usb; ++ + /* Protect struct usb_device->state and ->children members + * Note: Both are also protected by ->dev.sem, except that ->state can + * change to USB_STATE_NOTATTACHED even when the semaphore isn't held. */ +@@ -4847,6 +4849,12 @@ static void hub_port_connect(struct usb_hub *hub, int port1, u16 portstatus, + goto done; + return; + } ++ ++ if (deny_new_usb) { ++ dev_err(&port_dev->dev, "denied insert of USB device on port %d\n", port1); ++ goto done; ++ } ++ + if (hub_is_superspeed(hub->hdev)) + unit_load = 150; + else +diff --git a/fs/exec.c b/fs/exec.c +index 7eb8d21bcab9..171f31b3bf05 100644 +--- a/fs/exec.c ++++ b/fs/exec.c +@@ -62,6 +62,7 @@ + #include <linux/oom.h> + #include <linux/compat.h> + #include <linux/vmalloc.h> ++#include <linux/random.h> + + #include <linux/uaccess.h> + #include <asm/mmu_context.h> +@@ -321,6 +322,8 @@ static int __bprm_mm_init(struct linux_binprm *bprm) + arch_bprm_mm_init(mm, vma); + up_write(&mm->mmap_sem); + bprm->p = vma->vm_end - sizeof(void *); ++ if (randomize_va_space) ++ bprm->p ^= get_random_int() & ~PAGE_MASK; + return 0; + err: + up_write(&mm->mmap_sem); +diff --git a/fs/namei.c b/fs/namei.c +index b61d6aa9279d..255c2dc36189 100644 +--- a/fs/namei.c ++++ b/fs/namei.c +@@ -883,8 +883,8 @@ static inline void put_link(struct nameidata *nd) + path_put(&last->link); + } + +-int sysctl_protected_symlinks __read_mostly = 0; +-int sysctl_protected_hardlinks __read_mostly = 0; ++int sysctl_protected_symlinks __read_mostly = 1; ++int sysctl_protected_hardlinks __read_mostly = 1; + + /** + * may_follow_link - Check symlink following for unsafe situations +diff --git a/fs/nfs/Kconfig b/fs/nfs/Kconfig +index 5f93cfacb3d1..cea0d7d3b23e 100644 +--- a/fs/nfs/Kconfig ++++ b/fs/nfs/Kconfig +@@ -195,4 +195,3 @@ config NFS_DEBUG + bool + depends on NFS_FS && SUNRPC_DEBUG + select CRC32 +- default y +diff --git a/fs/proc/Kconfig b/fs/proc/Kconfig +index 1ade1206bb89..60b0f76dec47 100644 +--- a/fs/proc/Kconfig ++++ b/fs/proc/Kconfig +@@ -39,7 +39,6 @@ config PROC_KCORE + config PROC_VMCORE + bool "/proc/vmcore support" + depends on PROC_FS && CRASH_DUMP +- default y + help + Exports the dump image of crashed kernel in ELF format. + +diff --git a/fs/stat.c b/fs/stat.c +index 873785dae022..d3c2ada8b9c7 100644 +--- a/fs/stat.c ++++ b/fs/stat.c +@@ -40,8 +40,13 @@ void generic_fillattr(struct inode *inode, struct kstat *stat) + stat->gid = inode->i_gid; + stat->rdev = inode->i_rdev; + stat->size = i_size_read(inode); +- stat->atime = inode->i_atime; +- stat->mtime = inode->i_mtime; ++ if (is_sidechannel_device(inode) && !capable_noaudit(CAP_MKNOD)) { ++ stat->atime = inode->i_ctime; ++ stat->mtime = inode->i_ctime; ++ } else { ++ stat->atime = inode->i_atime; ++ stat->mtime = inode->i_mtime; ++ } + stat->ctime = inode->i_ctime; + stat->blksize = i_blocksize(inode); + stat->blocks = inode->i_blocks; +@@ -75,9 +80,14 @@ int vfs_getattr_nosec(const struct path *path, struct kstat *stat, + stat->result_mask |= STATX_BASIC_STATS; + request_mask &= STATX_ALL; + query_flags &= KSTAT_QUERY_FLAGS; +- if (inode->i_op->getattr) +- return inode->i_op->getattr(path, stat, request_mask, +- query_flags); ++ if (inode->i_op->getattr) { ++ int retval = inode->i_op->getattr(path, stat, request_mask, query_flags); ++ if (!retval && is_sidechannel_device(inode) && !capable_noaudit(CAP_MKNOD)) { ++ stat->atime = stat->ctime; ++ stat->mtime = stat->ctime; ++ } ++ return retval; ++ } + + generic_fillattr(inode, stat); + return 0; +diff --git a/include/linux/cache.h b/include/linux/cache.h +index 750621e41d1c..e7157c18c62c 100644 +--- a/include/linux/cache.h ++++ b/include/linux/cache.h +@@ -31,6 +31,8 @@ + #define __ro_after_init __attribute__((__section__(".data..ro_after_init"))) + #endif + ++#define __read_only __ro_after_init ++ + #ifndef ____cacheline_aligned + #define ____cacheline_aligned __attribute__((__aligned__(SMP_CACHE_BYTES))) + #endif +diff --git a/include/linux/capability.h b/include/linux/capability.h +index f640dcbc880c..2b4f5d651f19 100644 +--- a/include/linux/capability.h ++++ b/include/linux/capability.h +@@ -207,6 +207,7 @@ extern bool has_capability_noaudit(struct task_struct *t, int cap); + extern bool has_ns_capability_noaudit(struct task_struct *t, + struct user_namespace *ns, int cap); + extern bool capable(int cap); ++extern bool capable_noaudit(int cap); + extern bool ns_capable(struct user_namespace *ns, int cap); + extern bool ns_capable_noaudit(struct user_namespace *ns, int cap); + #else +@@ -232,6 +233,10 @@ static inline bool capable(int cap) + { + return true; + } ++static inline bool capable_noaudit(int cap) ++{ ++ return true; ++} + static inline bool ns_capable(struct user_namespace *ns, int cap) + { + return true; +diff --git a/include/linux/fs.h b/include/linux/fs.h +index c6baf767619e..31904f3d38a6 100644 +--- a/include/linux/fs.h ++++ b/include/linux/fs.h +@@ -3407,4 +3407,15 @@ static inline bool dir_relax_shared(struct inode *inode) + extern bool path_noexec(const struct path *path); + extern void inode_nohighmem(struct inode *inode); + ++extern int device_sidechannel_restrict; ++ ++static inline bool is_sidechannel_device(const struct inode *inode) ++{ ++ umode_t mode; ++ if (!device_sidechannel_restrict) ++ return false; ++ mode = inode->i_mode; ++ return ((S_ISCHR(mode) || S_ISBLK(mode)) && (mode & (S_IROTH | S_IWOTH))); ++} ++ + #endif /* _LINUX_FS_H */ +diff --git a/include/linux/fsnotify.h b/include/linux/fsnotify.h +index bdaf22582f6e..326ff15d4637 100644 +--- a/include/linux/fsnotify.h ++++ b/include/linux/fsnotify.h +@@ -181,6 +181,9 @@ static inline void fsnotify_access(struct file *file) + struct inode *inode = path->dentry->d_inode; + __u32 mask = FS_ACCESS; + ++ if (is_sidechannel_device(inode)) ++ return; ++ + if (S_ISDIR(inode->i_mode)) + mask |= FS_ISDIR; + +@@ -199,6 +202,9 @@ static inline void fsnotify_modify(struct file *file) + struct inode *inode = path->dentry->d_inode; + __u32 mask = FS_MODIFY; + ++ if (is_sidechannel_device(inode)) ++ return; ++ + if (S_ISDIR(inode->i_mode)) + mask |= FS_ISDIR; + +diff --git a/include/linux/gfp.h b/include/linux/gfp.h +index 1a4582b44d32..4d445a8fe7f2 100644 +--- a/include/linux/gfp.h ++++ b/include/linux/gfp.h +@@ -513,9 +513,9 @@ extern struct page *alloc_pages_vma(gfp_t gfp_mask, int order, + extern unsigned long __get_free_pages(gfp_t gfp_mask, unsigned int order); + extern unsigned long get_zeroed_page(gfp_t gfp_mask); + +-void *alloc_pages_exact(size_t size, gfp_t gfp_mask); ++void *alloc_pages_exact(size_t size, gfp_t gfp_mask) __attribute__((alloc_size(1))); + void free_pages_exact(void *virt, size_t size); +-void * __meminit alloc_pages_exact_nid(int nid, size_t size, gfp_t gfp_mask); ++void * __meminit alloc_pages_exact_nid(int nid, size_t size, gfp_t gfp_mask) __attribute__((alloc_size(1))); + + #define __get_free_page(gfp_mask) \ + __get_free_pages((gfp_mask), 0) +diff --git a/include/linux/highmem.h b/include/linux/highmem.h +index 776f90f3a1cd..3f5c47000059 100644 +--- a/include/linux/highmem.h ++++ b/include/linux/highmem.h +@@ -191,6 +191,13 @@ static inline void clear_highpage(struct page *page) + kunmap_atomic(kaddr); + } + ++static inline void verify_zero_highpage(struct page *page) ++{ ++ void *kaddr = kmap_atomic(page); ++ BUG_ON(memchr_inv(kaddr, 0, PAGE_SIZE)); ++ kunmap_atomic(kaddr); ++} ++ + static inline void zero_user_segments(struct page *page, + unsigned start1, unsigned end1, + unsigned start2, unsigned end2) +diff --git a/include/linux/interrupt.h b/include/linux/interrupt.h +index 69c238210325..ee487ea4f48f 100644 +--- a/include/linux/interrupt.h ++++ b/include/linux/interrupt.h +@@ -485,7 +485,7 @@ extern const char * const softirq_to_name[NR_SOFTIRQS]; + + struct softirq_action + { +- void (*action)(struct softirq_action *); ++ void (*action)(void); + }; + + asmlinkage void do_softirq(void); +@@ -500,7 +500,7 @@ static inline void do_softirq_own_stack(void) + } + #endif + +-extern void open_softirq(int nr, void (*action)(struct softirq_action *)); ++extern void __init open_softirq(int nr, void (*action)(void)); + extern void softirq_init(void); + extern void __raise_softirq_irqoff(unsigned int nr); + +diff --git a/include/linux/kobject_ns.h b/include/linux/kobject_ns.h +index 069aa2ebef90..cb9e3637a620 100644 +--- a/include/linux/kobject_ns.h ++++ b/include/linux/kobject_ns.h +@@ -45,7 +45,7 @@ struct kobj_ns_type_operations { + void (*drop_ns)(void *); + }; + +-int kobj_ns_type_register(const struct kobj_ns_type_operations *ops); ++int __init kobj_ns_type_register(const struct kobj_ns_type_operations *ops); + int kobj_ns_type_registered(enum kobj_ns_type type); + const struct kobj_ns_type_operations *kobj_child_ns_ops(struct kobject *parent); + const struct kobj_ns_type_operations *kobj_ns_ops(struct kobject *kobj); +diff --git a/include/linux/mm.h b/include/linux/mm.h +index a4e9bdbec490..0fe7ebd0f462 100644 +--- a/include/linux/mm.h ++++ b/include/linux/mm.h +@@ -535,7 +535,7 @@ static inline int is_vmalloc_or_module_addr(const void *x) + } + #endif + +-extern void *kvmalloc_node(size_t size, gfp_t flags, int node); ++extern void *kvmalloc_node(size_t size, gfp_t flags, int node) __attribute__((alloc_size(1))); + static inline void *kvmalloc(size_t size, gfp_t flags) + { + return kvmalloc_node(size, flags, NUMA_NO_NODE); +diff --git a/include/linux/percpu.h b/include/linux/percpu.h +index 296bbe49d5d1..b26652c9a98d 100644 +--- a/include/linux/percpu.h ++++ b/include/linux/percpu.h +@@ -129,7 +129,7 @@ extern int __init pcpu_page_first_chunk(size_t reserved_size, + pcpu_fc_populate_pte_fn_t populate_pte_fn); + #endif + +-extern void __percpu *__alloc_reserved_percpu(size_t size, size_t align); ++extern void __percpu *__alloc_reserved_percpu(size_t size, size_t align) __attribute__((alloc_size(1))); + extern bool __is_kernel_percpu_address(unsigned long addr, unsigned long *can_addr); + extern bool is_kernel_percpu_address(unsigned long addr); + +@@ -137,8 +137,8 @@ extern bool is_kernel_percpu_address(unsigned long addr); + extern void __init setup_per_cpu_areas(void); + #endif + +-extern void __percpu *__alloc_percpu_gfp(size_t size, size_t align, gfp_t gfp); +-extern void __percpu *__alloc_percpu(size_t size, size_t align); ++extern void __percpu *__alloc_percpu_gfp(size_t size, size_t align, gfp_t gfp) __attribute__((alloc_size(1))); ++extern void __percpu *__alloc_percpu(size_t size, size_t align) __attribute__((alloc_size(1))); + extern void free_percpu(void __percpu *__pdata); + extern phys_addr_t per_cpu_ptr_to_phys(void *addr); + +diff --git a/include/linux/perf_event.h b/include/linux/perf_event.h +index 7546822a1d74..320033b310d2 100644 +--- a/include/linux/perf_event.h ++++ b/include/linux/perf_event.h +@@ -1151,6 +1151,11 @@ extern int perf_cpu_time_max_percent_handler(struct ctl_table *table, int write, + int perf_event_max_stack_handler(struct ctl_table *table, int write, + void __user *buffer, size_t *lenp, loff_t *ppos); + ++static inline bool perf_paranoid_any(void) ++{ ++ return sysctl_perf_event_paranoid > 2; ++} ++ + static inline bool perf_paranoid_tracepoint_raw(void) + { + return sysctl_perf_event_paranoid > -1; +diff --git a/include/linux/slab.h b/include/linux/slab.h +index 231abc8976c5..b0bf5d4a4934 100644 +--- a/include/linux/slab.h ++++ b/include/linux/slab.h +@@ -177,8 +177,8 @@ void memcg_destroy_kmem_caches(struct mem_cgroup *); + /* + * Common kmalloc functions provided by all allocators + */ +-void * __must_check __krealloc(const void *, size_t, gfp_t); +-void * __must_check krealloc(const void *, size_t, gfp_t); ++void * __must_check __krealloc(const void *, size_t, gfp_t) __attribute__((alloc_size(2))); ++void * __must_check krealloc(const void *, size_t, gfp_t) __attribute((alloc_size(2))); + void kfree(const void *); + void kzfree(const void *); + size_t ksize(const void *); +@@ -351,7 +351,7 @@ static __always_inline int kmalloc_index(size_t size) + } + #endif /* !CONFIG_SLOB */ + +-void *__kmalloc(size_t size, gfp_t flags) __assume_kmalloc_alignment __malloc; ++void *__kmalloc(size_t size, gfp_t flags) __assume_kmalloc_alignment __malloc __attribute__((alloc_size(1))); + void *kmem_cache_alloc(struct kmem_cache *, gfp_t flags) __assume_slab_alignment __malloc; + void kmem_cache_free(struct kmem_cache *, void *); + +@@ -375,7 +375,7 @@ static __always_inline void kfree_bulk(size_t size, void **p) + } + + #ifdef CONFIG_NUMA +-void *__kmalloc_node(size_t size, gfp_t flags, int node) __assume_kmalloc_alignment __malloc; ++void *__kmalloc_node(size_t size, gfp_t flags, int node) __assume_kmalloc_alignment __malloc __attribute__((alloc_size(1))); + void *kmem_cache_alloc_node(struct kmem_cache *, gfp_t flags, int node) __assume_slab_alignment __malloc; + #else + static __always_inline void *__kmalloc_node(size_t size, gfp_t flags, int node) +@@ -497,7 +497,7 @@ static __always_inline void *kmalloc_large(size_t size, gfp_t flags) + * for general use, and so are not documented here. For a full list of + * potential flags, always refer to linux/gfp.h. + */ +-static __always_inline void *kmalloc(size_t size, gfp_t flags) ++static __always_inline __attribute__((alloc_size(1))) void *kmalloc(size_t size, gfp_t flags) + { + if (__builtin_constant_p(size)) { + if (size > KMALLOC_MAX_CACHE_SIZE) +@@ -537,7 +537,7 @@ static __always_inline int kmalloc_size(int n) + return 0; + } + +-static __always_inline void *kmalloc_node(size_t size, gfp_t flags, int node) ++static __always_inline __attribute__((alloc_size(1))) void *kmalloc_node(size_t size, gfp_t flags, int node) + { + #ifndef CONFIG_SLOB + if (__builtin_constant_p(size) && +diff --git a/include/linux/slub_def.h b/include/linux/slub_def.h +index 8ad99c47b19c..91fea0d0db3b 100644 +--- a/include/linux/slub_def.h ++++ b/include/linux/slub_def.h +@@ -120,6 +120,11 @@ struct kmem_cache { + unsigned long random; + #endif + ++#ifdef CONFIG_SLAB_CANARY ++ unsigned long random_active; ++ unsigned long random_inactive; ++#endif ++ + #ifdef CONFIG_NUMA + /* + * Defragmentation by allocating from a remote node. +diff --git a/include/linux/string.h b/include/linux/string.h +index dd39a690c841..00d16d874c0a 100644 +--- a/include/linux/string.h ++++ b/include/linux/string.h +@@ -235,10 +235,16 @@ void __read_overflow2(void) __compiletime_error("detected read beyond size of ob + void __read_overflow3(void) __compiletime_error("detected read beyond size of object passed as 3rd parameter"); + void __write_overflow(void) __compiletime_error("detected write beyond size of object passed as 1st parameter"); + ++#ifdef CONFIG_FORTIFY_SOURCE_STRICT_STRING ++#define __string_size(p) __builtin_object_size(p, 1) ++#else ++#define __string_size(p) __builtin_object_size(p, 0) ++#endif ++ + #if !defined(__NO_FORTIFY) && defined(__OPTIMIZE__) && defined(CONFIG_FORTIFY_SOURCE) + __FORTIFY_INLINE char *strncpy(char *p, const char *q, __kernel_size_t size) + { +- size_t p_size = __builtin_object_size(p, 0); ++ size_t p_size = __string_size(p); + if (__builtin_constant_p(size) && p_size < size) + __write_overflow(); + if (p_size < size) +@@ -248,7 +254,7 @@ __FORTIFY_INLINE char *strncpy(char *p, const char *q, __kernel_size_t size) + + __FORTIFY_INLINE char *strcat(char *p, const char *q) + { +- size_t p_size = __builtin_object_size(p, 0); ++ size_t p_size = __string_size(p); + if (p_size == (size_t)-1) + return __builtin_strcat(p, q); + if (strlcat(p, q, p_size) >= p_size) +@@ -259,7 +265,7 @@ __FORTIFY_INLINE char *strcat(char *p, const char *q) + __FORTIFY_INLINE __kernel_size_t strlen(const char *p) + { + __kernel_size_t ret; +- size_t p_size = __builtin_object_size(p, 0); ++ size_t p_size = __string_size(p); + + /* Work around gcc excess stack consumption issue */ + if (p_size == (size_t)-1 || +@@ -274,7 +280,7 @@ __FORTIFY_INLINE __kernel_size_t strlen(const char *p) + extern __kernel_size_t __real_strnlen(const char *, __kernel_size_t) __RENAME(strnlen); + __FORTIFY_INLINE __kernel_size_t strnlen(const char *p, __kernel_size_t maxlen) + { +- size_t p_size = __builtin_object_size(p, 0); ++ size_t p_size = __string_size(p); + __kernel_size_t ret = __real_strnlen(p, maxlen < p_size ? maxlen : p_size); + if (p_size <= ret && maxlen != ret) + fortify_panic(__func__); +@@ -286,8 +292,8 @@ extern size_t __real_strlcpy(char *, const char *, size_t) __RENAME(strlcpy); + __FORTIFY_INLINE size_t strlcpy(char *p, const char *q, size_t size) + { + size_t ret; +- size_t p_size = __builtin_object_size(p, 0); +- size_t q_size = __builtin_object_size(q, 0); ++ size_t p_size = __string_size(p); ++ size_t q_size = __string_size(q); + if (p_size == (size_t)-1 && q_size == (size_t)-1) + return __real_strlcpy(p, q, size); + ret = strlen(q); +@@ -307,8 +313,8 @@ __FORTIFY_INLINE size_t strlcpy(char *p, const char *q, size_t size) + __FORTIFY_INLINE char *strncat(char *p, const char *q, __kernel_size_t count) + { + size_t p_len, copy_len; +- size_t p_size = __builtin_object_size(p, 0); +- size_t q_size = __builtin_object_size(q, 0); ++ size_t p_size = __string_size(p); ++ size_t q_size = __string_size(q); + if (p_size == (size_t)-1 && q_size == (size_t)-1) + return __builtin_strncat(p, q, count); + p_len = strlen(p); +@@ -421,8 +427,8 @@ __FORTIFY_INLINE void *kmemdup(const void *p, size_t size, gfp_t gfp) + /* defined after fortified strlen and memcpy to reuse them */ + __FORTIFY_INLINE char *strcpy(char *p, const char *q) + { +- size_t p_size = __builtin_object_size(p, 0); +- size_t q_size = __builtin_object_size(q, 0); ++ size_t p_size = __string_size(p); ++ size_t q_size = __string_size(q); + if (p_size == (size_t)-1 && q_size == (size_t)-1) + return __builtin_strcpy(p, q); + memcpy(p, q, strlen(q) + 1); +diff --git a/include/linux/vmalloc.h b/include/linux/vmalloc.h +index 1e5d8c392f15..66d0e49c9987 100644 +--- a/include/linux/vmalloc.h ++++ b/include/linux/vmalloc.h +@@ -68,19 +68,19 @@ static inline void vmalloc_init(void) + } + #endif + +-extern void *vmalloc(unsigned long size); +-extern void *vzalloc(unsigned long size); +-extern void *vmalloc_user(unsigned long size); +-extern void *vmalloc_node(unsigned long size, int node); +-extern void *vzalloc_node(unsigned long size, int node); +-extern void *vmalloc_exec(unsigned long size); +-extern void *vmalloc_32(unsigned long size); +-extern void *vmalloc_32_user(unsigned long size); +-extern void *__vmalloc(unsigned long size, gfp_t gfp_mask, pgprot_t prot); ++extern void *vmalloc(unsigned long size) __attribute__((alloc_size(1))); ++extern void *vzalloc(unsigned long size) __attribute__((alloc_size(1))); ++extern void *vmalloc_user(unsigned long size) __attribute__((alloc_size(1))); ++extern void *vmalloc_node(unsigned long size, int node) __attribute__((alloc_size(1))); ++extern void *vzalloc_node(unsigned long size, int node) __attribute__((alloc_size(1))); ++extern void *vmalloc_exec(unsigned long size) __attribute__((alloc_size(1))); ++extern void *vmalloc_32(unsigned long size) __attribute__((alloc_size(1))); ++extern void *vmalloc_32_user(unsigned long size) __attribute__((alloc_size(1))); ++extern void *__vmalloc(unsigned long size, gfp_t gfp_mask, pgprot_t prot) __attribute__((alloc_size(1))); + extern void *__vmalloc_node_range(unsigned long size, unsigned long align, + unsigned long start, unsigned long end, gfp_t gfp_mask, + pgprot_t prot, unsigned long vm_flags, int node, +- const void *caller); ++ const void *caller) __attribute__((alloc_size(1))); + #ifndef CONFIG_MMU + extern void *__vmalloc_node_flags(unsigned long size, int node, gfp_t flags); + static inline void *__vmalloc_node_flags_caller(unsigned long size, int node, +diff --git a/init/Kconfig b/init/Kconfig +index e37f4b2a6445..49c20dea1afd 100644 +--- a/init/Kconfig ++++ b/init/Kconfig +@@ -296,6 +296,7 @@ config USELIB + config AUDIT + bool "Auditing support" + depends on NET ++ default y + help + Enable auditing infrastructure that can be used with another + kernel subsystem, such as SELinux (which requires this for +@@ -1039,6 +1040,12 @@ config CC_OPTIMIZE_FOR_SIZE + + endchoice + ++config LOCAL_INIT ++ bool "Zero uninitialized locals" ++ help ++ Zero-fill uninitialized local variables, other than variable-length ++ arrays. Requires compiler support. ++ + config SYSCTL + bool + +@@ -1296,8 +1303,7 @@ config SHMEM + which may be appropriate on small systems without swap. + + config AIO +- bool "Enable AIO support" if EXPERT +- default y ++ bool "Enable AIO support" + help + This option enables POSIX asynchronous I/O which may by used + by some high performance threaded applications. Disabling +@@ -1502,7 +1508,7 @@ config VM_EVENT_COUNTERS + + config SLUB_DEBUG + default y +- bool "Enable SLUB debugging support" if EXPERT ++ bool "Enable SLUB debugging support" + depends on SLUB && SYSFS + help + SLUB has extensive debug support features. Disabling these can +@@ -1526,7 +1532,6 @@ config SLUB_MEMCG_SYSFS_ON + + config COMPAT_BRK + bool "Disable heap randomization" +- default y + help + Randomizing heap placement makes heap exploits harder, but it + also breaks ancient binaries (including anything libc5 based). +@@ -1573,7 +1578,6 @@ endchoice + + config SLAB_MERGE_DEFAULT + bool "Allow slab caches to be merged" +- default y + help + For reduced kernel memory fragmentation, slab caches can be + merged when they share the same size and other characteristics. +@@ -1586,9 +1590,9 @@ config SLAB_MERGE_DEFAULT + command line. + + config SLAB_FREELIST_RANDOM +- default n + depends on SLAB || SLUB + bool "SLAB freelist randomization" ++ default y + help + Randomizes the freelist order used on creating new pages. This + security feature reduces the predictability of the kernel slab +@@ -1597,12 +1601,56 @@ config SLAB_FREELIST_RANDOM + config SLAB_FREELIST_HARDENED + bool "Harden slab freelist metadata" + depends on SLUB ++ default y + help + Many kernel heap attacks try to target slab cache metadata and + other infrastructure. This options makes minor performance + sacrifies to harden the kernel slab allocator against common + freelist exploit methods. + ++config SLAB_HARDENED ++ default y ++ depends on SLUB ++ bool "Hardened SLAB infrastructure" ++ help ++ Make minor performance sacrifices to harden the kernel slab ++ allocator. ++ ++config SLAB_CANARY ++ depends on SLUB ++ depends on !SLAB_MERGE_DEFAULT ++ bool "SLAB canaries" ++ default y ++ help ++ Place canaries at the end of kernel slab allocations, sacrificing ++ some performance and memory usage for security. ++ ++ Canaries can detect some forms of heap corruption when allocations ++ are freed and as part of the HARDENED_USERCOPY feature. It provides ++ basic use-after-free detection for HARDENED_USERCOPY. ++ ++ Canaries absorb small overflows (rendering them harmless), mitigate ++ non-NUL terminated C string overflows on 64-bit via a guaranteed zero ++ byte and provide basic double-free detection. ++ ++config SLAB_SANITIZE ++ bool "Sanitize SLAB allocations" ++ depends on SLUB ++ default y ++ help ++ Zero fill slab allocations on free, reducing the lifetime of ++ sensitive data and helping to mitigate use-after-free bugs. ++ ++ For slabs with debug poisoning enabling, this has no impact. ++ ++config SLAB_SANITIZE_VERIFY ++ depends on SLAB_SANITIZE && PAGE_SANITIZE ++ default y ++ bool "Verify sanitized SLAB allocations" ++ help ++ Verify that newly allocated slab allocations are zeroed to detect ++ write-after-free bugs. ++ + config SLUB_CPU_PARTIAL + default y + depends on SLUB && SMP +diff --git a/kernel/audit.c b/kernel/audit.c +index 227db99b0f19..aec52b408543 100644 +--- a/kernel/audit.c ++++ b/kernel/audit.c +@@ -1578,6 +1578,9 @@ static int __init audit_enable(char *str) + + if (audit_default == AUDIT_OFF) + audit_initialized = AUDIT_DISABLED; ++ else if (!audit_ever_enabled) ++ audit_initialized = AUDIT_UNINITIALIZED; ++ + if (audit_set_enabled(audit_default)) + panic("audit: error setting audit state (%d)\n", audit_default); + +diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c +index ba03ec39efb3..47ed9081b668 100644 +--- a/kernel/bpf/core.c ++++ b/kernel/bpf/core.c +@@ -302,7 +302,7 @@ struct bpf_prog *bpf_patch_insn_single(struct bpf_prog *prog, u32 off, + #ifdef CONFIG_BPF_JIT + /* All BPF JIT sysctl knobs here. */ + int bpf_jit_enable __read_mostly = IS_BUILTIN(CONFIG_BPF_JIT_ALWAYS_ON); +-int bpf_jit_harden __read_mostly; ++int bpf_jit_harden __read_mostly = 2; + int bpf_jit_kallsyms __read_mostly; + + static __always_inline void +diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c +index 43f95d190eea..8e353f596873 100644 +--- a/kernel/bpf/syscall.c ++++ b/kernel/bpf/syscall.c +@@ -42,7 +42,7 @@ static DEFINE_SPINLOCK(prog_idr_lock); + static DEFINE_IDR(map_idr); + static DEFINE_SPINLOCK(map_idr_lock); + +-int sysctl_unprivileged_bpf_disabled __read_mostly; ++int sysctl_unprivileged_bpf_disabled __read_mostly = 1; + + static const struct bpf_map_ops * const bpf_map_types[] = { + #define BPF_PROG_TYPE(_id, _ops) +diff --git a/kernel/capability.c b/kernel/capability.c +index 1e1c0236f55b..452062fe45ce 100644 +--- a/kernel/capability.c ++++ b/kernel/capability.c +@@ -431,6 +431,12 @@ bool capable(int cap) + return ns_capable(&init_user_ns, cap); + } + EXPORT_SYMBOL(capable); ++ ++bool capable_noaudit(int cap) ++{ ++ return ns_capable_noaudit(&init_user_ns, cap); ++} ++EXPORT_SYMBOL(capable_noaudit); + #endif /* CONFIG_MULTIUSER */ + + /** +diff --git a/kernel/events/core.c b/kernel/events/core.c +index ca7298760c83..910ac6cc9f07 100644 +--- a/kernel/events/core.c ++++ b/kernel/events/core.c +@@ -397,8 +397,13 @@ static cpumask_var_t perf_online_mask; + * 0 - disallow raw tracepoint access for unpriv + * 1 - disallow cpu events for unpriv + * 2 - disallow kernel profiling for unpriv ++ * 3 - disallow all unpriv perf event use + */ ++#ifdef CONFIG_SECURITY_PERF_EVENTS_RESTRICT ++int sysctl_perf_event_paranoid __read_mostly = 3; ++#else + int sysctl_perf_event_paranoid __read_mostly = 2; ++#endif + + /* Minimum for 512 kiB + 1 user control page */ + int sysctl_perf_event_mlock __read_mostly = 512 + (PAGE_SIZE / 1024); /* 'free' kiB per user */ +@@ -9921,6 +9926,9 @@ SYSCALL_DEFINE5(perf_event_open, + if (flags & ~PERF_FLAG_ALL) + return -EINVAL; + ++ if (perf_paranoid_any() && !capable(CAP_SYS_ADMIN)) ++ return -EACCES; ++ + err = perf_copy_attr(attr_uptr, &attr); + if (err) + return err; +diff --git a/kernel/fork.c b/kernel/fork.c +index e5d9d405ae4e..c4be89c51f25 100644 +--- a/kernel/fork.c ++++ b/kernel/fork.c +@@ -103,6 +103,11 @@ + + #define CREATE_TRACE_POINTS + #include <trace/events/task.h> ++#ifdef CONFIG_USER_NS ++extern int unprivileged_userns_clone; ++#else ++#define unprivileged_userns_clone 0 ++#endif + + /* + * Minimum number of threads to boot the kernel +@@ -1591,6 +1596,10 @@ static __latent_entropy struct task_struct *copy_process( + if ((clone_flags & (CLONE_NEWUSER|CLONE_FS)) == (CLONE_NEWUSER|CLONE_FS)) + return ERR_PTR(-EINVAL); + ++ if ((clone_flags & CLONE_NEWUSER) && !unprivileged_userns_clone) ++ if (!capable(CAP_SYS_ADMIN)) ++ return ERR_PTR(-EPERM); ++ + /* + * Thread groups must share signals as well, and detached threads + * can only be started up within the thread group. +@@ -2385,6 +2394,12 @@ SYSCALL_DEFINE1(unshare, unsigned long, unshare_flags) + if (unshare_flags & CLONE_NEWNS) + unshare_flags |= CLONE_FS; + ++ if ((unshare_flags & CLONE_NEWUSER) && !unprivileged_userns_clone) { ++ err = -EPERM; ++ if (!capable(CAP_SYS_ADMIN)) ++ goto bad_unshare_out; ++ } ++ + err = check_unshare_flags(unshare_flags); + if (err) + goto bad_unshare_out; +diff --git a/kernel/power/snapshot.c b/kernel/power/snapshot.c +index 3d37c279c090..0789ca413f09 100644 +--- a/kernel/power/snapshot.c ++++ b/kernel/power/snapshot.c +@@ -1138,7 +1138,7 @@ void free_basic_memory_bitmaps(void) + + void clear_free_pages(void) + { +-#ifdef CONFIG_PAGE_POISONING_ZERO ++#if defined(CONFIG_PAGE_POISONING_ZERO) || defined(CONFIG_PAGE_SANITIZE) + struct memory_bitmap *bm = free_pages_map; + unsigned long pfn; + +@@ -1155,7 +1155,7 @@ void clear_free_pages(void) + } + memory_bm_position_reset(bm); + pr_info("free pages cleared after restore\n"); +-#endif /* PAGE_POISONING_ZERO */ ++#endif /* PAGE_POISONING_ZERO || PAGE_SANITIZE */ + } + + /** +diff --git a/kernel/rcu/tiny.c b/kernel/rcu/tiny.c +index a64eee0db39e..4d7de378fe4c 100644 +--- a/kernel/rcu/tiny.c ++++ b/kernel/rcu/tiny.c +@@ -164,7 +164,7 @@ static void __rcu_process_callbacks(struct rcu_ctrlblk *rcp) + } + } + +-static __latent_entropy void rcu_process_callbacks(struct softirq_action *unused) ++static __latent_entropy void rcu_process_callbacks(void) + { + __rcu_process_callbacks(&rcu_sched_ctrlblk); + __rcu_process_callbacks(&rcu_bh_ctrlblk); +diff --git a/kernel/rcu/tree.c b/kernel/rcu/tree.c +index 491bdf39f276..28f51c774671 100644 +--- a/kernel/rcu/tree.c ++++ b/kernel/rcu/tree.c +@@ -2906,7 +2906,7 @@ __rcu_process_callbacks(struct rcu_state *rsp) + /* + * Do RCU core processing for the current CPU. + */ +-static __latent_entropy void rcu_process_callbacks(struct softirq_action *unused) ++static __latent_entropy void rcu_process_callbacks(void) + { + struct rcu_state *rsp; + +diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c +index 5eb3ffc9be84..a60c59cbbaee 100644 +--- a/kernel/sched/fair.c ++++ b/kernel/sched/fair.c +@@ -9387,7 +9387,7 @@ static void nohz_idle_balance(struct rq *this_rq, enum cpu_idle_type idle) { } + * run_rebalance_domains is triggered when needed from the scheduler tick. + * Also triggered for nohz idle balancing (with nohz_balancing_kick set). + */ +-static __latent_entropy void run_rebalance_domains(struct softirq_action *h) ++static __latent_entropy void run_rebalance_domains(void) + { + struct rq *this_rq = this_rq(); + enum cpu_idle_type idle = this_rq->idle_balance ? +diff --git a/kernel/softirq.c b/kernel/softirq.c +index 24d243ef8e71..4ed8a162cd70 100644 +--- a/kernel/softirq.c ++++ b/kernel/softirq.c +@@ -53,7 +53,7 @@ irq_cpustat_t irq_stat[NR_CPUS] ____cacheline_aligned; + EXPORT_SYMBOL(irq_stat); + #endif + +-static struct softirq_action softirq_vec[NR_SOFTIRQS] __cacheline_aligned_in_smp; ++static struct softirq_action softirq_vec[NR_SOFTIRQS] __ro_after_init __aligned(PAGE_SIZE); + + DEFINE_PER_CPU(struct task_struct *, ksoftirqd); + +@@ -282,7 +282,7 @@ asmlinkage __visible void __softirq_entry __do_softirq(void) + kstat_incr_softirqs_this_cpu(vec_nr); + + trace_softirq_entry(vec_nr); +- h->action(h); ++ h->action(); + trace_softirq_exit(vec_nr); + if (unlikely(prev_count != preempt_count())) { + pr_err("huh, entered softirq %u %s %p with preempt_count %08x, exited with %08x?\n", +@@ -444,7 +444,7 @@ void __raise_softirq_irqoff(unsigned int nr) + or_softirq_pending(1UL << nr); + } + +-void open_softirq(int nr, void (*action)(struct softirq_action *)) ++void __init open_softirq(int nr, void (*action)(void)) + { + softirq_vec[nr].action = action; + } +@@ -486,7 +486,7 @@ void __tasklet_hi_schedule(struct tasklet_struct *t) + } + EXPORT_SYMBOL(__tasklet_hi_schedule); + +-static __latent_entropy void tasklet_action(struct softirq_action *a) ++static __latent_entropy void tasklet_action(void) + { + struct tasklet_struct *list; + +@@ -522,7 +522,7 @@ static __latent_entropy void tasklet_action(struct softirq_action *a) + } + } + +-static __latent_entropy void tasklet_hi_action(struct softirq_action *a) ++static __latent_entropy void tasklet_hi_action(void) + { + struct tasklet_struct *list; + +diff --git a/kernel/sysctl.c b/kernel/sysctl.c +index f98f28c12020..861e8b721161 100644 +--- a/kernel/sysctl.c ++++ b/kernel/sysctl.c +@@ -99,12 +99,19 @@ + #if defined(CONFIG_SYSCTL) + + /* External variables not in a header file. */ ++#if IS_ENABLED(CONFIG_USB) ++int deny_new_usb __read_mostly = 0; ++EXPORT_SYMBOL(deny_new_usb); ++#endif + extern int suid_dumpable; + #ifdef CONFIG_COREDUMP + extern int core_uses_pid; + extern char core_pattern[]; + extern unsigned int core_pipe_limit; + #endif ++#ifdef CONFIG_USER_NS ++extern int unprivileged_userns_clone; ++#endif + extern int pid_max; + extern int pid_max_min, pid_max_max; + extern int percpu_pagelist_fraction; +@@ -116,40 +123,43 @@ extern int sysctl_nr_trim_pages; + + /* Constants used for minimum and maximum */ + #ifdef CONFIG_LOCKUP_DETECTOR +-static int sixty = 60; ++static int sixty __read_only = 60; + #endif + +-static int __maybe_unused neg_one = -1; ++static int __maybe_unused neg_one __read_only = -1; + + static int zero; +-static int __maybe_unused one = 1; +-static int __maybe_unused two = 2; +-static int __maybe_unused four = 4; +-static unsigned long one_ul = 1; +-static int one_hundred = 100; +-static int one_thousand = 1000; ++static int __maybe_unused one __read_only = 1; ++static int __maybe_unused two __read_only = 2; ++static int __maybe_unused four __read_only = 4; ++static unsigned long one_ul __read_only = 1; ++static int one_hundred __read_only = 100; ++static int one_thousand __read_only = 1000; + #ifdef CONFIG_PRINTK +-static int ten_thousand = 10000; ++static int ten_thousand __read_only = 10000; + #endif + #ifdef CONFIG_PERF_EVENTS +-static int six_hundred_forty_kb = 640 * 1024; ++static int six_hundred_forty_kb __read_only = 640 * 1024; + #endif + + /* this is needed for the proc_doulongvec_minmax of vm_dirty_bytes */ +-static unsigned long dirty_bytes_min = 2 * PAGE_SIZE; ++static unsigned long dirty_bytes_min __read_only = 2 * PAGE_SIZE; + + /* this is needed for the proc_dointvec_minmax for [fs_]overflow UID and GID */ +-static int maxolduid = 65535; +-static int minolduid; ++static int maxolduid __read_only = 65535; ++static int minolduid __read_only; + +-static int ngroups_max = NGROUPS_MAX; ++static int ngroups_max __read_only = NGROUPS_MAX; + static const int cap_last_cap = CAP_LAST_CAP; + + /*this is needed for proc_doulongvec_minmax of sysctl_hung_task_timeout_secs */ + #ifdef CONFIG_DETECT_HUNG_TASK +-static unsigned long hung_task_timeout_max = (LONG_MAX/HZ); ++static unsigned long hung_task_timeout_max __read_only = (LONG_MAX/HZ); + #endif + ++int device_sidechannel_restrict __read_mostly = 1; ++EXPORT_SYMBOL(device_sidechannel_restrict); ++ + #ifdef CONFIG_INOTIFY_USER + #include <linux/inotify.h> + #endif +@@ -289,19 +299,19 @@ static struct ctl_table sysctl_base_table[] = { + }; + + #ifdef CONFIG_SCHED_DEBUG +-static int min_sched_granularity_ns = 100000; /* 100 usecs */ +-static int max_sched_granularity_ns = NSEC_PER_SEC; /* 1 second */ +-static int min_wakeup_granularity_ns; /* 0 usecs */ +-static int max_wakeup_granularity_ns = NSEC_PER_SEC; /* 1 second */ ++static int min_sched_granularity_ns __read_only = 100000; /* 100 usecs */ ++static int max_sched_granularity_ns __read_only = NSEC_PER_SEC; /* 1 second */ ++static int min_wakeup_granularity_ns __read_only; /* 0 usecs */ ++static int max_wakeup_granularity_ns __read_only = NSEC_PER_SEC; /* 1 second */ + #ifdef CONFIG_SMP +-static int min_sched_tunable_scaling = SCHED_TUNABLESCALING_NONE; +-static int max_sched_tunable_scaling = SCHED_TUNABLESCALING_END-1; ++static int min_sched_tunable_scaling __read_only = SCHED_TUNABLESCALING_NONE; ++static int max_sched_tunable_scaling __read_only = SCHED_TUNABLESCALING_END-1; + #endif /* CONFIG_SMP */ + #endif /* CONFIG_SCHED_DEBUG */ + + #ifdef CONFIG_COMPACTION +-static int min_extfrag_threshold; +-static int max_extfrag_threshold = 1000; ++static int min_extfrag_threshold __read_only; ++static int max_extfrag_threshold __read_only = 1000; + #endif + + static struct ctl_table kern_table[] = { +@@ -515,6 +525,15 @@ static struct ctl_table kern_table[] = { + .proc_handler = proc_dointvec, + }, + #endif ++#ifdef CONFIG_USER_NS ++ { ++ .procname = "unprivileged_userns_clone", ++ .data = &unprivileged_userns_clone, ++ .maxlen = sizeof(int), ++ .mode = 0644, ++ .proc_handler = proc_dointvec, ++ }, ++#endif + #ifdef CONFIG_PROC_SYSCTL + { + .procname = "tainted", +@@ -856,6 +875,26 @@ static struct ctl_table kern_table[] = { + .extra1 = &zero, + .extra2 = &two, + }, ++#endif ++ { ++ .procname = "device_sidechannel_restrict", ++ .data = &device_sidechannel_restrict, ++ .maxlen = sizeof(int), ++ .mode = 0644, ++ .proc_handler = proc_dointvec_minmax_sysadmin, ++ .extra1 = &zero, ++ .extra2 = &one, ++ }, ++#if IS_ENABLED(CONFIG_USB) ++ { ++ .procname = "deny_new_usb", ++ .data = &deny_new_usb, ++ .maxlen = sizeof(int), ++ .mode = 0644, ++ .proc_handler = proc_dointvec_minmax_sysadmin, ++ .extra1 = &zero, ++ .extra2 = &one, ++ }, + #endif + { + .procname = "ngroups_max", +diff --git a/kernel/time/hrtimer.c b/kernel/time/hrtimer.c +index 23788100e214..5577a58d1c7a 100644 +--- a/kernel/time/hrtimer.c ++++ b/kernel/time/hrtimer.c +@@ -1413,7 +1413,7 @@ static void __hrtimer_run_queues(struct hrtimer_cpu_base *cpu_base, ktime_t now, + } + } + +-static __latent_entropy void hrtimer_run_softirq(struct softirq_action *h) ++static __latent_entropy void hrtimer_run_softirq(void) + { + struct hrtimer_cpu_base *cpu_base = this_cpu_ptr(&hrtimer_bases); + unsigned long flags; +diff --git a/kernel/time/timer.c b/kernel/time/timer.c +index 4a4fd567fb26..be236ef42690 100644 +--- a/kernel/time/timer.c ++++ b/kernel/time/timer.c +@@ -1672,7 +1672,7 @@ static inline void __run_timers(struct timer_base *base) + /* + * This function runs timers and the timer-tq in bottom half context. + */ +-static __latent_entropy void run_timer_softirq(struct softirq_action *h) ++static __latent_entropy void run_timer_softirq(void) + { + struct timer_base *base = this_cpu_ptr(&timer_bases[BASE_STD]); + +diff --git a/kernel/user_namespace.c b/kernel/user_namespace.c +index 246d4d4ce5c7..f64432b45cec 100644 +--- a/kernel/user_namespace.c ++++ b/kernel/user_namespace.c +@@ -26,6 +26,9 @@ + #include <linux/bsearch.h> + #include <linux/sort.h> + ++/* sysctl */ ++int unprivileged_userns_clone; ++ + static struct kmem_cache *user_ns_cachep __read_mostly; + static DEFINE_MUTEX(userns_state_mutex); + +diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug +index 64155e310a9f..0c002bbb8f75 100644 +--- a/lib/Kconfig.debug ++++ b/lib/Kconfig.debug +@@ -945,6 +945,7 @@ endmenu # "Debug lockups and hangs" + + config PANIC_ON_OOPS + bool "Panic on Oops" ++ default y + help + Say Y here to enable the kernel to panic when it oopses. This + has the same effect as setting oops=panic on the kernel command +@@ -954,7 +955,7 @@ config PANIC_ON_OOPS + anything erroneous after an oops which could result in data + corruption or other issues. + +- Say N if unsure. ++ Say Y if unsure. + + config PANIC_ON_OOPS_VALUE + int +@@ -1309,6 +1310,7 @@ config DEBUG_BUGVERBOSE + config DEBUG_LIST + bool "Debug linked list manipulation" + depends on DEBUG_KERNEL || BUG_ON_DATA_CORRUPTION ++ default y + help + Enable this to turn on extended checks in the linked-list + walking routines. +@@ -1949,6 +1951,7 @@ config MEMTEST + config BUG_ON_DATA_CORRUPTION + bool "Trigger a BUG when data corruption is detected" + select DEBUG_LIST ++ default y + help + Select this option if the kernel should BUG when it encounters + data corruption in kernel memory structures when they get checked +@@ -1988,6 +1991,7 @@ config STRICT_DEVMEM + config IO_STRICT_DEVMEM + bool "Filter I/O access to /dev/mem" + depends on STRICT_DEVMEM ++ default y + ---help--- + If this option is disabled, you allow userspace (root) access to all + io-memory regardless of whether a driver is actively using that +diff --git a/lib/irq_poll.c b/lib/irq_poll.c +index 86a709954f5a..6f15787fcb1b 100644 +--- a/lib/irq_poll.c ++++ b/lib/irq_poll.c +@@ -75,7 +75,7 @@ void irq_poll_complete(struct irq_poll *iop) + } + EXPORT_SYMBOL(irq_poll_complete); + +-static void __latent_entropy irq_poll_softirq(struct softirq_action *h) ++static void __latent_entropy irq_poll_softirq(void) + { + struct list_head *list = this_cpu_ptr(&blk_cpu_iopoll); + int rearm = 0, budget = irq_poll_budget; +diff --git a/lib/kobject.c b/lib/kobject.c +index d20a97a7e168..7afe7fcfa6c9 100644 +--- a/lib/kobject.c ++++ b/lib/kobject.c +@@ -954,9 +954,9 @@ EXPORT_SYMBOL_GPL(kset_create_and_add); + + + static DEFINE_SPINLOCK(kobj_ns_type_lock); +-static const struct kobj_ns_type_operations *kobj_ns_ops_tbl[KOBJ_NS_TYPES]; ++static const struct kobj_ns_type_operations *kobj_ns_ops_tbl[KOBJ_NS_TYPES] __ro_after_init; + +-int kobj_ns_type_register(const struct kobj_ns_type_operations *ops) ++int __init kobj_ns_type_register(const struct kobj_ns_type_operations *ops) + { + enum kobj_ns_type type = ops->type; + int error; +diff --git a/lib/nlattr.c b/lib/nlattr.c +index dfa55c873c13..c6b0436f473d 100644 +--- a/lib/nlattr.c ++++ b/lib/nlattr.c +@@ -364,6 +364,8 @@ int nla_memcpy(void *dest, const struct nlattr *src, int count) + { + int minlen = min_t(int, count, nla_len(src)); + ++ BUG_ON(minlen < 0); ++ + memcpy(dest, nla_data(src), minlen); + if (count > minlen) + memset(dest + minlen, 0, count - minlen); +diff --git a/lib/vsprintf.c b/lib/vsprintf.c +index 38b509cc6b46..6b3bf13d57d6 100644 +--- a/lib/vsprintf.c ++++ b/lib/vsprintf.c +@@ -1344,7 +1344,7 @@ char *uuid_string(char *buf, char *end, const u8 *addr, + return string(buf, end, uuid, spec); + } + +-int kptr_restrict __read_mostly; ++int kptr_restrict __read_mostly = 2; + + static noinline_for_stack + char *restricted_pointer(char *buf, char *end, const void *ptr, +diff --git a/mm/Kconfig b/mm/Kconfig +index e07608f64d47..18937911b87a 100644 +--- a/mm/Kconfig ++++ b/mm/Kconfig +@@ -319,7 +319,8 @@ config KSM + config DEFAULT_MMAP_MIN_ADDR + int "Low address space to protect from user allocation" + depends on MMU +- default 4096 ++ default 32768 if ARM || (ARM64 && COMPAT) ++ default 65536 + help + This is the portion of low virtual memory which should be protected + from userspace allocation. Keeping a user from writing to low pages +diff --git a/mm/mmap.c b/mm/mmap.c +index 03ca089cce0f..9bf52aa6b042 100644 +--- a/mm/mmap.c ++++ b/mm/mmap.c +@@ -220,6 +220,13 @@ SYSCALL_DEFINE1(brk, unsigned long, brk) + + newbrk = PAGE_ALIGN(brk); + oldbrk = PAGE_ALIGN(mm->brk); ++ /* properly handle unaligned min_brk as an empty heap */ ++ if (min_brk & ~PAGE_MASK) { ++ if (brk == min_brk) ++ newbrk -= PAGE_SIZE; ++ if (mm->brk == min_brk) ++ oldbrk -= PAGE_SIZE; ++ } + if (oldbrk == newbrk) + goto set_brk; + +diff --git a/mm/page_alloc.c b/mm/page_alloc.c +index 1741dd23e7c1..462ce9910e43 100644 +--- a/mm/page_alloc.c ++++ b/mm/page_alloc.c +@@ -68,6 +68,7 @@ + #include <linux/ftrace.h> + #include <linux/lockdep.h> + #include <linux/nmi.h> ++#include <linux/random.h> + + #include <asm/sections.h> + #include <asm/tlbflush.h> +@@ -101,6 +102,15 @@ int _node_numa_mem_[MAX_NUMNODES]; + DEFINE_MUTEX(pcpu_drain_mutex); + DEFINE_PER_CPU(struct work_struct, pcpu_drain); + ++bool __meminitdata extra_latent_entropy; ++ ++static int __init setup_extra_latent_entropy(char *str) ++{ ++ extra_latent_entropy = true; ++ return 0; ++} ++early_param("extra_latent_entropy", setup_extra_latent_entropy); ++ + #ifdef CONFIG_GCC_PLUGIN_LATENT_ENTROPY + volatile unsigned long latent_entropy __latent_entropy; + EXPORT_SYMBOL(latent_entropy); +@@ -1069,6 +1079,13 @@ static __always_inline bool free_pages_prepare(struct page *page, + debug_check_no_obj_freed(page_address(page), + PAGE_SIZE << order); + } ++ ++ if (IS_ENABLED(CONFIG_PAGE_SANITIZE)) { ++ int i; ++ for (i = 0; i < (1 << order); i++) ++ clear_highpage(page + i); ++ } ++ + arch_free_page(page, order); + kernel_poison_pages(page, 1 << order, 0); + kernel_map_pages(page, 1 << order, 0); +@@ -1286,6 +1303,21 @@ static void __init __free_pages_boot_core(struct page *page, unsigned int order) + __ClearPageReserved(p); + set_page_count(p, 0); + ++ if (extra_latent_entropy && !PageHighMem(page) && page_to_pfn(page) < 0x100000) { ++ unsigned long hash = 0; ++ size_t index, end = PAGE_SIZE * nr_pages / sizeof hash; ++ const unsigned long *data = lowmem_page_address(page); ++ ++ for (index = 0; index < end; index++) ++ hash ^= hash + data[index]; ++#ifdef CONFIG_GCC_PLUGIN_LATENT_ENTROPY ++ latent_entropy ^= hash; ++ add_device_randomness((const void *)&latent_entropy, sizeof(latent_entropy)); ++#else ++ add_device_randomness((const void *)&hash, sizeof(hash)); ++#endif ++ } ++ + page_zone(page)->managed_pages += nr_pages; + set_page_refcounted(page); + __free_pages(page, order); +@@ -1754,8 +1786,8 @@ static inline int check_new_page(struct page *page) + + static inline bool free_pages_prezeroed(void) + { +- return IS_ENABLED(CONFIG_PAGE_POISONING_ZERO) && +- page_poisoning_enabled(); ++ return IS_ENABLED(CONFIG_PAGE_SANITIZE) || ++ (IS_ENABLED(CONFIG_PAGE_POISONING_ZERO) && page_poisoning_enabled()); + } + + #ifdef CONFIG_DEBUG_VM +@@ -1812,6 +1844,11 @@ static void prep_new_page(struct page *page, unsigned int order, gfp_t gfp_flags + + post_alloc_hook(page, order, gfp_flags); + ++ if (IS_ENABLED(CONFIG_PAGE_SANITIZE_VERIFY)) { ++ for (i = 0; i < (1 << order); i++) ++ verify_zero_highpage(page + i); ++ } ++ + if (!free_pages_prezeroed() && (gfp_flags & __GFP_ZERO)) + for (i = 0; i < (1 << order); i++) + clear_highpage(page + i); +diff --git a/mm/slab.h b/mm/slab.h +index 51813236e773..e0d1b194a454 100644 +--- a/mm/slab.h ++++ b/mm/slab.h +@@ -312,7 +312,11 @@ static inline bool is_root_cache(struct kmem_cache *s) + static inline bool slab_equal_or_root(struct kmem_cache *s, + struct kmem_cache *p) + { ++#ifdef CONFIG_SLAB_HARDENED ++ return p == s; ++#else + return true; ++#endif + } + + static inline const char *cache_name(struct kmem_cache *s) +@@ -364,18 +368,26 @@ static inline struct kmem_cache *cache_from_obj(struct kmem_cache *s, void *x) + * to not do even the assignment. In that case, slab_equal_or_root + * will also be a constant. + */ +- if (!memcg_kmem_enabled() && ++ if (!IS_ENABLED(CONFIG_SLAB_HARDENED) && ++ !memcg_kmem_enabled() && + !unlikely(s->flags & SLAB_CONSISTENCY_CHECKS)) + return s; + + page = virt_to_head_page(x); ++#ifdef CONFIG_SLAB_HARDENED ++ BUG_ON(!PageSlab(page)); ++#endif + cachep = page->slab_cache; + if (slab_equal_or_root(cachep, s)) + return cachep; + + pr_err("%s: Wrong slab cache. %s but object is from %s\n", + __func__, s->name, cachep->name); ++#ifdef CONFIG_BUG_ON_DATA_CORRUPTION ++ BUG_ON(1); ++#else + WARN_ON_ONCE(1); ++#endif + return s; + } + +@@ -400,7 +412,7 @@ static inline size_t slab_ksize(const struct kmem_cache *s) + * back there or track user information then we can + * only use the space before that information. + */ +- if (s->flags & (SLAB_TYPESAFE_BY_RCU | SLAB_STORE_USER)) ++ if ((s->flags & (SLAB_TYPESAFE_BY_RCU | SLAB_STORE_USER)) || IS_ENABLED(CONFIG_SLAB_CANARY)) + return s->inuse; + /* + * Else we can use all the padding etc for the allocation +diff --git a/mm/slab_common.c b/mm/slab_common.c +index 10f127b2de7c..3637ef72c5b4 100644 +--- a/mm/slab_common.c ++++ b/mm/slab_common.c +@@ -26,10 +26,10 @@ + + #include "slab.h" + +-enum slab_state slab_state; ++enum slab_state slab_state __ro_after_init; + LIST_HEAD(slab_caches); + DEFINE_MUTEX(slab_mutex); +-struct kmem_cache *kmem_cache; ++struct kmem_cache *kmem_cache __ro_after_init; + + #ifdef CONFIG_HARDENED_USERCOPY + bool usercopy_fallback __ro_after_init = +@@ -57,7 +57,7 @@ static DECLARE_WORK(slab_caches_to_rcu_destroy_work, + /* + * Merge control. If this is set then no merging of slab caches will occur. + */ +-static bool slab_nomerge = !IS_ENABLED(CONFIG_SLAB_MERGE_DEFAULT); ++static bool slab_nomerge __ro_after_init = !IS_ENABLED(CONFIG_SLAB_MERGE_DEFAULT); + + static int __init setup_slab_nomerge(char *str) + { +@@ -968,7 +968,7 @@ EXPORT_SYMBOL(kmalloc_dma_caches); + * of two cache sizes there. The size of larger slabs can be determined using + * fls. + */ +-static s8 size_index[24] = { ++static s8 size_index[24] __ro_after_init = { + 3, /* 8 */ + 4, /* 16 */ + 5, /* 24 */ +diff --git a/mm/slub.c b/mm/slub.c +index e381728a3751..76dd844d978a 100644 +--- a/mm/slub.c ++++ b/mm/slub.c +@@ -125,6 +125,16 @@ static inline int kmem_cache_debug(struct kmem_cache *s) + #endif + } + ++static inline bool has_sanitize(struct kmem_cache *s) ++{ ++ return IS_ENABLED(CONFIG_SLAB_SANITIZE) && !(s->flags & (SLAB_TYPESAFE_BY_RCU | SLAB_POISON)); ++} ++ ++static inline bool has_sanitize_verify(struct kmem_cache *s) ++{ ++ return IS_ENABLED(CONFIG_SLAB_SANITIZE_VERIFY) && has_sanitize(s); ++} ++ + void *fixup_red_left(struct kmem_cache *s, void *p) + { + if (kmem_cache_debug(s) && s->flags & SLAB_RED_ZONE) +@@ -299,6 +309,35 @@ static inline void set_freepointer(struct kmem_cache *s, void *object, void *fp) + *(void **)freeptr_addr = freelist_ptr(s, fp, freeptr_addr); + } + ++#ifdef CONFIG_SLAB_CANARY ++static inline unsigned long *get_canary(struct kmem_cache *s, void *object) ++{ ++ if (s->offset) ++ return object + s->offset + sizeof(void *); ++ return object + s->inuse; ++} ++ ++static inline unsigned long get_canary_value(const void *canary, unsigned long value) ++{ ++ return (value ^ (unsigned long)canary) & CANARY_MASK; ++} ++ ++static inline void set_canary(struct kmem_cache *s, void *object, unsigned long value) ++{ ++ unsigned long *canary = get_canary(s, object); ++ *canary = get_canary_value(canary, value); ++} ++ ++static inline void check_canary(struct kmem_cache *s, void *object, unsigned long value) ++{ ++ unsigned long *canary = get_canary(s, object); ++ BUG_ON(*canary != get_canary_value(canary, value)); ++} ++#else ++#define set_canary(s, object, value) ++#define check_canary(s, object, value) ++#endif ++ + /* Loop over all objects in a slab */ + #define for_each_object(__p, __s, __addr, __objects) \ + for (__p = fixup_red_left(__s, __addr); \ +@@ -486,13 +525,13 @@ static inline void *restore_red_left(struct kmem_cache *s, void *p) + * Debug settings: + */ + #if defined(CONFIG_SLUB_DEBUG_ON) +-static slab_flags_t slub_debug = DEBUG_DEFAULT_FLAGS; ++static slab_flags_t slub_debug __ro_after_init = DEBUG_DEFAULT_FLAGS; + #else +-static slab_flags_t slub_debug; ++static slab_flags_t slub_debug __ro_after_init; + #endif + +-static char *slub_debug_slabs; +-static int disable_higher_order_debug; ++static char *slub_debug_slabs __ro_after_init; ++static int disable_higher_order_debug __ro_after_init; + + /* + * slub is about to manipulate internal object metadata. This memory lies +@@ -552,6 +591,9 @@ static struct track *get_track(struct kmem_cache *s, void *object, + else + p = object + s->inuse; + ++ if (IS_ENABLED(CONFIG_SLAB_CANARY)) ++ p = (void *)p + sizeof(void *); ++ + return p + alloc; + } + +@@ -690,6 +732,9 @@ static void print_trailer(struct kmem_cache *s, struct page *page, u8 *p) + else + off = s->inuse; + ++ if (IS_ENABLED(CONFIG_SLAB_CANARY)) ++ off += sizeof(void *); ++ + if (s->flags & SLAB_STORE_USER) + off += 2 * sizeof(struct track); + +@@ -819,6 +864,9 @@ static int check_pad_bytes(struct kmem_cache *s, struct page *page, u8 *p) + /* Freepointer is placed after the object. */ + off += sizeof(void *); + ++ if (IS_ENABLED(CONFIG_SLAB_CANARY)) ++ off += sizeof(void *); ++ + if (s->flags & SLAB_STORE_USER) + /* We also have user information there */ + off += 2 * sizeof(struct track); +@@ -1420,8 +1468,9 @@ static void setup_object(struct kmem_cache *s, struct page *page, + void *object) + { + setup_object_debug(s, page, object); ++ set_canary(s, object, s->random_inactive); + kasan_init_slab_obj(s, object); +- if (unlikely(s->ctor)) { ++ if (unlikely(s->ctor) && !has_sanitize_verify(s)) { + kasan_unpoison_object_data(s, object); + s->ctor(object); + kasan_poison_object_data(s, object); +@@ -2719,9 +2768,21 @@ static __always_inline void *slab_alloc_node(struct kmem_cache *s, + stat(s, ALLOC_FASTPATH); + } + +- if (unlikely(gfpflags & __GFP_ZERO) && object) ++ if (has_sanitize_verify(s) && object) { ++ size_t offset = s->offset ? 0 : sizeof(void *); ++ BUG_ON(memchr_inv(object + offset, 0, s->object_size - offset)); ++ if (s->ctor) ++ s->ctor(object); ++ if (unlikely(gfpflags & __GFP_ZERO) && offset) ++ memset(object, 0, sizeof(void *)); ++ } else if (unlikely(gfpflags & __GFP_ZERO) && object) + memset(object, 0, s->object_size); + ++ if (object) { ++ check_canary(s, object, s->random_inactive); ++ set_canary(s, object, s->random_active); ++ } ++ + slab_post_alloc_hook(s, gfpflags, 1, &object); + + return object; +@@ -2928,6 +2989,27 @@ static __always_inline void do_slab_free(struct kmem_cache *s, + void *tail_obj = tail ? : head; + struct kmem_cache_cpu *c; + unsigned long tid; ++ bool sanitize = has_sanitize(s); ++ ++ if (IS_ENABLED(CONFIG_SLAB_CANARY) || sanitize) { ++ __maybe_unused int offset = s->offset ? 0 : sizeof(void *); ++ void *x = head; ++ ++ while (1) { ++ check_canary(s, x, s->random_active); ++ set_canary(s, x, s->random_inactive); ++ ++ if (sanitize) { ++ memset(x + offset, 0, s->object_size - offset); ++ if (!IS_ENABLED(CONFIG_SLAB_SANITIZE_VERIFY) && s->ctor) ++ s->ctor(x); ++ } ++ if (x == tail_obj) ++ break; ++ x = get_freepointer(s, x); ++ } ++ } ++ + redo: + /* + * Determine the currently cpus per cpu slab. +@@ -3106,7 +3188,7 @@ int kmem_cache_alloc_bulk(struct kmem_cache *s, gfp_t flags, size_t size, + void **p) + { + struct kmem_cache_cpu *c; +- int i; ++ int i, k; + + /* memcg and kmem_cache debug support */ + s = slab_pre_alloc_hook(s, flags); +@@ -3143,13 +3225,29 @@ int kmem_cache_alloc_bulk(struct kmem_cache *s, gfp_t flags, size_t size, + local_irq_enable(); + + /* Clear memory outside IRQ disabled fastpath loop */ +- if (unlikely(flags & __GFP_ZERO)) { ++ if (has_sanitize_verify(s)) { ++ int j; ++ ++ for (j = 0; j < i; j++) { ++ size_t offset = s->offset ? 0 : sizeof(void *); ++ BUG_ON(memchr_inv(p[j] + offset, 0, s->object_size - offset)); ++ if (s->ctor) ++ s->ctor(p[j]); ++ if (unlikely(flags & __GFP_ZERO) && offset) ++ memset(p[j], 0, sizeof(void *)); ++ } ++ } else if (unlikely(flags & __GFP_ZERO)) { + int j; + + for (j = 0; j < i; j++) + memset(p[j], 0, s->object_size); + } + ++ for (k = 0; k < i; k++) { ++ check_canary(s, p[k], s->random_inactive); ++ set_canary(s, p[k], s->random_active); ++ } ++ + /* memcg and kmem_cache debug support */ + slab_post_alloc_hook(s, flags, size, p); + return i; +@@ -3181,9 +3279,9 @@ EXPORT_SYMBOL(kmem_cache_alloc_bulk); + * and increases the number of allocations possible without having to + * take the list_lock. + */ +-static int slub_min_order; +-static int slub_max_order = PAGE_ALLOC_COSTLY_ORDER; +-static int slub_min_objects; ++static int slub_min_order __ro_after_init; ++static int slub_max_order __ro_after_init = PAGE_ALLOC_COSTLY_ORDER; ++static int slub_min_objects __ro_after_init; + + /* + * Calculate the order of allocation given an slab object size. +@@ -3353,6 +3451,7 @@ static void early_kmem_cache_node_alloc(int node) + init_object(kmem_cache_node, n, SLUB_RED_ACTIVE); + init_tracking(kmem_cache_node, n); + #endif ++ set_canary(kmem_cache_node, n, kmem_cache_node->random_active); + kasan_kmalloc(kmem_cache_node, n, sizeof(struct kmem_cache_node), + GFP_KERNEL); + init_kmem_cache_node(n); +@@ -3509,6 +3608,9 @@ static int calculate_sizes(struct kmem_cache *s, int forced_order) + size += sizeof(void *); + } + ++ if (IS_ENABLED(CONFIG_SLAB_CANARY)) ++ size += sizeof(void *); ++ + #ifdef CONFIG_SLUB_DEBUG + if (flags & SLAB_STORE_USER) + /* +@@ -3579,6 +3681,10 @@ static int kmem_cache_open(struct kmem_cache *s, slab_flags_t flags) + #ifdef CONFIG_SLAB_FREELIST_HARDENED + s->random = get_random_long(); + #endif ++#ifdef CONFIG_SLAB_CANARY ++ s->random_active = get_random_long(); ++ s->random_inactive = get_random_long(); ++#endif + + if (need_reserve_slab_rcu && (s->flags & SLAB_TYPESAFE_BY_RCU)) + s->reserved = sizeof(struct rcu_head); +@@ -3846,6 +3952,8 @@ void __check_heap_object(const void *ptr, unsigned long n, struct page *page, + offset -= s->red_left_pad; + } + ++ check_canary(s, (void *)ptr - offset, s->random_active); ++ + /* Allow address range falling entirely within usercopy region. */ + if (offset >= s->useroffset && + offset - s->useroffset <= s->usersize && +@@ -3879,7 +3987,11 @@ static size_t __ksize(const void *object) + page = virt_to_head_page(object); + + if (unlikely(!PageSlab(page))) { ++#ifdef CONFIG_BUG_ON_DATA_CORRUPTION ++ BUG_ON(!PageCompound(page)); ++#else + WARN_ON(!PageCompound(page)); ++#endif + return PAGE_SIZE << compound_order(page); + } + +@@ -4744,7 +4856,7 @@ enum slab_stat_type { + #define SO_TOTAL (1 << SL_TOTAL) + + #ifdef CONFIG_MEMCG +-static bool memcg_sysfs_enabled = IS_ENABLED(CONFIG_SLUB_MEMCG_SYSFS_ON); ++static bool memcg_sysfs_enabled __ro_after_init = IS_ENABLED(CONFIG_SLUB_MEMCG_SYSFS_ON); + + static int __init setup_slub_memcg_sysfs(char *str) + { +diff --git a/mm/swap.c b/mm/swap.c +index 0f17330dd0e5..6e52cb476ef5 100644 +--- a/mm/swap.c ++++ b/mm/swap.c +@@ -92,6 +92,13 @@ static void __put_compound_page(struct page *page) + if (!PageHuge(page)) + __page_cache_release(page); + dtor = get_compound_page_dtor(page); ++ if (!PageHuge(page)) ++ BUG_ON(dtor != free_compound_page ++#ifdef CONFIG_TRANSPARENT_HUGEPAGE ++ && dtor != free_transhuge_page ++#endif ++ ); ++ + (*dtor)(page); + } + +diff --git a/net/core/dev.c b/net/core/dev.c +index ace13bea3e50..77a1519c52b7 100644 +--- a/net/core/dev.c ++++ b/net/core/dev.c +@@ -4196,7 +4196,7 @@ int netif_rx_ni(struct sk_buff *skb) + } + EXPORT_SYMBOL(netif_rx_ni); + +-static __latent_entropy void net_tx_action(struct softirq_action *h) ++static __latent_entropy void net_tx_action(void) + { + struct softnet_data *sd = this_cpu_ptr(&softnet_data); + +@@ -5745,7 +5745,7 @@ static int napi_poll(struct napi_struct *n, struct list_head *repoll) + return work; + } + +-static __latent_entropy void net_rx_action(struct softirq_action *h) ++static __latent_entropy void net_rx_action(void) + { + struct softnet_data *sd = this_cpu_ptr(&softnet_data); + unsigned long time_limit = jiffies + +diff --git a/net/ipv4/Kconfig b/net/ipv4/Kconfig +index f48fe6fc7e8c..d78c52835c08 100644 +--- a/net/ipv4/Kconfig ++++ b/net/ipv4/Kconfig +@@ -261,6 +261,7 @@ config IP_PIMSM_V2 + + config SYN_COOKIES + bool "IP: TCP syncookie support" ++ default y + ---help--- + Normal TCP/IP networking is open to an attack known as "SYN + flooding". This denial-of-service attack prevents legitimate remote +diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c +index 9917f928d0fd..784e0e2fc839 100644 +--- a/scripts/mod/modpost.c ++++ b/scripts/mod/modpost.c +@@ -37,6 +37,7 @@ static int vmlinux_section_warnings = 1; + static int warn_unresolved = 0; + /* How a symbol is exported */ + static int sec_mismatch_count = 0; ++static int writable_fptr_count = 0; + static int sec_mismatch_verbose = 1; + static int sec_mismatch_fatal = 0; + /* ignore missing files */ +@@ -965,6 +966,7 @@ enum mismatch { + ANY_EXIT_TO_ANY_INIT, + EXPORT_TO_INIT_EXIT, + EXTABLE_TO_NON_TEXT, ++ DATA_TO_TEXT + }; + + /** +@@ -1091,6 +1093,12 @@ static const struct sectioncheck sectioncheck[] = { + .good_tosec = {ALL_TEXT_SECTIONS , NULL}, + .mismatch = EXTABLE_TO_NON_TEXT, + .handler = extable_mismatch_handler, ++}, ++/* Do not reference code from writable data */ ++{ ++ .fromsec = { DATA_SECTIONS, NULL }, ++ .bad_tosec = { ALL_TEXT_SECTIONS, NULL }, ++ .mismatch = DATA_TO_TEXT + } + }; + +@@ -1240,10 +1248,10 @@ static Elf_Sym *find_elf_symbol(struct elf_info *elf, Elf64_Sword addr, + continue; + if (ELF_ST_TYPE(sym->st_info) == STT_SECTION) + continue; +- if (sym->st_value == addr) +- return sym; + /* Find a symbol nearby - addr are maybe negative */ + d = sym->st_value - addr; ++ if (d == 0) ++ return sym; + if (d < 0) + d = addr - sym->st_value; + if (d < distance) { +@@ -1402,7 +1410,11 @@ static void report_sec_mismatch(const char *modname, + char *prl_from; + char *prl_to; + +- sec_mismatch_count++; ++ if (mismatch->mismatch == DATA_TO_TEXT) ++ writable_fptr_count++; ++ else ++ sec_mismatch_count++; ++ + if (!sec_mismatch_verbose) + return; + +@@ -1526,6 +1538,14 @@ static void report_sec_mismatch(const char *modname, + fatal("There's a special handler for this mismatch type, " + "we should never get here."); + break; ++ case DATA_TO_TEXT: ++#if 0 ++ fprintf(stderr, ++ "The %s %s:%s references\n" ++ "the %s %s:%s%s\n", ++ from, fromsec, fromsym, to, tosec, tosym, to_p); ++#endif ++ break; + } + fprintf(stderr, "\n"); + } +@@ -2539,6 +2559,14 @@ int main(int argc, char **argv) + } + } + free(buf.p); ++ if (writable_fptr_count) { ++ if (!sec_mismatch_verbose) { ++ warn("modpost: Found %d writable function pointer(s).\n" ++ "To see full details build your kernel with:\n" ++ "'make CONFIG_DEBUG_SECTION_MISMATCH=y'\n", ++ writable_fptr_count); ++ } ++ } + + return err; + } +diff --git a/security/Kconfig b/security/Kconfig +index c4302067a3ad..1b1e9368cae5 100644 +--- a/security/Kconfig ++++ b/security/Kconfig +@@ -8,7 +8,7 @@ source security/keys/Kconfig + + config SECURITY_DMESG_RESTRICT + bool "Restrict unprivileged access to the kernel syslog" +- default n ++ default y + help + This enforces restrictions on unprivileged users reading the kernel + syslog via dmesg(8). +@@ -18,10 +18,21 @@ config SECURITY_DMESG_RESTRICT + + If you are unsure how to answer this question, answer N. + ++config SECURITY_PERF_EVENTS_RESTRICT ++ bool "Restrict unprivileged use of performance events" ++ depends on PERF_EVENTS ++ default y ++ help ++ If you say Y here, the kernel.perf_event_paranoid sysctl ++ will be set to 3 by default, and no unprivileged use of the ++ perf_event_open syscall will be permitted unless it is ++ changed. ++ + config SECURITY + bool "Enable different security models" + depends on SYSFS + depends on MULTIUSER ++ default y + help + This allows you to choose different security modules to be + configured into your kernel. +@@ -48,6 +59,7 @@ config SECURITYFS + config SECURITY_NETWORK + bool "Socket and Networking Security Hooks" + depends on SECURITY ++ default y + help + This enables the socket and networking security hooks. + If enabled, a security module can use these hooks to +@@ -155,6 +167,7 @@ config HARDENED_USERCOPY + depends on HAVE_HARDENED_USERCOPY_ALLOCATOR + select BUG + imply STRICT_DEVMEM ++ default y + help + This option checks for obviously wrong memory regions when + copying memory to/from the kernel (via copy_to_user() and +@@ -167,7 +180,6 @@ config HARDENED_USERCOPY + config HARDENED_USERCOPY_FALLBACK + bool "Allow usercopy whitelist violations to fallback to object size" + depends on HARDENED_USERCOPY +- default y + help + This is a temporary option that allows missing usercopy whitelists + to be discovered via a WARN() to the kernel log, instead of +@@ -192,10 +204,36 @@ config HARDENED_USERCOPY_PAGESPAN + config FORTIFY_SOURCE + bool "Harden common str/mem functions against buffer overflows" + depends on ARCH_HAS_FORTIFY_SOURCE ++ default y + help + Detect overflows of buffers in common string and memory functions + where the compiler can determine and validate the buffer sizes. + ++config FORTIFY_SOURCE_STRICT_STRING ++ bool "Harden common functions against buffer overflows" ++ depends on FORTIFY_SOURCE ++ depends on EXPERT ++ help ++ Perform stricter overflow checks catching overflows within objects ++ for common C string functions rather than only between objects. ++ ++ This is not yet intended for production use, only bug finding. ++ ++config PAGE_SANITIZE ++ bool "Sanitize pages" ++ default y ++ help ++ Zero fill page allocations on free, reducing the lifetime of ++ sensitive data and helping to mitigate use-after-free bugs. ++ ++config PAGE_SANITIZE_VERIFY ++ bool "Verify sanitized pages" ++ depends on PAGE_SANITIZE ++ default y ++ help ++ Verify that newly allocated pages are zeroed to detect ++ write-after-free bugs. ++ + config STATIC_USERMODEHELPER + bool "Force all usermode helper calls through a single binary" + help +diff --git a/security/selinux/Kconfig b/security/selinux/Kconfig +index 8af7a690eb40..6539694b0fd3 100644 +--- a/security/selinux/Kconfig ++++ b/security/selinux/Kconfig +@@ -2,7 +2,7 @@ config SECURITY_SELINUX + bool "NSA SELinux Support" + depends on SECURITY_NETWORK && AUDIT && NET && INET + select NETWORK_SECMARK +- default n ++ default y + help + This selects NSA Security-Enhanced Linux (SELinux). + You will also need a policy configuration and a labeled filesystem. +@@ -79,23 +79,3 @@ config SECURITY_SELINUX_AVC_STATS + This option collects access vector cache statistics to + /selinux/avc/cache_stats, which may be monitored via + tools such as avcstat. +- +-config SECURITY_SELINUX_CHECKREQPROT_VALUE +- int "NSA SELinux checkreqprot default value" +- depends on SECURITY_SELINUX +- range 0 1 +- default 0 +- help +- This option sets the default value for the 'checkreqprot' flag +- that determines whether SELinux checks the protection requested +- by the application or the protection that will be applied by the +- kernel (including any implied execute for read-implies-exec) for +- mmap and mprotect calls. If this option is set to 0 (zero), +- SELinux will default to checking the protection that will be applied +- by the kernel. If this option is set to 1 (one), SELinux will +- default to checking the protection requested by the application. +- The checkreqprot flag may be changed from the default via the +- 'checkreqprot=' boot parameter. It may also be changed at runtime +- via /selinux/checkreqprot if authorized by policy. +- +- If you are unsure how to answer this question, answer 0. +diff --git a/security/selinux/include/objsec.h b/security/selinux/include/objsec.h +index 3d54468ce334..ceafb908afde 100644 +--- a/security/selinux/include/objsec.h ++++ b/security/selinux/include/objsec.h +@@ -154,6 +154,6 @@ struct bpf_security_struct { + u32 sid; /*SID of bpf obj creater*/ + }; + +-extern unsigned int selinux_checkreqprot; ++extern const unsigned int selinux_checkreqprot; + + #endif /* _SELINUX_OBJSEC_H_ */ +diff --git a/security/selinux/selinuxfs.c b/security/selinux/selinuxfs.c +index 00eed842c491..8f7b8d7e6f91 100644 +--- a/security/selinux/selinuxfs.c ++++ b/security/selinux/selinuxfs.c +@@ -41,16 +41,7 @@ + #include "objsec.h" + #include "conditional.h" + +-unsigned int selinux_checkreqprot = CONFIG_SECURITY_SELINUX_CHECKREQPROT_VALUE; +- +-static int __init checkreqprot_setup(char *str) +-{ +- unsigned long checkreqprot; +- if (!kstrtoul(str, 0, &checkreqprot)) +- selinux_checkreqprot = checkreqprot ? 1 : 0; +- return 1; +-} +-__setup("checkreqprot=", checkreqprot_setup); ++const unsigned int selinux_checkreqprot; + + static DEFINE_MUTEX(sel_mutex); + +@@ -610,10 +601,9 @@ static ssize_t sel_write_checkreqprot(struct file *file, const char __user *buf, + return PTR_ERR(page); + + length = -EINVAL; +- if (sscanf(page, "%u", &new_value) != 1) ++ if (sscanf(page, "%u", &new_value) != 1 || new_value) + goto out; + +- selinux_checkreqprot = new_value ? 1 : 0; + length = count; + out: + kfree(page); +diff --git a/security/yama/Kconfig b/security/yama/Kconfig +index 96b27405558a..485c1b85c325 100644 +--- a/security/yama/Kconfig ++++ b/security/yama/Kconfig +@@ -1,7 +1,7 @@ + config SECURITY_YAMA + bool "Yama support" + depends on SECURITY +- default n ++ default y + help + This selects Yama, which extends DAC support with additional + system-wide security settings beyond regular Linux discretionary diff --git a/pkgs/os-specific/linux/kernel/generic.nix b/pkgs/os-specific/linux/kernel/generic.nix index 2b44ff51ad0a..249a1ea5cefa 100644 --- a/pkgs/os-specific/linux/kernel/generic.nix +++ b/pkgs/os-specific/linux/kernel/generic.nix @@ -12,6 +12,9 @@ , # The kernel version. version +, # Allows overriding the default defconfig + defconfig ? null + , # Overrides to the kernel config. extraConfig ? "" @@ -85,7 +88,7 @@ let platformName = hostPlatform.platform.name; # e.g. "defconfig" - kernelBaseConfig = hostPlatform.platform.kernelBaseConfig; + kernelBaseConfig = if defconfig != null then defconfig else hostPlatform.platform.kernelBaseConfig; # e.g. "bzImage" kernelTarget = hostPlatform.platform.kernelTarget; diff --git a/pkgs/os-specific/linux/kernel/hardened-config.nix b/pkgs/os-specific/linux/kernel/hardened-config.nix index 3a82c00c5010..a00ba9ab7b8e 100644 --- a/pkgs/os-specific/linux/kernel/hardened-config.nix +++ b/pkgs/os-specific/linux/kernel/hardened-config.nix @@ -78,6 +78,9 @@ ${optionalString (versionAtLeast version "4.13") '' # Perform usercopy bounds checking. HARDENED_USERCOPY y +${optionalString (versionAtLeast version "4.16") '' + HARDENED_USERCOPY_FALLBACK n +''} # Randomize allocator freelists. SLAB_FREELIST_RANDOM y diff --git a/pkgs/os-specific/linux/kernel/linux-4.14.nix b/pkgs/os-specific/linux/kernel/linux-4.14.nix index d9aef3a21930..cf6b254ee858 100644 --- a/pkgs/os-specific/linux/kernel/linux-4.14.nix +++ b/pkgs/os-specific/linux/kernel/linux-4.14.nix @@ -1,15 +1,18 @@ -{ stdenv, buildPackages, hostPlatform, fetchurl, perl, buildLinux, ... } @ args: +{ stdenv, buildPackages, hostPlatform, fetchurl, perl, buildLinux, modDirVersionArg ? null, ... } @ args: with stdenv.lib; buildLinux (args // rec { - version = "4.14.37"; + version = "4.14.52"; + + # modDirVersion needs to be x.y.z, will automatically add .0 if needed + modDirVersion = if (modDirVersionArg == null) then concatStrings (intersperse "." (take 3 (splitString "." "${version}.0"))) else modDirVersionArg; # branchVersion needs to be x.y extraMeta.branch = concatStrings (intersperse "." (take 2 (splitString "." version))); src = fetchurl { url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz"; - sha256 = "14lfj2vfxw36k8cbmzs280w4h81yz5xhlhq5550kww906vnyg5w1"; + sha256 = "0448z0sdwazk2xrwq1zrinv881qhl33f5r2n3pqb07pxnb3jdlm5"; }; } // (args.argsOverride or {})) diff --git a/pkgs/os-specific/linux/kernel/linux-4.16.nix b/pkgs/os-specific/linux/kernel/linux-4.16.nix index 3da2cda30e22..46d58c5a14dc 100644 --- a/pkgs/os-specific/linux/kernel/linux-4.16.nix +++ b/pkgs/os-specific/linux/kernel/linux-4.16.nix @@ -1,18 +1,18 @@ -{ stdenv, buildPackages, hostPlatform, fetchurl, perl, buildLinux, ... } @ args: +{ stdenv, buildPackages, hostPlatform, fetchurl, perl, buildLinux, modDirVersionArg ? null, ... } @ args: with stdenv.lib; buildLinux (args // rec { - version = "4.16.5"; + version = "4.16.18"; # modDirVersion needs to be x.y.z, will automatically add .0 if needed - modDirVersion = concatStrings (intersperse "." (take 3 (splitString "." "${version}.0"))); + modDirVersion = if (modDirVersionArg == null) then concatStrings (intersperse "." (take 3 (splitString "." "${version}.0"))) else modDirVersionArg; # branchVersion needs to be x.y extraMeta.branch = concatStrings (intersperse "." (take 2 (splitString "." version))); src = fetchurl { url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz"; - sha256 = "0f1a8ggjb2jxc8n3hvypc81xbwylwkqi0mnynd9q316ay152zb1r"; + sha256 = "089hx2hdd5r558mv8n0c7jciv2nj9v77df0lsplsbxx47dqns0j1"; }; } // (args.argsOverride or {})) diff --git a/pkgs/os-specific/linux/kernel/linux-4.17.nix b/pkgs/os-specific/linux/kernel/linux-4.17.nix new file mode 100644 index 000000000000..166a8572cf7a --- /dev/null +++ b/pkgs/os-specific/linux/kernel/linux-4.17.nix @@ -0,0 +1,18 @@ +{ stdenv, buildPackages, hostPlatform, fetchurl, perl, buildLinux, modDirVersionArg ? null, ... } @ args: + +with stdenv.lib; + +buildLinux (args // rec { + version = "4.17.3"; + + # modDirVersion needs to be x.y.z, will automatically add .0 if needed + modDirVersion = if (modDirVersionArg == null) then concatStrings (intersperse "." (take 3 (splitString "." "${version}.0"))) else modDirVersionArg; + + # branchVersion needs to be x.y + extraMeta.branch = concatStrings (intersperse "." (take 2 (splitString "." version))); + + src = fetchurl { + url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz"; + sha256 = "1z8zja786x5dxwm69zgfkwsvfwjfznwbclf76301c2fd4wjancmg"; + }; +} // (args.argsOverride or {})) diff --git a/pkgs/os-specific/linux/kernel/linux-4.4.nix b/pkgs/os-specific/linux/kernel/linux-4.4.nix index fe8633ed0da7..307276d04e70 100644 --- a/pkgs/os-specific/linux/kernel/linux-4.4.nix +++ b/pkgs/os-specific/linux/kernel/linux-4.4.nix @@ -1,11 +1,11 @@ { stdenv, buildPackages, hostPlatform, fetchurl, perl, buildLinux, ... } @ args: buildLinux (args // rec { - version = "4.4.129"; + version = "4.4.138"; extraMeta.branch = "4.4"; src = fetchurl { url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz"; - sha256 = "0aviyky8f73l6jpi1d4by947rj78d5vckxkyf9aj73bavaxc8rd1"; + sha256 = "1vn45hvwk49cfm283yg4j76k7dnn351rg5zy28z3bfp02x7cdyg6"; }; } // (args.argsOverride or {})) diff --git a/pkgs/os-specific/linux/kernel/linux-4.9.nix b/pkgs/os-specific/linux/kernel/linux-4.9.nix index 63fe3db3b577..287d8c9cf37d 100644 --- a/pkgs/os-specific/linux/kernel/linux-4.9.nix +++ b/pkgs/os-specific/linux/kernel/linux-4.9.nix @@ -1,11 +1,11 @@ { stdenv, buildPackages, hostPlatform, fetchurl, perl, buildLinux, ... } @ args: buildLinux (args // rec { - version = "4.9.96"; + version = "4.9.110"; extraMeta.branch = "4.9"; src = fetchurl { url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz"; - sha256 = "0zw7x86c8qa2kzkwlxlhqzsnddyp1ncw4ja660bqnzqrnmp5jvw2"; + sha256 = "0ypaqj9vs2jc4qiss5yyplx09rk55fa3hrlzdkm0x7x7f0x196ip"; }; } // (args.argsOverride or {})) diff --git a/pkgs/os-specific/linux/kernel/linux-copperhead-lts.nix b/pkgs/os-specific/linux/kernel/linux-copperhead-lts.nix index 76b59ee75fb1..85ad00efcd67 100644 --- a/pkgs/os-specific/linux/kernel/linux-copperhead-lts.nix +++ b/pkgs/os-specific/linux/kernel/linux-copperhead-lts.nix @@ -3,9 +3,9 @@ with stdenv.lib; let - version = "4.14.37"; + version = "4.14.44"; revision = "a"; - sha256 = "0dwi17hx13kkccqc2315dnb8sfdc0jgv9v4b1xd10v2pnq7qb0x8"; + sha256 = "1alvhpwy9xzppwsag7qh1lkk3l4piyh2fv27w37il6gclja4dxkf"; # modVersion needs to be x.y.z, will automatically add .0 if needed modVersion = concatStrings (intersperse "." (take 3 (splitString "." "${version}.0"))); diff --git a/pkgs/os-specific/linux/kernel/linux-copperhead-stable.nix b/pkgs/os-specific/linux/kernel/linux-copperhead-stable.nix deleted file mode 100644 index 86b7eaa8823e..000000000000 --- a/pkgs/os-specific/linux/kernel/linux-copperhead-stable.nix +++ /dev/null @@ -1,30 +0,0 @@ -{ stdenv, buildPackages, hostPlatform, fetchFromGitHub, perl, buildLinux, ... } @ args: - -with stdenv.lib; - -let - version = "4.16.5"; - revision = "a"; - sha256 = "150cwq51x3cnnvnd7izizi93jmiqs0na15p8ip4vkm5frspmnks7"; - - # modVersion needs to be x.y.z, will automatically add .0 if needed - modVersion = concatStrings (intersperse "." (take 3 (splitString "." "${version}.0"))); - - # branchVersion needs to be x.y - branchVersion = concatStrings (intersperse "." (take 2 (splitString "." version))); - - modDirVersion = "${modVersion}-hardened"; -in -buildLinux (args // { - inherit modDirVersion; - - version = "${version}-${revision}"; - extraMeta.branch = "${branchVersion}"; - - src = fetchFromGitHub { - inherit sha256; - owner = "copperhead"; - repo = "linux-hardened"; - rev = "${version}.${revision}"; - }; -} // (args.argsOverride or {})) diff --git a/pkgs/os-specific/linux/kernel/linux-hardkernel-4.14.nix b/pkgs/os-specific/linux/kernel/linux-hardkernel-4.14.nix new file mode 100644 index 000000000000..6855c5c5f903 --- /dev/null +++ b/pkgs/os-specific/linux/kernel/linux-hardkernel-4.14.nix @@ -0,0 +1,19 @@ +{ stdenv, buildPackages, hostPlatform, fetchFromGitHub, perl, buildLinux, libelf, utillinux, ... } @ args: + +buildLinux (args // rec { + version = "4.14.47-139"; + + # modDirVersion needs to be x.y.z. + modDirVersion = "4.14.47"; + + # branchVersion needs to be x.y. + extraMeta.branch = "4.14"; + + src = fetchFromGitHub { + owner = "hardkernel"; + repo = "linux"; + rev = version; + sha256 = "0jjgrmvi1h8zs8snnvghnjd422yfmn7jv9y1n7xikmfv4nvwqrkv"; + }; + +} // (args.argsOverride or {})) diff --git a/pkgs/os-specific/linux/kernel/linux-mptcp.nix b/pkgs/os-specific/linux/kernel/linux-mptcp.nix index 0ff0e747bfdc..a439fd0a6ec5 100644 --- a/pkgs/os-specific/linux/kernel/linux-mptcp.nix +++ b/pkgs/os-specific/linux/kernel/linux-mptcp.nix @@ -33,8 +33,7 @@ buildLinux (rec { DEFAULT_MPTCP_PM default # MPTCP scheduler selection. - # Disabled as the only non-default is the useless round-robin. - MPTCP_SCHED_ADVANCED n + MPTCP_SCHED_ADVANCED y DEFAULT_MPTCP_SCHED default # Smarter TCP congestion controllers diff --git a/pkgs/os-specific/linux/kernel/linux-rpi.nix b/pkgs/os-specific/linux/kernel/linux-rpi.nix index a96a910c68c9..d869ea090360 100644 --- a/pkgs/os-specific/linux/kernel/linux-rpi.nix +++ b/pkgs/os-specific/linux/kernel/linux-rpi.nix @@ -1,8 +1,8 @@ { stdenv, buildPackages, hostPlatform, fetchFromGitHub, perl, buildLinux, ... } @ args: let - modDirVersion = "4.9.59"; - tag = "1.20171029"; + modDirVersion = "4.14.34"; + tag = "1.20180417"; in stdenv.lib.overrideDerivation (buildLinux (args // rec { version = "${modDirVersion}-${tag}"; @@ -12,9 +12,14 @@ stdenv.lib.overrideDerivation (buildLinux (args // rec { owner = "raspberrypi"; repo = "linux"; rev = "raspberrypi-kernel_${tag}-1"; - sha256 = "19lb1gxz21x1d5zdznzqfq60kxg7iqmyl6l0mb9qg2vrl8fcgnxk"; + sha256 = "1xgisvmcq50lpnd4rpqhaw52399n0rx2n8mp6k0bf8qm1g3vnza2"; }; + defconfig = { + "armv6l-linux" = "bcmrpi_defconfig"; + "armv7l-linux" = "bcm2709_defconfig"; + }.${stdenv.system} or (throw "linux_rpi not supported on '${stdenv.system}'"); + features = { efiBootStub = false; } // (args.features or {}); @@ -27,16 +32,15 @@ stdenv.lib.overrideDerivation (buildLinux (args // rec { ''; postFixup = '' - # Make copies of the DTBs so that U-Boot finds them, as it is looking for the upstream names. - # This is ugly as heck. + # Make copies of the DTBs named after the upstream names so that U-Boot finds them. + # This is ugly as heck, but I don't know a better solution so far. + rm $out/dtbs/bcm283*.dtb copyDTB() { - if [ -f "$out/dtbs/$1" ]; then - cp -v "$out/dtbs/$1" "$out/dtbs/$2" - fi + cp -v "$out/dtbs/$1" "$out/dtbs/$2" } - # I am not sure if all of these are correct... - copyDTB bcm2708-rpi-0-w.dts bcm2835-rpi-zero.dtb + copyDTB bcm2708-rpi-0-w.dtb bcm2835-rpi-zero.dtb + copyDTB bcm2708-rpi-0-w.dtb bcm2835-rpi-zero-w.dtb copyDTB bcm2708-rpi-b.dtb bcm2835-rpi-a.dtb copyDTB bcm2708-rpi-b.dtb bcm2835-rpi-b.dtb copyDTB bcm2708-rpi-b.dtb bcm2835-rpi-b-rev2.dtb @@ -46,6 +50,7 @@ stdenv.lib.overrideDerivation (buildLinux (args // rec { copyDTB bcm2708-rpi-cm.dtb bcm2835-rpi-cm.dtb copyDTB bcm2709-rpi-2-b.dtb bcm2836-rpi-2-b.dtb copyDTB bcm2710-rpi-3-b.dtb bcm2837-rpi-3-b.dtb - # bcm2710-rpi-cm3.dts is yet unknown. + copyDTB bcm2710-rpi-3-b-plus.dtb bcm2837-rpi-3-b-plus.dtb + copyDTB bcm2710-rpi-cm3.dtb bcm2837-rpi-cm3.dtb ''; }) diff --git a/pkgs/os-specific/linux/kernel/linux-testing.nix b/pkgs/os-specific/linux/kernel/linux-testing.nix index 6370f82235a7..5e8059bb4655 100644 --- a/pkgs/os-specific/linux/kernel/linux-testing.nix +++ b/pkgs/os-specific/linux/kernel/linux-testing.nix @@ -1,13 +1,13 @@ { stdenv, buildPackages, hostPlatform, fetchurl, perl, buildLinux, libelf, utillinux, ... } @ args: buildLinux (args // rec { - version = "4.17-rc2"; - modDirVersion = "4.17.0-rc2"; - extraMeta.branch = "4.17"; + version = "4.18-rc2"; + modDirVersion = "4.18.0-rc2"; + extraMeta.branch = "4.18"; src = fetchurl { url = "https://git.kernel.org/torvalds/t/linux-${version}.tar.gz"; - sha256 = "1z4kl25x8m498wicbzhx21kvksp63ab8l2s0nfxf7fwj7dd13cld"; + sha256 = "04vflzj14wvvkj3lsbabsw0239y58cdd8g5kciqz1ydhdlgifpza"; }; # Should the testing kernels ever be built on Hydra? diff --git a/pkgs/os-specific/linux/kernel/mips-ext3-n32.patch b/pkgs/os-specific/linux/kernel/mips-ext3-n32.patch deleted file mode 100644 index fcb6f9177c7d..000000000000 --- a/pkgs/os-specific/linux/kernel/mips-ext3-n32.patch +++ /dev/null @@ -1,17 +0,0 @@ -Dirty patch that makes ext3 work again on 3.5 and 3.6 kernels, -on mips n32. - -http://www.linux-mips.org/archives/linux-mips/2012-11/msg00030.html - -diff --git a/fs/ext3/dir.c b/fs/ext3/dir.c -index 92490e9..bf63d7b 100644 ---- a/fs/ext3/dir.c -+++ b/fs/ext3/dir.c -@@ -228,6 +228,7 @@ out: - - static inline int is_32bit_api(void) - { -+ return 1; - #ifdef CONFIG_COMPAT - return is_compat_task(); - #else diff --git a/pkgs/os-specific/linux/kernel/mips-fpu-sigill.patch b/pkgs/os-specific/linux/kernel/mips-fpu-sigill.patch deleted file mode 100644 index 248aba2b2c20..000000000000 --- a/pkgs/os-specific/linux/kernel/mips-fpu-sigill.patch +++ /dev/null @@ -1,507 +0,0 @@ -From bf55ef4e3c2f622ac013f196affbd11b67b59223 Mon Sep 17 00:00:00 2001 -From: Mark H Weaver <mhw@netris.org> -Date: Fri, 28 Oct 2011 13:24:37 -0400 -Subject: [PATCH 2/4] Fix handling of prefx instruction in mips/math-emu - -* The instruction is named prefx, not pfetch, and its function - field is 0x17, not 0x07. - -* Recognize the prefx instruction regardless of what bits happen to be - in bits 21-25, which is the format field of the floating-point ops, - but holds the base register of the prefx instruction. ---- - arch/mips/include/asm/inst.h | 4 ++-- - arch/mips/math-emu/cp1emu.c | 16 +++++++--------- - 2 files changed, 9 insertions(+), 11 deletions(-) - -diff --git a/arch/mips/include/asm/inst.h b/arch/mips/include/asm/inst.h -index ab84064..3048edc 100644 ---- a/arch/mips/include/asm/inst.h -+++ b/arch/mips/include/asm/inst.h -@@ -161,8 +161,8 @@ enum cop1_sdw_func { - */ - enum cop1x_func { - lwxc1_op = 0x00, ldxc1_op = 0x01, -- pfetch_op = 0x07, swxc1_op = 0x08, -- sdxc1_op = 0x09, madd_s_op = 0x20, -+ swxc1_op = 0x08, sdxc1_op = 0x09, -+ prefx_op = 0x17, madd_s_op = 0x20, - madd_d_op = 0x21, madd_e_op = 0x22, - msub_s_op = 0x28, msub_d_op = 0x29, - msub_e_op = 0x2a, nmadd_s_op = 0x30, -diff --git a/arch/mips/math-emu/cp1emu.c b/arch/mips/math-emu/cp1emu.c -index dbf2f93..87ddba1 100644 ---- a/arch/mips/math-emu/cp1emu.c -+++ b/arch/mips/math-emu/cp1emu.c -@@ -739,7 +739,7 @@ static int fpux_emu(struct pt_regs *xcp, struct mips_fpu_struct *ctx, - break; - - default: -- return SIGILL; -+ goto SIGILL_unless_prefx_op; - } - break; - } -@@ -809,19 +809,17 @@ static int fpux_emu(struct pt_regs *xcp, struct mips_fpu_struct *ctx, - goto copcsr; - - default: -- return SIGILL; -+ goto SIGILL_unless_prefx_op; - } - break; - } - -- case 0x7: /* 7 */ -- if (MIPSInst_FUNC(ir) != pfetch_op) { -- return SIGILL; -- } -- /* ignore prefx operation */ -- break; -- - default: -+ SIGILL_unless_prefx_op: -+ if (MIPSInst_FUNC(ir) == prefx_op) { -+ /* ignore prefx operation */ -+ break; -+ } - return SIGILL; - } - --- -1.7.5.4 - -From 97a564e3eddbfb84844b8eccb3bd751c71dfb3eb Mon Sep 17 00:00:00 2001 -From: Mark H Weaver <mhw@netris.org> -Date: Fri, 28 Oct 2011 13:35:27 -0400 -Subject: [PATCH 3/4] Don't process empty cause flags after simple fp move on - mips - ---- - arch/mips/math-emu/cp1emu.c | 4 ++-- - 1 files changed, 2 insertions(+), 2 deletions(-) - -diff --git a/arch/mips/math-emu/cp1emu.c b/arch/mips/math-emu/cp1emu.c -index 87ddba1..fefcba2 100644 ---- a/arch/mips/math-emu/cp1emu.c -+++ b/arch/mips/math-emu/cp1emu.c -@@ -912,7 +912,7 @@ static int fpu_emu(struct pt_regs *xcp, struct mips_fpu_struct *ctx, - case fmov_op: - /* an easy one */ - SPFROMREG(rv.s, MIPSInst_FS(ir)); -- goto copcsr; -+ break; - - /* binary op on handler */ - scopbop: -@@ -1099,7 +1099,7 @@ static int fpu_emu(struct pt_regs *xcp, struct mips_fpu_struct *ctx, - case fmov_op: - /* an easy one */ - DPFROMREG(rv.d, MIPSInst_FS(ir)); -- goto copcsr; -+ break; - - /* binary op on handler */ - dcopbop:{ --- -1.7.5.4 - -From 4051727b3007ef3675e7258ed86fa8517f86d929 Mon Sep 17 00:00:00 2001 -From: Mark H Weaver <mhw@netris.org> -Date: Fri, 28 Oct 2011 13:39:10 -0400 -Subject: [PATCH 4/4] Support Loongson2f floating-point instructions in - mips/math-emu - -* (arch/mips/include/asm/inst.h): Add Loongson2f function field values - for madd/msub/nmadd/nmsub that use the spec2 opcode, and the - Loongson2f/MIPS-5 format field value for paired-single - floating-point operations. - -* (arch/mips/math-emu/cp1emu.c): Add support for the Loongson2f - instructions for madd/msub/nmadd/nmsub, which use the spec2 opcode. - Also add support for the Loongson2f instructions that use the - paired-single floating-point format. ---- - arch/mips/include/asm/inst.h | 4 +- - arch/mips/math-emu/cp1emu.c | 287 +++++++++++++++++++++++++++++++++++++++++- - 2 files changed, 289 insertions(+), 2 deletions(-) - -diff --git a/arch/mips/include/asm/inst.h b/arch/mips/include/asm/inst.h -index 3048edc..0e8ba7c 100644 ---- a/arch/mips/include/asm/inst.h -+++ b/arch/mips/include/asm/inst.h -@@ -61,6 +61,8 @@ enum spec_op { - enum spec2_op { - madd_op, maddu_op, mul_op, spec2_3_unused_op, - msub_op, msubu_op, /* more unused ops */ -+ loongson_madd_op = 0x18, loongson_msub_op, -+ loongson_nmadd_op, loongson_nmsub_op, - clz_op = 0x20, clo_op, - dclz_op = 0x24, dclo_op, - sdbpp_op = 0x3f -@@ -133,7 +135,7 @@ enum cop0_com_func { - */ - enum cop1_fmt { - s_fmt, d_fmt, e_fmt, q_fmt, -- w_fmt, l_fmt -+ w_fmt, l_fmt, ps_fmt - }; - - /* -diff --git a/arch/mips/math-emu/cp1emu.c b/arch/mips/math-emu/cp1emu.c -index fefcba2..166b2a4 100644 ---- a/arch/mips/math-emu/cp1emu.c -+++ b/arch/mips/math-emu/cp1emu.c -@@ -7,6 +7,9 @@ - * Kevin D. Kissell, kevink@mips.com and Carsten Langgaard, carstenl@mips.com - * Copyright (C) 2000 MIPS Technologies, Inc. - * -+ * Loongson instruction support -+ * Copyright (C) 2011 Mark H Weaver <mhw@netris.org> -+ * - * This program is free software; you can distribute it and/or modify it - * under the terms of the GNU General Public License (Version 2) as - * published by the Free Software Foundation. -@@ -57,6 +60,14 @@ - #endif - #define __mips 4 - -+#ifdef __loongson_fp -+#undef __loongson_fp -+#endif -+#if __mips >= 4 && __mips != 32 -+/* Include support for Loongson floating point instructions */ -+#define __loongson_fp 1 -+#endif -+ - /* Function which emulates a floating point instruction. */ - - static int fpu_emu(struct pt_regs *, struct mips_fpu_struct *, -@@ -66,6 +77,10 @@ static int fpu_emu(struct pt_regs *, struct mips_fpu_struct *, - static int fpux_emu(struct pt_regs *, - struct mips_fpu_struct *, mips_instruction, void *__user *); - #endif -+#ifdef __loongson_fp -+static int loongson_spec2_emu(struct pt_regs *, -+ struct mips_fpu_struct *, mips_instruction, void *__user *); -+#endif - - /* Further private data for which no space exists in mips_fpu_struct */ - -@@ -203,6 +218,14 @@ static inline int cop1_64bit(struct pt_regs *xcp) - #define DPFROMREG(dp, x) DIFROMREG((dp).bits, x) - #define DPTOREG(dp, x) DITOREG((dp).bits, x) - -+/* Support for Loongson paired single floating-point format */ -+#define PSIFROMREG(si1, si2, x) ({ u64 di; DIFROMREG(di, x); \ -+ (si1) = (u32)di; (si2) = (u32)(di >> 32); }) -+#define PSITOREG(si1, si2, x) DITOREG((si1) | ((u64)(si2) << 32), x) -+ -+#define PSPFROMREG(sp1, sp2, x) PSIFROMREG((sp1).bits, (sp2).bits, x) -+#define PSPTOREG(sp1, sp2, x) PSITOREG((sp1).bits, (sp2).bits, x) -+ - /* - * Emulate the single floating point instruction pointed at by EPC. - * Two instructions if the instruction is in a branch delay slot. -@@ -568,6 +591,15 @@ static int cop1Emulate(struct pt_regs *xcp, struct mips_fpu_struct *ctx, - break; - #endif - -+#ifdef __loongson_fp -+ case spec2_op:{ -+ int sig = loongson_spec2_emu(xcp, ctx, ir, fault_addr); -+ if (sig) -+ return sig; -+ break; -+ } -+#endif -+ - default: - return SIGILL; - } -@@ -646,6 +678,172 @@ DEF3OP(msub, dp, ieee754dp_mul, ieee754dp_sub, ); - DEF3OP(nmadd, dp, ieee754dp_mul, ieee754dp_add, ieee754dp_neg); - DEF3OP(nmsub, dp, ieee754dp_mul, ieee754dp_sub, ieee754dp_neg); - -+#ifdef __loongson_fp -+static int loongson_spec2_emu(struct pt_regs *xcp, struct mips_fpu_struct *ctx, -+ mips_instruction ir, void *__user *fault_addr) -+{ -+ int rfmt; /* resulting format */ -+ unsigned rcsr = 0; /* resulting csr */ -+ union { -+ ieee754dp d; -+ struct { -+ ieee754sp s; -+ ieee754sp s2; -+ }; -+ } rv; /* resulting value */ -+ -+ /* XXX maybe add a counter for loongson spec2 fp instructions? */ -+ /* MIPS_FPU_EMU_INC_STATS(cp1xops); */ -+ -+ switch (rfmt = (MIPSInst_FFMT(ir) & 0xf)) { -+ case s_fmt:{ -+ ieee754sp(*handler) (ieee754sp, ieee754sp, ieee754sp); -+ ieee754sp fd, fs, ft; -+ -+ switch (MIPSInst_FUNC(ir)) { -+ case loongson_madd_op: -+ handler = fpemu_sp_madd; -+ goto scoptop; -+ case loongson_msub_op: -+ handler = fpemu_sp_msub; -+ goto scoptop; -+ case loongson_nmadd_op: -+ handler = fpemu_sp_nmadd; -+ goto scoptop; -+ case loongson_nmsub_op: -+ handler = fpemu_sp_nmsub; -+ goto scoptop; -+ -+ scoptop: -+ SPFROMREG(fd, MIPSInst_FD(ir)); -+ SPFROMREG(fs, MIPSInst_FS(ir)); -+ SPFROMREG(ft, MIPSInst_FT(ir)); -+ rv.s = (*handler) (fd, fs, ft); -+ -+ copcsr: -+ if (ieee754_cxtest(IEEE754_INEXACT)) -+ rcsr |= FPU_CSR_INE_X | FPU_CSR_INE_S; -+ if (ieee754_cxtest(IEEE754_UNDERFLOW)) -+ rcsr |= FPU_CSR_UDF_X | FPU_CSR_UDF_S; -+ if (ieee754_cxtest(IEEE754_OVERFLOW)) -+ rcsr |= FPU_CSR_OVF_X | FPU_CSR_OVF_S; -+ if (ieee754_cxtest(IEEE754_INVALID_OPERATION)) -+ rcsr |= FPU_CSR_INV_X | FPU_CSR_INV_S; -+ -+ break; -+ -+ default: -+ return SIGILL; -+ } -+ break; -+ } -+ -+ case d_fmt:{ -+ ieee754dp(*handler) (ieee754dp, ieee754dp, ieee754dp); -+ ieee754dp fd, fs, ft; -+ -+ switch (MIPSInst_FUNC(ir)) { -+ case loongson_madd_op: -+ handler = fpemu_dp_madd; -+ goto dcoptop; -+ case loongson_msub_op: -+ handler = fpemu_dp_msub; -+ goto dcoptop; -+ case loongson_nmadd_op: -+ handler = fpemu_dp_nmadd; -+ goto dcoptop; -+ case loongson_nmsub_op: -+ handler = fpemu_dp_nmsub; -+ goto dcoptop; -+ -+ dcoptop: -+ DPFROMREG(fd, MIPSInst_FD(ir)); -+ DPFROMREG(fs, MIPSInst_FS(ir)); -+ DPFROMREG(ft, MIPSInst_FT(ir)); -+ rv.d = (*handler) (fd, fs, ft); -+ goto copcsr; -+ -+ default: -+ return SIGILL; -+ } -+ break; -+ } -+ -+ case ps_fmt:{ -+ ieee754sp(*handler) (ieee754sp, ieee754sp, ieee754sp); -+ struct _ieee754_csr ieee754_csr_save; -+ ieee754sp fd1, fs1, ft1; -+ ieee754sp fd2, fs2, ft2; -+ -+ switch (MIPSInst_FUNC(ir)) { -+ case loongson_madd_op: -+ handler = fpemu_sp_madd; -+ goto pscoptop; -+ case loongson_msub_op: -+ handler = fpemu_sp_msub; -+ goto pscoptop; -+ case loongson_nmadd_op: -+ handler = fpemu_sp_nmadd; -+ goto pscoptop; -+ case loongson_nmsub_op: -+ handler = fpemu_sp_nmsub; -+ goto pscoptop; -+ -+ pscoptop: -+ PSPFROMREG(fd1, fd2, MIPSInst_FD(ir)); -+ PSPFROMREG(fs1, fs2, MIPSInst_FS(ir)); -+ PSPFROMREG(ft1, ft2, MIPSInst_FT(ir)); -+ rv.s = (*handler) (fd1, fs1, ft1); -+ ieee754_csr_save = ieee754_csr; -+ rv.s2 = (*handler) (fd2, fs2, ft2); -+ ieee754_csr.cx |= ieee754_csr_save.cx; -+ ieee754_csr.sx |= ieee754_csr_save.sx; -+ goto copcsr; -+ -+ default: -+ return SIGILL; -+ } -+ break; -+ } -+ -+ default: -+ return SIGILL; -+ } -+ -+ /* -+ * Update the fpu CSR register for this operation. -+ * If an exception is required, generate a tidy SIGFPE exception, -+ * without updating the result register. -+ * Note: cause exception bits do not accumulate, they are rewritten -+ * for each op; only the flag/sticky bits accumulate. -+ */ -+ ctx->fcr31 = (ctx->fcr31 & ~FPU_CSR_ALL_X) | rcsr; -+ if ((ctx->fcr31 >> 5) & ctx->fcr31 & FPU_CSR_ALL_E) { -+ /*printk ("SIGFPE: fpu csr = %08x\n",ctx->fcr31); */ -+ return SIGFPE; -+ } -+ -+ /* -+ * Now we can safely write the result back to the register file. -+ */ -+ switch (rfmt) { -+ case d_fmt: -+ DPTOREG(rv.d, MIPSInst_FD(ir)); -+ break; -+ case s_fmt: -+ SPTOREG(rv.s, MIPSInst_FD(ir)); -+ break; -+ case ps_fmt: -+ PSPTOREG(rv.s, rv.s2, MIPSInst_FD(ir)); -+ break; -+ default: -+ return SIGILL; -+ } -+ -+ return 0; -+} -+#endif -+ - static int fpux_emu(struct pt_regs *xcp, struct mips_fpu_struct *ctx, - mips_instruction ir, void *__user *fault_addr) - { -@@ -840,7 +1038,12 @@ static int fpu_emu(struct pt_regs *xcp, struct mips_fpu_struct *ctx, - unsigned cond; - union { - ieee754dp d; -- ieee754sp s; -+ struct { -+ ieee754sp s; -+#ifdef __loongson_fp -+ ieee754sp s2; /* for Loongson paired singles */ -+#endif -+ }; - int w; - #ifdef __mips64 - s64 l; -@@ -1210,6 +1413,83 @@ static int fpu_emu(struct pt_regs *xcp, struct mips_fpu_struct *ctx, - break; - } - -+#ifdef __loongson_fp -+ case ps_fmt:{ /* 6 */ -+ /* Support for Loongson paired single fp instructions */ -+ union { -+ ieee754sp(*b) (ieee754sp, ieee754sp); -+ ieee754sp(*u) (ieee754sp); -+ } handler; -+ -+ switch (MIPSInst_FUNC(ir)) { -+ /* binary ops */ -+ case fadd_op: -+ handler.b = ieee754sp_add; -+ goto pscopbop; -+ case fsub_op: -+ handler.b = ieee754sp_sub; -+ goto pscopbop; -+ case fmul_op: -+ handler.b = ieee754sp_mul; -+ goto pscopbop; -+ -+ /* unary ops */ -+ case fabs_op: -+ handler.u = ieee754sp_abs; -+ goto pscopuop; -+ case fneg_op: -+ handler.u = ieee754sp_neg; -+ goto pscopuop; -+ case fmov_op: -+ /* an easy one */ -+ PSPFROMREG(rv.s, rv.s2, MIPSInst_FS(ir)); -+ break; -+ -+ pscopbop: /* paired binary op handler */ -+ { -+ struct _ieee754_csr ieee754_csr_save; -+ ieee754sp fs1, ft1; -+ ieee754sp fs2, ft2; -+ -+ PSPFROMREG(fs1, fs2, MIPSInst_FS(ir)); -+ PSPFROMREG(ft1, ft2, MIPSInst_FT(ir)); -+ rv.s = (*handler.b) (fs1, ft1); -+ ieee754_csr_save = ieee754_csr; -+ rv.s2 = (*handler.b) (fs2, ft2); -+ ieee754_csr.cx |= ieee754_csr_save.cx; -+ ieee754_csr.sx |= ieee754_csr_save.sx; -+ goto copcsr; -+ } -+ pscopuop: /* paired unary op handler */ -+ { -+ struct _ieee754_csr ieee754_csr_save; -+ ieee754sp fs1; -+ ieee754sp fs2; -+ -+ PSPFROMREG(fs1, fs2, MIPSInst_FS(ir)); -+ rv.s = (*handler.u) (fs1); -+ ieee754_csr_save = ieee754_csr; -+ rv.s2 = (*handler.u) (fs2); -+ ieee754_csr.cx |= ieee754_csr_save.cx; -+ ieee754_csr.sx |= ieee754_csr_save.sx; -+ goto copcsr; -+ } -+ break; -+ -+ default: -+ if (MIPSInst_FUNC(ir) >= fcmp_op) { -+ /* Loongson fp hardware handles all -+ cases of fp compare insns, so we -+ shouldn't have to */ -+ printk ("Loongson paired-single fp compare" -+ " unimplemented in cp1emu.c\n"); -+ } -+ return SIGILL; -+ } -+ break; -+ } -+#endif -+ - case w_fmt:{ - ieee754sp fs; - -@@ -1299,6 +1579,11 @@ static int fpu_emu(struct pt_regs *xcp, struct mips_fpu_struct *ctx, - DITOREG(rv.l, MIPSInst_FD(ir)); - break; - #endif -+#ifdef __loongson_fp -+ case ps_fmt: -+ PSPTOREG(rv.s, rv.s2, MIPSInst_FD(ir)); -+ break; -+#endif - default: - return SIGILL; - } --- -1.7.5.4 - diff --git a/pkgs/os-specific/linux/kernel/mips-fpureg-emulation.patch b/pkgs/os-specific/linux/kernel/mips-fpureg-emulation.patch deleted file mode 100644 index 452c4f26f6fd..000000000000 --- a/pkgs/os-specific/linux/kernel/mips-fpureg-emulation.patch +++ /dev/null @@ -1,144 +0,0 @@ -From ab1ce0a6cd51ca83194a865837f3b90f366a733d Mon Sep 17 00:00:00 2001 -From: Lluis Batlle i Rossell <viric@viric.name> -Date: Sat, 16 Jun 2012 00:22:53 +0200 -Subject: [PATCH] MIPS: Add emulation for fpureg-mem unaligned access -To: linux-mips@linux-mips.org -Cc: loongson-dev@googlegroups.com - -Reusing most of the code from lw,ld,sw,sd emulation, -I add the emulation for lwc1,ldc1,swc1,sdc1. - -This avoids the direct SIGBUS sent to userspace processes that have -misaligned memory accesses. - -I've tested the change in Loongson2F, with an own test program, and -WebKit 1.4.0, as both were killed by sigbus without this patch. - -Signed-off: Lluis Batlle i Rossell <viric@viric.name> ---- - arch/mips/kernel/unaligned.c | 43 +++++++++++++++++++++++++++++------------- - 1 file changed, 30 insertions(+), 13 deletions(-) - -diff --git a/arch/mips/kernel/unaligned.c b/arch/mips/kernel/unaligned.c -index 9c58bdf..4531e6c 100644 ---- a/arch/mips/kernel/unaligned.c -+++ b/arch/mips/kernel/unaligned.c -@@ -85,6 +85,7 @@ - #include <asm/cop2.h> - #include <asm/inst.h> - #include <asm/uaccess.h> -+#include <asm/fpu.h> - - #define STR(x) __STR(x) - #define __STR(x) #x -@@ -108,6 +109,7 @@ static void emulate_load_store_insn(struct pt_regs *regs, - union mips_instruction insn; - unsigned long value; - unsigned int res; -+ fpureg_t *fpuregs; - - perf_sw_event(PERF_COUNT_SW_EMULATION_FAULTS, 1, regs, 0); - -@@ -183,6 +185,7 @@ static void emulate_load_store_insn(struct pt_regs *regs, - break; - - case lw_op: -+ case lwc1_op: - if (!access_ok(VERIFY_READ, addr, 4)) - goto sigbus; - -@@ -209,7 +212,12 @@ static void emulate_load_store_insn(struct pt_regs *regs, - if (res) - goto fault; - compute_return_epc(regs); -- regs->regs[insn.i_format.rt] = value; -+ if (insn.i_format.opcode == lw_op) { -+ regs->regs[insn.i_format.rt] = value; -+ } else { -+ fpuregs = get_fpu_regs(current); -+ fpuregs[insn.i_format.rt] = value; -+ } - break; - - case lhu_op: -@@ -291,6 +299,7 @@ static void emulate_load_store_insn(struct pt_regs *regs, - goto sigill; - - case ld_op: -+ case ldc1_op: - #ifdef CONFIG_64BIT - /* - * A 32-bit kernel might be running on a 64-bit processor. But -@@ -325,7 +334,12 @@ static void emulate_load_store_insn(struct pt_regs *regs, - if (res) - goto fault; - compute_return_epc(regs); -- regs->regs[insn.i_format.rt] = value; -+ if (insn.i_format.opcode == ld_op) { -+ regs->regs[insn.i_format.rt] = value; -+ } else { -+ fpuregs = get_fpu_regs(current); -+ fpuregs[insn.i_format.rt] = value; -+ } - break; - #endif /* CONFIG_64BIT */ - -@@ -370,10 +384,16 @@ static void emulate_load_store_insn(struct pt_regs *regs, - break; - - case sw_op: -+ case swc1_op: - if (!access_ok(VERIFY_WRITE, addr, 4)) - goto sigbus; - -- value = regs->regs[insn.i_format.rt]; -+ if (insn.i_format.opcode == sw_op) { -+ value = regs->regs[insn.i_format.rt]; -+ } else { -+ fpuregs = get_fpu_regs(current); -+ value = fpuregs[insn.i_format.rt]; -+ } - __asm__ __volatile__ ( - #ifdef __BIG_ENDIAN - "1:\tswl\t%1,(%2)\n" -@@ -401,6 +421,7 @@ static void emulate_load_store_insn(struct pt_regs *regs, - break; - - case sd_op: -+ case sdc1_op: - #ifdef CONFIG_64BIT - /* - * A 32-bit kernel might be running on a 64-bit processor. But -@@ -412,7 +433,12 @@ static void emulate_load_store_insn(struct pt_regs *regs, - if (!access_ok(VERIFY_WRITE, addr, 8)) - goto sigbus; - -- value = regs->regs[insn.i_format.rt]; -+ if (insn.i_format.opcode == sd_op) { -+ value = regs->regs[insn.i_format.rt]; -+ } else { -+ fpuregs = get_fpu_regs(current); -+ value = fpuregs[insn.i_format.rt]; -+ } - __asm__ __volatile__ ( - #ifdef __BIG_ENDIAN - "1:\tsdl\t%1,(%2)\n" -@@ -443,15 +469,6 @@ static void emulate_load_store_insn(struct pt_regs *regs, - /* Cannot handle 64-bit instructions in 32-bit kernel */ - goto sigill; - -- case lwc1_op: -- case ldc1_op: -- case swc1_op: -- case sdc1_op: -- /* -- * I herewith declare: this does not happen. So send SIGBUS. -- */ -- goto sigbus; -- - /* - * COP2 is available to implementor for application specific use. - * It's up to applications to register a notifier chain and do --- -1.7.9.5 - diff --git a/pkgs/os-specific/linux/kernel/patches.nix b/pkgs/os-specific/linux/kernel/patches.nix index cedb2dfc2230..69495e5fc439 100644 --- a/pkgs/os-specific/linux/kernel/patches.nix +++ b/pkgs/os-specific/linux/kernel/patches.nix @@ -1,26 +1,6 @@ { stdenv, fetchurl, fetchpatch, pkgs }: -let - - makeTuxonicePatch = { version, kernelVersion, sha256, - url ? "http://tuxonice.nigelcunningham.com.au/downloads/all/tuxonice-for-linux-${kernelVersion}-${version}.patch.bz2" }: - { name = "tuxonice-${kernelVersion}"; - patch = stdenv.mkDerivation { - name = "tuxonice-${version}-for-${kernelVersion}.patch"; - src = fetchurl { - inherit url sha256; - }; - phases = [ "installPhase" ]; - installPhase = '' - source $stdenv/setup - bunzip2 -c $src > $out - ''; - }; - }; -in - rec { - bridge_stp_helper = { name = "bridge-stp-helper"; patch = ./bridge-stp-helper.patch; @@ -31,21 +11,6 @@ rec { patch = ./p9-fixes.patch; }; - mips_fpureg_emu = - { name = "mips-fpureg-emulation"; - patch = ./mips-fpureg-emulation.patch; - }; - - mips_fpu_sigill = - { name = "mips-fpu-sigill"; - patch = ./mips-fpu-sigill.patch; - }; - - mips_ext3_n32 = - { name = "mips-ext3-n32"; - patch = ./mips-ext3-n32.patch; - }; - modinst_arg_list_too_long = { name = "modinst-arglist-too-long"; patch = ./modinst-arg-list-too-long.patch; @@ -63,6 +28,16 @@ rec { patch = ./tag-hardened.patch; }; + copperhead_4_14 = rec { + name = "copperhead-4.14"; + patch = ./copperhead-4-14.patch; + }; + + copperhead_4_16 = rec { + name = "copperhead-4.16"; + patch = ./copperhead-4-16.patch; + }; + # https://bugzilla.kernel.org/show_bug.cgi?id=197591#c6 iwlwifi_mvm_support_version_7_scan_req_umac_fw_command = rec { name = "iwlwifi_mvm_support_version_7_scan_req_umac_fw_command"; diff --git a/pkgs/os-specific/linux/kernel/perf.nix b/pkgs/os-specific/linux/kernel/perf.nix index a6f399c0fba4..c58851bb03ec 100644 --- a/pkgs/os-specific/linux/kernel/perf.nix +++ b/pkgs/os-specific/linux/kernel/perf.nix @@ -31,6 +31,8 @@ stdenv.mkDerivation { makeFlags = ["prefix=$(out)" "WERROR=0"] ++ kernel.makeFlags; + hardeningDisable = [ "format" ]; + # perf refers both to newt and slang nativeBuildInputs = [ asciidoc xmlto docbook_xsl docbook_xml_dtd_45 libxslt @@ -53,6 +55,9 @@ stdenv.mkDerivation { "-Wno-error=unused-const-variable" "-Wno-error=misleading-indentation" ]; + doCheck = false; # requires "sparse" + doInstallCheck = false; # same + separateDebugInfo = true; installFlags = "install install-man ASCIIDOC8=1 prefix=$(out)"; diff --git a/pkgs/os-specific/linux/kexectools/default.nix b/pkgs/os-specific/linux/kexectools/default.nix index 26f3d89c6628..f5f0916b90a6 100644 --- a/pkgs/os-specific/linux/kexectools/default.nix +++ b/pkgs/os-specific/linux/kexectools/default.nix @@ -2,14 +2,14 @@ stdenv.mkDerivation rec { name = "kexec-tools-${version}"; - version = "2.0.16"; + version = "2.0.17"; src = fetchurl { urls = [ "mirror://kernel/linux/utils/kernel/kexec/${name}.tar.xz" "http://horms.net/projects/kexec/kexec-tools/${name}.tar.xz" ]; - sha256 = "043hasx5b9zk7r7dzx24z5wybg74dpmh0nyns6nrnb3mmm8k642v"; + sha256 = "1ac20jws8iys9w6dpn4q3hihyx73zkabdwv3gcb779cxfrmq2k2h"; }; hardeningDisable = [ "format" "pic" "relro" ]; diff --git a/pkgs/os-specific/linux/keyutils/default.nix b/pkgs/os-specific/linux/keyutils/default.nix index c7915ace7ca3..201f170c2580 100644 --- a/pkgs/os-specific/linux/keyutils/default.nix +++ b/pkgs/os-specific/linux/keyutils/default.nix @@ -5,7 +5,7 @@ stdenv.mkDerivation rec { version = "1.5.10"; src = fetchurl { - url = "http://people.redhat.com/dhowells/keyutils/${name}.tar.bz2"; + url = "https://people.redhat.com/dhowells/keyutils/${name}.tar.bz2"; sha256 = "1dmgjcf7mnwc6h72xkvpaqpzxw8vmlnsmzz0s27pg0giwzm3sp0i"; }; diff --git a/pkgs/os-specific/linux/kmod-debian-aliases/default.nix b/pkgs/os-specific/linux/kmod-debian-aliases/default.nix index a7b6561239d0..07ab0427b226 100644 --- a/pkgs/os-specific/linux/kmod-debian-aliases/default.nix +++ b/pkgs/os-specific/linux/kmod-debian-aliases/default.nix @@ -5,7 +5,7 @@ stdenv.mkDerivation rec { version = "22-1.1"; src = fetchurl { - url = "http://snapshot.debian.org/archive/debian/20160404T220610Z/pool/main/k/kmod/kmod_${version}.debian.tar.xz"; + url = "https://snapshot.debian.org/archive/debian/20160404T220610Z/pool/main/k/kmod/kmod_${version}.debian.tar.xz"; sha256 = "0daap2n4bvjqcnksaayy6csmdb1px4r02w3xp36bcp6w3lbnqamh"; }; diff --git a/pkgs/os-specific/linux/kmscon/default.nix b/pkgs/os-specific/linux/kmscon/default.nix index d3d6cfd4c58b..0fff816eac7b 100644 --- a/pkgs/os-specific/linux/kmscon/default.nix +++ b/pkgs/os-specific/linux/kmscon/default.nix @@ -16,7 +16,7 @@ stdenv.mkDerivation rec { name = "kmscon-8"; src = fetchurl { - url = "http://www.freedesktop.org/software/kmscon/releases/${name}.tar.xz"; + url = "https://www.freedesktop.org/software/kmscon/releases/${name}.tar.xz"; sha256 = "0axfwrp3c8f4gb67ap2sqnkn75idpiw09s35wwn6kgagvhf1rc0a"; }; diff --git a/pkgs/os-specific/linux/kmscube/default.nix b/pkgs/os-specific/linux/kmscube/default.nix index 27ffaca61e71..99ef7d4a5508 100644 --- a/pkgs/os-specific/linux/kmscube/default.nix +++ b/pkgs/os-specific/linux/kmscube/default.nix @@ -4,7 +4,7 @@ stdenv.mkDerivation rec { name = "kmscube-2017-03-19"; src = fetchgit { - url = git://anongit.freedesktop.org/libGLU_combined/kmscube; + url = git://anongit.freedesktop.org/mesa/kmscube; rev = "b88a44d95eceaeebc5b9c6972ffcbfe9eca00aea"; sha256 = "029ccslfavz6jllqv980sr6mj9bdbr0kx7bi21ra0q9yl2vh0yca"; }; diff --git a/pkgs/os-specific/linux/libcap-ng/default.nix b/pkgs/os-specific/linux/libcap-ng/default.nix index d4625687c472..845e4e704eba 100644 --- a/pkgs/os-specific/linux/libcap-ng/default.nix +++ b/pkgs/os-specific/linux/libcap-ng/default.nix @@ -6,11 +6,11 @@ stdenv.mkDerivation rec { name = "libcap-ng-${version}"; # When updating make sure to test that the version with # all of the python bindings still works - version = "0.7.8"; + version = "0.7.9"; src = fetchurl { url = "${meta.homepage}/${name}.tar.gz"; - sha256 = "0pyhjxgsph3p28ayk4ynxab6wvzaqmazk1nkamx11m2w8jbzj6n2"; + sha256 = "0a0k484kwv0zilry2mbl9k56cnpdhsjxdxin17jas6kkyfy345aa"; }; nativeBuildInputs = [ swig ]; diff --git a/pkgs/os-specific/linux/libcap/default.nix b/pkgs/os-specific/linux/libcap/default.nix index f00d6272902d..8248a628f0ac 100644 --- a/pkgs/os-specific/linux/libcap/default.nix +++ b/pkgs/os-specific/linux/libcap/default.nix @@ -1,5 +1,4 @@ -{ stdenv, buildPackages, fetchurl, attr, perl, pam ? null }: -assert pam != null -> stdenv.isLinux; +{ stdenv, buildPackages, fetchurl, attr, perl, pam }: stdenv.mkDerivation rec { name = "libcap-${version}"; @@ -10,8 +9,7 @@ stdenv.mkDerivation rec { sha256 = "0qjiqc5pknaal57453nxcbz3mn1r4hkyywam41wfcglq3v2qlg39"; }; - outputs = [ "out" "dev" "lib" "man" "doc" ] - ++ stdenv.lib.optional (pam != null) "pam"; + outputs = [ "out" "dev" "lib" "man" "doc" "pam" ]; depsBuildBuild = [ buildPackages.stdenv.cc ]; nativeBuildInputs = [ perl ]; @@ -22,7 +20,7 @@ stdenv.mkDerivation rec { makeFlags = [ "lib=lib" - (stdenv.lib.optional (pam != null) "PAM_CAP=yes") + "PAM_CAP=yes" "BUILD_CC=$(CC_FOR_BUILD)" "CC:=$(CC)" ]; diff --git a/pkgs/os-specific/linux/libnl/default.nix b/pkgs/os-specific/linux/libnl/default.nix index f66df8163ff1..1caf91b0bb69 100644 --- a/pkgs/os-specific/linux/libnl/default.nix +++ b/pkgs/os-specific/linux/libnl/default.nix @@ -1,17 +1,18 @@ -{ stdenv, lib, fetchFromGitHub, fetchpatch, autoreconfHook, bison, flex, pkgconfig }: +{ stdenv, file, lib, fetchFromGitHub, fetchpatch, autoreconfHook, bison, flex, pkgconfig +, pythonSupport ? true, swig ? null, python}: -let version = "3.3.0"; in -stdenv.mkDerivation { +stdenv.mkDerivation rec { name = "libnl-${version}"; + version = "3.4.0"; src = fetchFromGitHub { repo = "libnl"; owner = "thom311"; rev = "libnl${lib.replaceStrings ["."] ["_"] version}"; - sha256 = "1796kyq2lkhz2802v9kp32vlxf8ynlyqgyw9nhmry3qh5d0ahcsv"; + sha256 = "1bqf1f5glwf285sa98k5pkj9gg79lliixk1jk85j63v5510fbagp"; }; - outputs = [ "bin" "dev" "out" "man" ]; + outputs = [ "bin" "dev" "out" "man" ] ++ lib.optional pythonSupport "py"; patches = stdenv.lib.optional stdenv.hostPlatform.isMusl (fetchpatch { @@ -19,7 +20,24 @@ stdenv.mkDerivation { sha256 = "0dd7xxikib201i99k2if066hh7gwf2i4ffckrjplq6lr206jn00r"; }); - nativeBuildInputs = [ autoreconfHook bison flex pkgconfig ]; + enableParallelBuilding = true; + + nativeBuildInputs = [ autoreconfHook bison flex pkgconfig file ] + ++ lib.optional pythonSupport swig; + + postBuild = lib.optionalString (pythonSupport) '' + cd python + ${python}/bin/python setup.py install --prefix=../pythonlib + cd - + ''; + + postFixup = lib.optionalString pythonSupport '' + mv "pythonlib/" "$py" + ''; + + passthru = { + inherit pythonSupport; + }; meta = with lib; { inherit version; diff --git a/pkgs/os-specific/linux/libselinux/default.nix b/pkgs/os-specific/linux/libselinux/default.nix index 59d5db52ac68..a172e45e7faa 100644 --- a/pkgs/os-specific/linux/libselinux/default.nix +++ b/pkgs/os-specific/linux/libselinux/default.nix @@ -1,6 +1,6 @@ { stdenv, fetchurl, pcre, pkgconfig, libsepol , enablePython ? true, swig ? null, python ? null -, musl-fts +, fts }: assert enablePython -> swig != null && python != null; @@ -18,9 +18,8 @@ stdenv.mkDerivation rec { }; nativeBuildInputs = [ pkgconfig ]; - buildInputs = [ libsepol pcre ] - ++ optionals enablePython [ swig python ] - ++ optional stdenv.hostPlatform.isMusl musl-fts; + buildInputs = [ libsepol pcre fts ] + ++ optionals enablePython [ swig python ]; # drop fortify here since package uses it by default, leading to compile error: # command-line>:0:0: error: "_FORTIFY_SOURCE" redefined [-Werror] diff --git a/pkgs/os-specific/linux/libsmbios/default.nix b/pkgs/os-specific/linux/libsmbios/default.nix index 62898675f2be..c61fa683c758 100644 --- a/pkgs/os-specific/linux/libsmbios/default.nix +++ b/pkgs/os-specific/linux/libsmbios/default.nix @@ -1,5 +1,5 @@ { stdenv, fetchFromGitHub, pkgconfig, autoreconfHook, help2man, gettext -, libxml2, perl, doxygen }: +, libxml2, perl, python3, doxygen }: stdenv.mkDerivation rec { @@ -15,7 +15,9 @@ stdenv.mkDerivation rec { nativeBuildInputs = [ autoreconfHook doxygen gettext libxml2 help2man perl pkgconfig ]; - configureFlags = [ "--disable-python" "--disable-graphviz" ]; + buildInputs = [ python3 ]; + + configureFlags = [ "--disable-graphviz" ]; enableParallelBuilding = true; diff --git a/pkgs/os-specific/linux/libvolume_id/default.nix b/pkgs/os-specific/linux/libvolume_id/default.nix index c82c892c4627..14c152dc10e9 100644 --- a/pkgs/os-specific/linux/libvolume_id/default.nix +++ b/pkgs/os-specific/linux/libvolume_id/default.nix @@ -4,7 +4,7 @@ stdenv.mkDerivation { name = "libvolume_id-0.81.1"; src = fetchurl { - url = http://www.marcuscom.com/downloads/libvolume_id-0.81.1.tar.bz2; + url = https://www.marcuscom.com/downloads/libvolume_id-0.81.1.tar.bz2; sha256 = "029z04vdxxsl8gycm9whcljhv6dy4b12ybsxdb99jr251gl1ifs5"; }; diff --git a/pkgs/os-specific/linux/lm-sensors/default.nix b/pkgs/os-specific/linux/lm-sensors/default.nix index 4f35d5465383..25b868369ae1 100644 --- a/pkgs/os-specific/linux/lm-sensors/default.nix +++ b/pkgs/os-specific/linux/lm-sensors/default.nix @@ -12,7 +12,7 @@ stdenv.mkDerivation rec { src = fetchurl { urls = [ "http://dl.lm-sensors.org/lm-sensors/releases/lm_sensors-${version}.tar.bz2" - "http://src.fedoraproject.org/repo/pkgs/lm_sensors/lm_sensors-${version}.tar.bz2/c03675ae9d43d60322110c679416901a/lm_sensors-${version}.tar.bz2" + "https://src.fedoraproject.org/repo/pkgs/lm_sensors/lm_sensors-${version}.tar.bz2/c03675ae9d43d60322110c679416901a/lm_sensors-${version}.tar.bz2" ]; sha256 = "07q6811l4pp0f7pxr8bk3s97ippb84mx5qdg7v92s9hs10b90mz0"; }; diff --git a/pkgs/os-specific/linux/lsscsi/default.nix b/pkgs/os-specific/linux/lsscsi/default.nix index 833c032ccd2c..d250d658282f 100644 --- a/pkgs/os-specific/linux/lsscsi/default.nix +++ b/pkgs/os-specific/linux/lsscsi/default.nix @@ -1,13 +1,11 @@ { stdenv, fetchurl }: -assert stdenv.isLinux; - stdenv.mkDerivation { - name = "lsscsi-0.28"; + name = "lsscsi-0.29"; src = fetchurl { - url = "http://sg.danny.cz/scsi/lsscsi-0.28.tgz"; - sha256 = "0l6xz8545lnfd9f4z974ar1pbzfdkr6c8r56zjrcaazl3ad00p82"; + url = "http://sg.danny.cz/scsi/lsscsi-0.29.tgz"; + sha256 = "0538fjgxky03yn7mzyslkyi2af3yy5llsnjjcgjx73x08wd6hv5n"; }; preConfigure = '' diff --git a/pkgs/os-specific/linux/lttng-modules/default.nix b/pkgs/os-specific/linux/lttng-modules/default.nix index 7c2233714d4c..d4b3f374c5bc 100644 --- a/pkgs/os-specific/linux/lttng-modules/default.nix +++ b/pkgs/os-specific/linux/lttng-modules/default.nix @@ -10,6 +10,8 @@ stdenv.mkDerivation rec { sha256 = "07rs01zwr4bmjamplix5qz1c6mb6wdawb68vyn0w6wx68ppbpnxq"; }; + buildInputs = kernel.moduleBuildDependencies; + hardeningDisable = [ "pic" ]; NIX_CFLAGS_COMPILE = [ "-Wno-error=implicit-function-declaration" ]; @@ -30,7 +32,7 @@ stdenv.mkDerivation rec { platforms = platforms.linux; maintainers = [ maintainers.bjornfor ]; broken = builtins.compareVersions kernel.version "3.18" == -1 - || builtins.compareVersions kernel.version "4.11" == 1; + || builtins.compareVersions kernel.version "4.16" == 1; }; } diff --git a/pkgs/os-specific/linux/lvm2/default.nix b/pkgs/os-specific/linux/lvm2/default.nix index bd84e121a7d6..8cda636e987d 100644 --- a/pkgs/os-specific/linux/lvm2/default.nix +++ b/pkgs/os-specific/linux/lvm2/default.nix @@ -59,6 +59,8 @@ stdenv.mkDerivation { }) ]; + doCheck = false; # requires root + # To prevent make install from failing. preInstall = "installFlags=\"OWNER= GROUP= confdir=$out/etc\""; diff --git a/pkgs/os-specific/linux/lxc/default.nix b/pkgs/os-specific/linux/lxc/default.nix index 1b15edcc923c..491f89f3cb44 100644 --- a/pkgs/os-specific/linux/lxc/default.nix +++ b/pkgs/os-specific/linux/lxc/default.nix @@ -9,11 +9,11 @@ with stdenv.lib; stdenv.mkDerivation rec { name = "lxc-${version}"; - version = "3.0.0"; + version = "3.0.1"; src = fetchurl { url = "https://linuxcontainers.org/downloads/lxc/lxc-${version}.tar.gz"; - sha256 = "12ldpkd17cy6fg7z1icr91cfs86jkkrsj61b6wdj0l7h4x624c32"; + sha256 = "1nyml98k28sc5sda0260cmby4irkpnhpwgmx4yhqy10wpr4nr625"; }; nativeBuildInputs = [ diff --git a/pkgs/os-specific/linux/lxcfs/default.nix b/pkgs/os-specific/linux/lxcfs/default.nix index 6f7dd2f56ff7..2bdec70b6f9c 100644 --- a/pkgs/os-specific/linux/lxcfs/default.nix +++ b/pkgs/os-specific/linux/lxcfs/default.nix @@ -3,13 +3,13 @@ with stdenv.lib; stdenv.mkDerivation rec { - name = "lxcfs-3.0.0"; + name = "lxcfs-3.0.1"; src = fetchFromGitHub { owner = "lxc"; repo = "lxcfs"; rev = name; - sha256 = "0fsy2h7b5dkzvfm6m8vqzhnji42cszdn0b3ndnaxiwv3402ccmvk"; + sha256 = "0rwk1nbcjnp2d2zbyng8ix9dmww211aiqq8870r9p4j11xv9mgx4"; }; nativeBuildInputs = [ pkgconfig help2man autoreconfHook ]; diff --git a/pkgs/os-specific/linux/mcelog/default.nix b/pkgs/os-specific/linux/mcelog/default.nix index 4ebc1c00f7af..e5ee5e202944 100644 --- a/pkgs/os-specific/linux/mcelog/default.nix +++ b/pkgs/os-specific/linux/mcelog/default.nix @@ -2,13 +2,13 @@ stdenv.mkDerivation rec { name = "mcelog-${version}"; - version = "157"; + version = "159"; src = fetchFromGitHub { owner = "andikleen"; repo = "mcelog"; rev = "v${version}"; - sha256 = "1965axyfizv2jg412a4wrrghgswwvvgymk7mbwaraw3xl9p21wgv"; + sha256 = "1w8y4igxi48r2d9s6g9fm1bgmsga94gfz6x0xaln6rhvbgi318xg"; }; postPatch = '' diff --git a/pkgs/os-specific/linux/mdadm/default.nix b/pkgs/os-specific/linux/mdadm/default.nix index 7a59c2ea7573..b6fdae75bac2 100644 --- a/pkgs/os-specific/linux/mdadm/default.nix +++ b/pkgs/os-specific/linux/mdadm/default.nix @@ -3,8 +3,6 @@ , buildPlatform, hostPlatform }: -assert stdenv.isLinux; - let sendmail-script = writeScript "sendmail-script" '' #!/bin/sh diff --git a/pkgs/os-specific/linux/mmc-utils/default.nix b/pkgs/os-specific/linux/mmc-utils/default.nix index a17f687a2550..b491d5bbda7e 100644 --- a/pkgs/os-specific/linux/mmc-utils/default.nix +++ b/pkgs/os-specific/linux/mmc-utils/default.nix @@ -10,6 +10,8 @@ stdenv.mkDerivation rec { sha256 = "0hkdzc71pdnscbpdpgwljcchiyancarldjyd0w609sy18bky833x"; }; + makeFlags = "CC=${stdenv.cc.targetPrefix}cc"; + installPhase = '' make install prefix=$out mkdir -p $out/share/man/man1 diff --git a/pkgs/os-specific/linux/multipath-tools/default.nix b/pkgs/os-specific/linux/multipath-tools/default.nix index 0e0178e8845b..a1b207ffea09 100644 --- a/pkgs/os-specific/linux/multipath-tools/default.nix +++ b/pkgs/os-specific/linux/multipath-tools/default.nix @@ -5,7 +5,7 @@ stdenv.mkDerivation rec { src = fetchurl { name = "${name}.tar.gz"; - url = "http://git.opensvc.com/?p=multipath-tools/.git;a=snapshot;h=e165b73a16fc9027aa3306df40052038c175be1b;sf=tgz"; + url = "https://git.opensvc.com/"; sha256 = "159hxvbk9kh1qay9x04w0gsqzg0hkl5yghfc1wi9kv2n5pcwbkpm"; }; diff --git a/pkgs/os-specific/linux/musl/default.nix b/pkgs/os-specific/linux/musl/default.nix index 3d515f7b762f..6bcd2ea692d3 100644 --- a/pkgs/os-specific/linux/musl/default.nix +++ b/pkgs/os-specific/linux/musl/default.nix @@ -33,7 +33,7 @@ stdenv.mkDerivation rec { version = "1.1.19"; src = fetchurl { - url = "http://www.musl-libc.org/releases/musl-${version}.tar.gz"; + url = "https://www.musl-libc.org/releases/musl-${version}.tar.gz"; sha256 = "1nf1wh44bhm8gdcfr75ayib29b99vpq62zmjymrq7f96h9bshnfv"; }; diff --git a/pkgs/os-specific/linux/musl/fts-setup-hook.sh b/pkgs/os-specific/linux/musl/fts-setup-hook.sh deleted file mode 100644 index 3962dcb19a20..000000000000 --- a/pkgs/os-specific/linux/musl/fts-setup-hook.sh +++ /dev/null @@ -1,17 +0,0 @@ -ftsLdflags() { - # The `depHostOffset` describes how the host platform of the dependencies - # are slid relative to the depending package. It is brought into scope of - # the environment hook defined as the role of the dependency being applied. - case $depHostOffset in - -1) local role='BUILD_' ;; - 0) local role='' ;; - 1) local role='TARGET_' ;; - *) echo "cc-wrapper: Error: Cannot be used with $depHostOffset-offset deps" >2; - return 1 ;; - esac - - export NIX_${role}LDFLAGS+=" -lfts" -} - -addEnvHooks "$hostOffset" ftsLdflags - diff --git a/pkgs/os-specific/linux/musl/fts.nix b/pkgs/os-specific/linux/musl/fts.nix deleted file mode 100644 index 0f16e8cc79bf..000000000000 --- a/pkgs/os-specific/linux/musl/fts.nix +++ /dev/null @@ -1,16 +0,0 @@ -{ stdenv, fetchFromGitHub, autoreconfHook, pkgconfig }: - -stdenv.mkDerivation rec { - name = "musl-fts-${version}"; - version = "2017-01-13"; - src = fetchFromGitHub { - owner = "pullmoll"; - repo = "musl-fts"; - rev = "0bde52df588e8969879a2cae51c3a4774ec62472"; - sha256 = "1q8cpzisziysrs08b89wj0rm4p6dsyl177cclpfa0f7spjm3jg03"; - }; - - nativeBuildInputs = [ autoreconfHook pkgconfig ]; - - setupHook = ./fts-setup-hook.sh; -} diff --git a/pkgs/os-specific/linux/musl/getconf.nix b/pkgs/os-specific/linux/musl/getconf.nix deleted file mode 100644 index dbfaca296bf9..000000000000 --- a/pkgs/os-specific/linux/musl/getconf.nix +++ /dev/null @@ -1,19 +0,0 @@ -{ stdenv, fetchurl }: - -stdenv.mkDerivation { - name = "musl-getconf"; - src = fetchurl { - url = "https://raw.githubusercontent.com/alpinelinux/aports/48b16204aeeda5bc1f87e49c6b8e23d9abb07c73/main/musl/getconf.c"; - sha256 = "0z14ml5343p5gapxw9fnbn2r72r7v2gk8662iifjrblh6sxhqzfq"; - }; - - unpackPhase = ":"; - - buildPhase = ''$CC $src -o getconf''; - installPhase = '' - mkdir -p $out/bin - cp getconf $out/bin/ - ''; -} - - diff --git a/pkgs/os-specific/linux/musl/getent.nix b/pkgs/os-specific/linux/musl/getent.nix deleted file mode 100644 index 6eed17a76b02..000000000000 --- a/pkgs/os-specific/linux/musl/getent.nix +++ /dev/null @@ -1,18 +0,0 @@ -{ stdenv, fetchurl }: - -stdenv.mkDerivation { - name = "musl-getent"; - src = fetchurl { - url = "https://raw.githubusercontent.com/alpinelinux/aports/89a718d88ec7466e721f3bbe9ede5ffe58061d78/main/musl/getent.c"; - sha256 = "0b4jqnsmv1hjgcz7db3vd61k682aphl59c3yhwya2q7mkc6g48xk"; - }; - - unpackPhase = ":"; - - buildPhase = ''$CC $src -o getent''; - installPhase = '' - mkdir -p $out/bin - cp getent $out/bin/ - ''; -} - diff --git a/pkgs/os-specific/linux/mwprocapture/default.nix b/pkgs/os-specific/linux/mwprocapture/default.nix index e2abbd7335ee..72095bc8cdab 100644 --- a/pkgs/os-specific/linux/mwprocapture/default.nix +++ b/pkgs/os-specific/linux/mwprocapture/default.nix @@ -5,9 +5,6 @@ with stdenv.lib; # The Magewell Pro Capture drivers are not supported for kernels older than 3.2 assert versionAtLeast kernel.version "3.2.0"; -# this package currently only supports x86 and x86_64, as I have no ARM device to test on -assert (stdenv.system == "x86_64-linux") || (stdenv.system == "i686-linux"); - let bits = if stdenv.is64bit then "64" diff --git a/pkgs/os-specific/linux/net-tools/default.nix b/pkgs/os-specific/linux/net-tools/default.nix index ce287dc18415..42f745b02e30 100644 --- a/pkgs/os-specific/linux/net-tools/default.nix +++ b/pkgs/os-specific/linux/net-tools/default.nix @@ -15,6 +15,8 @@ stdenv.mkDerivation rec { ''; makeFlags = [ + "CC=${stdenv.cc.targetPrefix}cc" + "AR=${stdenv.cc.targetPrefix}ar" "BASEDIR=$(out)" "mandir=/share/man" "HAVE_ARP_TOOLS=1" diff --git a/pkgs/os-specific/linux/nfs-utils/default.nix b/pkgs/os-specific/linux/nfs-utils/default.nix index 904dae55c9cb..359d18690843 100644 --- a/pkgs/os-specific/linux/nfs-utils/default.nix +++ b/pkgs/os-specific/linux/nfs-utils/default.nix @@ -1,4 +1,4 @@ -{ stdenv, fetchurl, lib, pkgconfig, utillinux, libcap, libtirpc, libevent, libnfsidmap +{ stdenv, fetchurl, fetchpatch, lib, pkgconfig, utillinux, libcap, libtirpc, libevent, libnfsidmap , sqlite, kerberos, kmod, libuuid, keyutils, lvm2, systemd, coreutils, tcp_wrappers , buildEnv }: @@ -39,6 +39,18 @@ in stdenv.mkDerivation rec { ] ++ lib.optional (stdenv ? glibc) "--with-rpcgen=${stdenv.glibc.bin}/bin/rpcgen"; + patches = lib.optionals stdenv.hostPlatform.isMusl [ + (fetchpatch { + url = "https://raw.githubusercontent.com/alpinelinux/aports/cb880042d48d77af412d4688f24b8310ae44f55f/main/nfs-utils/0011-exportfs-only-do-glibc-specific-hackery-on-glibc.patch"; + sha256 = "0rrddrykz8prk0dcgfvmnz0vxn09dbgq8cb098yjjg19zz6d7vid"; + }) + # http://openwall.com/lists/musl/2015/08/18/10 + (fetchpatch { + url = "https://raw.githubusercontent.com/alpinelinux/aports/cb880042d48d77af412d4688f24b8310ae44f55f/main/nfs-utils/musl-getservbyport.patch"; + sha256 = "1fqws9dz8n1d9a418c54r11y3w330qgy2652dpwcy96cm44sqyhf"; + }) + ]; + postPatch = '' patchShebangs tests diff --git a/pkgs/os-specific/linux/nftables/default.nix b/pkgs/os-specific/linux/nftables/default.nix index be52cbc2029d..468bfd135e77 100644 --- a/pkgs/os-specific/linux/nftables/default.nix +++ b/pkgs/os-specific/linux/nftables/default.nix @@ -2,12 +2,12 @@ , flex, bison, libmnl, libnftnl, gmp, readline }: stdenv.mkDerivation rec { - version = "0.8.3"; + version = "0.9.0"; name = "nftables-${version}"; src = fetchurl { - url = "http://netfilter.org/projects/nftables/files/${name}.tar.bz2"; - sha256 = "0f2yv7as1ybkfvn75f72x0z9y1ydibw4s3hbzhlmvsc8vgsy2syi"; + url = "https://netfilter.org/projects/nftables/files/${name}.tar.bz2"; + sha256 = "14bygs6vg2v448cw5r4pxqi8an29hw0m9vab8hpmgjmrzjsq30dd"; }; configureFlags = [ diff --git a/pkgs/os-specific/linux/nvidia-x11/builder.sh b/pkgs/os-specific/linux/nvidia-x11/builder.sh index cd7733f43a48..15c3e10e1199 100755 --- a/pkgs/os-specific/linux/nvidia-x11/builder.sh +++ b/pkgs/os-specific/linux/nvidia-x11/builder.sh @@ -17,7 +17,6 @@ buildPhase() { # Create the module. echo "Building linux driver against kernel: $kernel"; cd kernel - kernelVersion=$(cd $kernel/lib/modules && ls) sysSrc=$(echo $kernel/lib/modules/$kernelVersion/source) sysOut=$(echo $kernel/lib/modules/$kernelVersion/build) unset src # used by the nv makefile diff --git a/pkgs/os-specific/linux/nvidia-x11/default.nix b/pkgs/os-specific/linux/nvidia-x11/default.nix index 11a97d420a83..8eeaf502020d 100644 --- a/pkgs/os-specific/linux/nvidia-x11/default.nix +++ b/pkgs/os-specific/linux/nvidia-x11/default.nix @@ -17,13 +17,11 @@ in rec { # Policy: use the highest stable version as the default (on our master). stable = generic { - version = "390.48"; - sha256_32bit = "1y6n2hfz9vd0h7gd31fgxcl76s5pjf8afwqyq5slqpcxpd78j5ai"; - sha256_64bit = "16a3blvizcksmaxr644s857yanw3i3vcvqvn7qnwbsbqpmxga09c"; - settingsSha256 = "058xaiw5g0kxrvc3lvy4424fqbjkvmsznj2v73cgbm25i1m83krl"; - persistencedSha256 = "0y86bhzl42lqyrbibqzf8a8yd49zbq3ryb78vgsl13i44f9sl79k"; - - patches = [ ./fix_missing_symbol.patch ]; + version = "390.67"; + sha256_32bit = "01c8fa80njyyr39c1pyf7ssmfq65ci8mapbs94fd6gnhwc7gfjkg"; + sha256_64bit = "0np6xj93fali2hss8xsdlmy5ykjgn4hx6mzjr8dpbdi0fhdcmwkd"; + settingsSha256 = "1wk4587czysnbj5yxijmv3bldcffzwp4yvfx133apsr31dqca0s7"; + persistencedSha256 = "1zia1r97lyj6fbmvsw4hv5qfcj84x3sz971m4430d8qyks2c4sdw"; }; beta = stable; # not enough interest to maintain beta ATM diff --git a/pkgs/os-specific/linux/nvidia-x11/fix_missing_symbol.patch b/pkgs/os-specific/linux/nvidia-x11/fix_missing_symbol.patch deleted file mode 100644 index ea783b4f011e..000000000000 --- a/pkgs/os-specific/linux/nvidia-x11/fix_missing_symbol.patch +++ /dev/null @@ -1,19 +0,0 @@ -https://devtalk.nvidia.com/default/topic/1030082/linux/kernel-4-16-rc1-breaks-latest-drivers-unknown-symbol-swiotlb_map_sg_attrs-/ ---- a/kernel/common/inc/nv-linux.h~ 2018-01-25 06:09:41.000000000 +0100 -+++ b/kernel/common/inc/nv-linux.h 2018-03-05 13:58:17.746725638 +0100 -@@ -1209,6 +1209,7 @@ static inline NvU32 nv_alloc_init_flags( - static inline NvBool nv_dma_maps_swiotlb(struct pci_dev *dev) - { - NvBool swiotlb_in_use = NV_FALSE; -+#if 0 - #if defined(CONFIG_SWIOTLB) - #if defined(NV_DMA_OPS_PRESENT) || defined(NV_GET_DMA_OPS_PRESENT) - /* -@@ -1251,7 +1252,7 @@ static inline NvBool nv_dma_maps_swiotlb - swiotlb_in_use = (swiotlb == 1); - #endif - #endif -- -+#endif - return swiotlb_in_use; - } diff --git a/pkgs/os-specific/linux/nvidia-x11/generic.nix b/pkgs/os-specific/linux/nvidia-x11/generic.nix index 13e5d1b76ea6..0fe0f3d92c92 100644 --- a/pkgs/os-specific/linux/nvidia-x11/generic.nix +++ b/pkgs/os-specific/linux/nvidia-x11/generic.nix @@ -55,6 +55,7 @@ let outputDev = if libsOnly then null else "bin"; kernel = if libsOnly then null else kernel.dev; + kernelVersion = if libsOnly then null else kernel.modDirVersion; hardeningDisable = [ "pic" "format" ]; diff --git a/pkgs/os-specific/linux/odp-dpdk/configure.patch b/pkgs/os-specific/linux/odp-dpdk/configure.patch deleted file mode 100644 index 3dadc98e8342..000000000000 --- a/pkgs/os-specific/linux/odp-dpdk/configure.patch +++ /dev/null @@ -1,32 +0,0 @@ -diff --git a/configure.ac b/configure.ac -index 001ebfc2893b..7d19ebcd213f 100644 ---- a/configure.ac -+++ b/configure.ac -@@ -215,7 +215,7 @@ AC_SUBST([testdir]) - ########################################################################## - AM_CONDITIONAL([netmap_support], [test x$netmap_support = xyes ]) - AM_CONDITIONAL([PKTIO_DPDK], [test x$pktio_dpdk_support = xyes ]) --AM_CONDITIONAL([HAVE_PCAP], [test $have_pcap = yes]) -+AM_CONDITIONAL([HAVE_PCAP], [test x$have_pcap = xyes]) - AM_CONDITIONAL([DPDK_DEFAULT_DIR], [test "x${DPDK_DEFAULT_DIR}" = "x1"]) - AM_CONDITIONAL([test_installdir], [test "$testdir" != ""]) - AM_CONDITIONAL([cunit_support], [test x$cunit_support = xyes ]) -@@ -320,18 +320,6 @@ ODP_CFLAGS="$ODP_CFLAGS -Wcast-align -Wnested-externs -Wcast-qual -Wformat-nonli - ODP_CFLAGS="$ODP_CFLAGS -Wformat-security -Wundef -Wwrite-strings" - ODP_CFLAGS="$ODP_CFLAGS -std=gnu99" - --dnl Use -Werror in the checks below since Clang emits a warning instead of --dnl an error when it encounters an unknown warning option. --AX_CHECK_COMPILE_FLAG([-Wimplicit-fallthrough=0], -- [ODP_CFLAGS="$ODP_CFLAGS -Wimplicit-fallthrough=0"], -- [], [-Werror]) --AX_CHECK_COMPILE_FLAG([-Wformat-truncation=0], -- [ODP_CFLAGS="$ODP_CFLAGS -Wformat-truncation=0"], -- [], [-Werror]) --AX_CHECK_COMPILE_FLAG([-Wformat-overflow=0], -- [ODP_CFLAGS="$ODP_CFLAGS -Wformat-overflow=0"], -- [], [-Werror]) -- - # Extra flags for example to suppress certain warning types - ODP_CFLAGS="$ODP_CFLAGS $ODP_CFLAGS_EXTRA" - diff --git a/pkgs/os-specific/linux/odp-dpdk/default.nix b/pkgs/os-specific/linux/odp-dpdk/default.nix index a444243e802e..bead5f84eac9 100644 --- a/pkgs/os-specific/linux/odp-dpdk/default.nix +++ b/pkgs/os-specific/linux/odp-dpdk/default.nix @@ -1,36 +1,32 @@ -{ stdenv, fetchgit, autoreconfHook, openssl, libpcap, dpdk }: +{ stdenv, fetchurl, autoreconfHook, pkgconfig +, dpdk, libconfig, libpcap, numactl, openssl +}: stdenv.mkDerivation rec { name = "odp-dpdk-${version}"; - version = "1.15.0.0"; + version = "1.19.0.0_DPDK_17.11"; - src = fetchgit { - url = "https://git.linaro.org/lng/odp-dpdk.git"; - rev = "d8533b4e575d62c9f6f2caedd38d98a1a56fb8d3"; - sha256 = "1p09rw7dxxqcxxrdb8wbwp2imapyjvdbvap7s9km2i9hbd8ipdif"; + src = fetchurl { + url = "https://git.linaro.org/lng/odp-dpdk.git/snapshot/${name}.tar.gz"; + sha256 = "05bwjaxl9hqc6fbkp95nniq11g3kvzmlxw0bq55i7p2v35nv38px"; }; - nativeBuildInputs = [ autoreconfHook ]; - buildInputs = [ openssl dpdk libpcap ]; + nativeBuildInputs = [ autoreconfHook pkgconfig ]; + buildInputs = [ dpdk libconfig libpcap numactl openssl ]; - RTE_SDK = "${dpdk}"; + RTE_SDK = "${dpdk}/share/dpdk"; RTE_TARGET = "x86_64-native-linuxapp-gcc"; dontDisableStatic = true; configureFlags = [ "--disable-shared" - "--with-sdk-install-path=${dpdk}/${RTE_TARGET}" - ]; - - patches = [ - ./configure.patch - ./odp_crypto.patch + "--with-dpdk-path=${dpdk}" ]; meta = with stdenv.lib; { description = "Open Data Plane optimized for DPDK"; - homepage = http://www.opendataplane.org; + homepage = https://www.opendataplane.org; license = licenses.bsd3; platforms = [ "x86_64-linux" ]; maintainers = [ maintainers.abuibrahim ]; diff --git a/pkgs/os-specific/linux/odp-dpdk/odp_crypto.patch b/pkgs/os-specific/linux/odp-dpdk/odp_crypto.patch deleted file mode 100644 index 44ef155d69fb..000000000000 --- a/pkgs/os-specific/linux/odp-dpdk/odp_crypto.patch +++ /dev/null @@ -1,18 +0,0 @@ -diff --git a/platform/linux-dpdk/odp_crypto.c b/platform/linux-dpdk/odp_crypto.c -index d95b157805dc..d13ad5bbde95 100644 ---- a/platform/linux-dpdk/odp_crypto.c -+++ b/platform/linux-dpdk/odp_crypto.c -@@ -900,11 +900,12 @@ int odp_crypto_session_create(odp_crypto_session_param_t *param, - /* Setup session */ - session = rte_cryptodev_sym_session_create(cdev_id, first_xform); - -- if (session == NULL) -+ if (session == NULL) { - /* remove the crypto_session_entry_t */ - memset(entry, 0, sizeof(*entry)); - free_session(entry); - return -1; -+ } - - entry->rte_session = (intptr_t)session; - entry->cipher_xform = cipher_xform; diff --git a/pkgs/os-specific/linux/otpw/default.nix b/pkgs/os-specific/linux/otpw/default.nix index 69c6dd1510cb..a0464e1996a5 100644 --- a/pkgs/os-specific/linux/otpw/default.nix +++ b/pkgs/os-specific/linux/otpw/default.nix @@ -4,7 +4,7 @@ stdenv.mkDerivation rec { name = "otpw-1.3"; src = fetchurl { - url = "http://www.cl.cam.ac.uk/~mgk25/download/${name}.tar.gz"; + url = "https://www.cl.cam.ac.uk/~mgk25/download/${name}.tar.gz"; sha256 = "1k3hc7xbxz6hkc55kvddi3cibafwf93ivn58sy1l888d3l5dwmrk"; }; diff --git a/pkgs/os-specific/linux/pagemon/default.nix b/pkgs/os-specific/linux/pagemon/default.nix index 99caa813b2ea..6429c19f2b5c 100644 --- a/pkgs/os-specific/linux/pagemon/default.nix +++ b/pkgs/os-specific/linux/pagemon/default.nix @@ -2,10 +2,10 @@ stdenv.mkDerivation rec { name = "pagemon-${version}"; - version = "0.01.12"; + version = "0.01.13"; src = fetchFromGitHub { - sha256 = "0bddn22daf33dbghwfjxxgsn4gmr5knr6h9sbqhs7g7p85dla6wa"; + sha256 = "055qniys5xv0ivdvdws5vwdgfyj6iyq02v5nn945l1x59rwnb541"; rev = "V${version}"; repo = "pagemon"; owner = "ColinIanKing"; diff --git a/pkgs/os-specific/linux/pam/default.nix b/pkgs/os-specific/linux/pam/default.nix index 5f92dfcc8390..0e7033972496 100644 --- a/pkgs/os-specific/linux/pam/default.nix +++ b/pkgs/os-specific/linux/pam/default.nix @@ -1,4 +1,4 @@ -{ stdenv, buildPackages, hostPlatform, fetchurl, fetchpatch, flex, cracklib }: +{ stdenv, buildPackages, hostPlatform, fetchurl, fetchpatch, flex, cracklib, db4 }: stdenv.mkDerivation rec { name = "linux-pam-${version}"; @@ -29,25 +29,10 @@ stdenv.mkDerivation rec { depsBuildBuild = [ buildPackages.stdenv.cc ]; nativeBuildInputs = [ flex ]; - buildInputs = [ cracklib ]; + buildInputs = [ cracklib db4 ]; enableParallelBuilding = true; - crossAttrs = { - propagatedBuildInputs = [ flex.crossDrv cracklib.crossDrv ]; - preConfigure = preConfigure + '' - $crossConfig-ar x ${flex.crossDrv}/lib/libfl.a - mv libyywrap.o libyywrap-target.o - ar x ${flex}/lib/libfl.a - mv libyywrap.o libyywrap-host.o - export LDFLAGS="$LDFLAGS $PWD/libyywrap-target.o" - sed -e 's/@CC@/gcc/' -i doc/specs/Makefile.in - ''; - postConfigure = '' - sed -e "s@ $PWD/libyywrap-target.o@ $PWD/libyywrap-host.o@" -i doc/specs/Makefile - ''; - }; - postInstall = '' mv -v $out/sbin/unix_chkpwd{,.orig} ln -sv /run/wrappers/bin/unix_chkpwd $out/sbin/unix_chkpwd @@ -70,9 +55,12 @@ stdenv.mkDerivation rec { sed -e 's/pam_rhosts//g' -i modules/Makefile.in ''; - meta = { - homepage = http://ftp.kernel.org/pub/linux/libs/pam/; + doCheck = false; # fails + + meta = with stdenv.lib; { + homepage = http://www.linux-pam.org/; description = "Pluggable Authentication Modules, a flexible mechanism for authenticating user"; - platforms = stdenv.lib.platforms.linux; + platforms = platforms.linux; + license = licenses.bsd3; }; } diff --git a/pkgs/os-specific/linux/pam_krb5/default.nix b/pkgs/os-specific/linux/pam_krb5/default.nix index 76dbbf1e1be4..dd3957d36185 100644 --- a/pkgs/os-specific/linux/pam_krb5/default.nix +++ b/pkgs/os-specific/linux/pam_krb5/default.nix @@ -4,7 +4,7 @@ stdenv.mkDerivation rec { name = "pam-krb5-4.8"; src = fetchurl { - url = "http://archives.eyrie.org/software/kerberos/${name}.tar.gz"; + url = "https://archives.eyrie.org/software/kerberos/${name}.tar.gz"; sha256 = "0j96jfaxzkj1ifc3qxagjmaxvgda7ndqaaxx2ka018is9f5lbfrs"; }; diff --git a/pkgs/os-specific/linux/pam_u2f/default.nix b/pkgs/os-specific/linux/pam_u2f/default.nix index 0f0b6ebb37a6..58e3f79d42b2 100644 --- a/pkgs/os-specific/linux/pam_u2f/default.nix +++ b/pkgs/os-specific/linux/pam_u2f/default.nix @@ -2,11 +2,11 @@ stdenv.mkDerivation rec { name = "pam_u2f-${version}"; - version = "1.0.5"; + version = "1.0.7"; src = fetchurl { url = "https://developers.yubico.com/pam-u2f/Releases/${name}.tar.gz"; - sha256 = "0bbwy9k3002anhkv67zwck3dry7blqnnp291dc4qsjrca0blw217"; + sha256 = "1kz7d3vr5dag1d5zq14kcp887p5d0q079dy1sqyl8ndi567asjh3"; }; nativeBuildInputs = [ pkgconfig ]; diff --git a/pkgs/os-specific/linux/paxctl/default.nix b/pkgs/os-specific/linux/paxctl/default.nix index afb342768c33..270be695f03a 100644 --- a/pkgs/os-specific/linux/paxctl/default.nix +++ b/pkgs/os-specific/linux/paxctl/default.nix @@ -5,7 +5,7 @@ stdenv.mkDerivation rec { version = "0.9"; src = fetchurl { - url = "http://pax.grsecurity.net/${name}.tar.gz"; + url = "https://pax.grsecurity.net/${name}.tar.gz"; sha256 = "0biw882fp1lmgs6kpxznp1v6758r7dg9x8iv5a06k0b82bcdsc53"; }; diff --git a/pkgs/os-specific/linux/phc-intel/default.nix b/pkgs/os-specific/linux/phc-intel/default.nix index cc6ac64d58ad..68acbb83531e 100644 --- a/pkgs/os-specific/linux/phc-intel/default.nix +++ b/pkgs/os-specific/linux/phc-intel/default.nix @@ -1,6 +1,5 @@ { stdenv, fetchurl, kernel, which }: -assert stdenv.isLinux; # Don't bother with older versions, though some might even work: assert stdenv.lib.versionAtLeast kernel.version "4.10"; diff --git a/pkgs/os-specific/linux/pktgen/Makefile.patch b/pkgs/os-specific/linux/pktgen/Makefile.patch deleted file mode 100644 index da948bcc5a08..000000000000 --- a/pkgs/os-specific/linux/pktgen/Makefile.patch +++ /dev/null @@ -1,34 +0,0 @@ -diff --git a/app/Makefile b/app/Makefile -index 5078b9a..99b208a 100644 ---- a/app/Makefile -+++ b/app/Makefile -@@ -46,29 +46,10 @@ APP = pktgen - CFLAGS += -O3 -g $(WERROR_FLAGS) -fno-stack-protector - CFLAGS += -I$(RTE_SRCDIR) -I$(RTE_SRCDIR)/../lib/common - --dpdk_ver := $(RTE_SDK)/xusertools/dpdk-version.sh --pktgen_ver := $(RTE_SRCDIR)/../tools/dpdk-version.sh --ver_cmd := $(if $(wildcard $(dpdk_ver)),$(dpdk_ver),$(pktgen_ver)) --# $(info ver_cmd=$(ver_cmd)) -- --yy := $(shell $(ver_cmd) -yy) --# mm := $(shell $(ver_cmd) -mm) -- --# $(info yy=$(yy)) -- --ifeq ($(yy),17) - COMMON_PRE := $(RTE_SRCDIR)/../lib/common - LUA_PRE := $(RTE_SRCDIR)/../lib/lua/src - CLI_PRE := $(RTE_SRCDIR)/../lib/cli - GUI_PRE := $(RTE_SRCDIR)/../gui/gui --else --ifeq ($(yy),16) --COMMON_PRE := $(RTE_SRCDIR)/../lib/common/lib/common --LUA_PRE := $(RTE_SRCDIR)/../lib/lua/src/lib/lua/src --CLI_PRE := $(RTE_SRCDIR)/../lib/cli/lib/cli --GUI_PRE := $(RTE_SRCDIR)/../gui --endif --endif - - COMMON_LIB := $(COMMON_PRE)/$(RTE_TARGET) - LUA_LIB := $(LUA_PRE)/$(RTE_TARGET) diff --git a/pkgs/os-specific/linux/pktgen/default.nix b/pkgs/os-specific/linux/pktgen/default.nix index 9bc8967453b4..a7bb4a81510d 100644 --- a/pkgs/os-specific/linux/pktgen/default.nix +++ b/pkgs/os-specific/linux/pktgen/default.nix @@ -1,34 +1,48 @@ -{ stdenv, fetchurl, dpdk, libpcap, utillinux -, pkgconfig +{ stdenv, lib, fetchurl, pkgconfig +, dpdk, libpcap, numactl, utillinux , gtk2, withGtk ? false }: -stdenv.mkDerivation rec { +let + + # pktgen needs a specific version of lua to apply its patch (see lib/lua/Makefile). + lua = rec { + name = "lua-5.3.4"; + basename = name + ".tar.gz"; + src = fetchurl { + url = "https://www.lua.org/ftp/${basename}"; + sha256 = "0320a8dg3aci4hxla380dx1ifkw8gj4gbw5c4dz41g1kh98sm0gn"; + }; + }; + +in stdenv.mkDerivation rec { name = "pktgen-${version}"; - version = "3.4.0"; + version = "3.5.0"; src = fetchurl { - url = "http://dpdk.org/browse/apps/pktgen-dpdk/snapshot/pktgen-${version}.tar.gz"; - sha256 = "0fcyb56d4mkvchi5i8s3m210f5c3xa8zbjb08ranpa1a2k1kzfg5"; + url = "http://dpdk.org/browse/apps/pktgen-dpdk/snapshot/pktgen-${version}.tar.xz"; + sha256 = "1gy99jr9dbwzi9pd3w5k673h3pfnbkz6rbzmrkwcyis72pnphy5z"; }; nativeBuildInputs = stdenv.lib.optionals withGtk [ pkgconfig ]; buildInputs = - [ dpdk libpcap ] + [ dpdk libpcap numactl ] ++ stdenv.lib.optionals withGtk [gtk2]; - RTE_SDK = "${dpdk}"; + RTE_SDK = "${dpdk}/share/dpdk"; RTE_TARGET = "x86_64-native-linuxapp-gcc"; GUI = stdenv.lib.optionalString withGtk "true"; - NIX_CFLAGS_COMPILE = [ "-march=core2" ]; + NIX_CFLAGS_COMPILE = [ "-msse3" ]; - patches = [ ./Makefile.patch ]; - - postPatch = '' - substituteInPlace lib/lua/src/luaconf.h --replace /usr/local $out + postPatch = let dpdkMajor = lib.versions.major dpdk.version; in '' + substituteInPlace app/Makefile --replace 'yy :=' 'yy := ${dpdkMajor} #' substituteInPlace lib/common/lscpu.h --replace /usr/bin/lscpu ${utillinux}/bin/lscpu + + ln -s ${lua.src} lib/lua/${lua.basename} + make -C lib/lua get_tarball # unpack and patch + substituteInPlace lib/lua/${lua.name}/src/luaconf.h --replace /usr/local $out ''; installPhase = '' @@ -38,6 +52,8 @@ stdenv.mkDerivation rec { install -m 0644 Pktgen.lua $out/lib/lua/5.3 ''; + enableParallelBuilding = true; + meta = with stdenv.lib; { description = "Traffic generator powered by DPDK"; homepage = http://dpdk.org/; diff --git a/pkgs/os-specific/linux/plymouth/default.nix b/pkgs/os-specific/linux/plymouth/default.nix index 4d70533fac7f..88592798a1f6 100644 --- a/pkgs/os-specific/linux/plymouth/default.nix +++ b/pkgs/os-specific/linux/plymouth/default.nix @@ -7,7 +7,7 @@ stdenv.mkDerivation rec { version = "0.9.3"; src = fetchurl { - url = "http://www.freedesktop.org/software/plymouth/releases/${name}.tar.xz"; + url = "https://www.freedesktop.org/software/plymouth/releases/${name}.tar.xz"; sha256 = "0x2a9s5jdvfcrdnwbdhm5x4ck3zimmcpghnqvhl65byfj25d13cz"; }; diff --git a/pkgs/os-specific/linux/pm-utils/default.nix b/pkgs/os-specific/linux/pm-utils/default.nix index 1053e07559e8..326ba444957e 100644 --- a/pkgs/os-specific/linux/pm-utils/default.nix +++ b/pkgs/os-specific/linux/pm-utils/default.nix @@ -15,7 +15,7 @@ stdenv.mkDerivation rec { name = "pm-utils-1.4.1"; src = fetchurl { - url = "http://pm-utils.freedesktop.org/releases/${name}.tar.gz"; + url = "https://pm-utils.freedesktop.org/releases/${name}.tar.gz"; sha256 = "02qc6zaf7ams6qcc470fwb6jvr4abv3lrlx16clqpn36501rkn4f"; }; diff --git a/pkgs/os-specific/linux/pommed-light/default.nix b/pkgs/os-specific/linux/pommed-light/default.nix index a039984ff338..3ee5e312d233 100644 --- a/pkgs/os-specific/linux/pommed-light/default.nix +++ b/pkgs/os-specific/linux/pommed-light/default.nix @@ -12,13 +12,13 @@ stdenv.mkDerivation rec { pkgname = "pommed-light"; - version = "1.50lw"; + version = "1.51lw"; name = "${pkgname}-${version}"; src = fetchurl { url = "https://github.com/bytbox/${pkgname}/archive/v${version}.tar.gz"; - sha256 = "1r2f28zqmyvzgymd0ng53hscbrq8vcqhxdnkq5dppjf9yrzn018b"; + sha256 = "11wi17bh2br1hp8gmq40b1hm5drm6h969505f7432zam3cm8mc8q"; }; postPatch = '' @@ -59,7 +59,7 @@ stdenv.mkDerivation rec { and the like. ''; homepage = https://github.com/bytbox/pommed-light; - platforms = stdenv.lib.platforms.linux; + platforms = [ "x86_64-linux" ]; license = stdenv.lib.licenses.gpl2; }; } diff --git a/pkgs/os-specific/linux/powerstat/default.nix b/pkgs/os-specific/linux/powerstat/default.nix index 88151fca2f54..5408c4237ec4 100644 --- a/pkgs/os-specific/linux/powerstat/default.nix +++ b/pkgs/os-specific/linux/powerstat/default.nix @@ -2,10 +2,10 @@ stdenv.mkDerivation rec { name = "powerstat-${version}"; - version = "0.02.15"; + version = "0.02.17"; src = fetchurl { url = "http://kernel.ubuntu.com/~cking/tarballs/powerstat/powerstat-${version}.tar.gz"; - sha256 = "0m8662qv77nzbwkdpydiz87kd75cjjajgp30j6mc5padyw65bxxx"; + sha256 = "1lxzrvwlf6h35i0d8v1yj1ka63i9i0yvv3adhy3pa3fl8arpvycs"; }; installFlags = [ "DESTDIR=$(out)" ]; postInstall = '' diff --git a/pkgs/os-specific/linux/procps-ng/default.nix b/pkgs/os-specific/linux/procps-ng/default.nix index 316f0ad1a28d..bd69145521c1 100644 --- a/pkgs/os-specific/linux/procps-ng/default.nix +++ b/pkgs/os-specific/linux/procps-ng/default.nix @@ -1,38 +1,17 @@ -{ lib, stdenv, fetchFromGitLab, fetchpatch, ncurses, libtool, gettext, autoconf, automake, pkgconfig }: +{ lib, stdenv, fetchurl, ncurses, pkgconfig }: stdenv.mkDerivation rec { name = "procps-${version}"; - version = "3.3.13"; + version = "3.3.15"; - src = fetchFromGitLab { - owner ="procps-ng"; - repo = "procps"; - rev = "v${version}"; - sha256 = "0r3h9adhqi5fi62lx65z839fww35lfh2isnknhkaw71xndjpzr0q"; + # The project's releases are on SF, but git repo on gitlab. + src = fetchurl { + url = "mirror://sourceforge/procps-ng/procps-ng-${version}.tar.xz"; + sha256 = "0r84kwa5fl0sjdashcn4vh7hgfm7ahdcysig3mcjvpmkzi7p9g8h"; }; buildInputs = [ ncurses ]; - nativeBuildInputs = [ libtool gettext autoconf automake pkgconfig ]; - - # https://gitlab.com/procps-ng/procps/issues/88 - # Patches needed for musl and glibc 2.28 - patches = [ - (fetchpatch { - url = "https://gitlab.com/procps-ng/procps/uploads/f91ff094be1e4638aeffb67bdbb751ba/numa.h.diff"; - sha256 = "16r537d2wfrvbv6dg9vyfck8n31xa58903mnssw1s4kb5ap83yd5"; - extraPrefix = ""; - }) - (fetchpatch { - url = "https://gitlab.com/procps-ng/procps/uploads/6a7bdea4d82ba781451316fda74192ae/libio_detection.diff"; - sha256 = "0qp0j60kiycjsv213ih10imjirmxz8zja3rk9fq5lr5xf7k2lr3p"; - }) - ]; - - # autoreconfHook doesn't quite get, what procps-ng buildprocss does - # with po/Makefile.in.in and stuff. - preConfigure = '' - ./autogen.sh - ''; + nativeBuildInputs = [ pkgconfig ]; makeFlags = "usrbin_execdir=$(out)/bin"; diff --git a/pkgs/os-specific/linux/psmisc/default.nix b/pkgs/os-specific/linux/psmisc/default.nix index edc7220d6586..358fa700382f 100644 --- a/pkgs/os-specific/linux/psmisc/default.nix +++ b/pkgs/os-specific/linux/psmisc/default.nix @@ -1,7 +1,5 @@ {stdenv, fetchurl, ncurses}: -assert stdenv.isLinux; - stdenv.mkDerivation rec { name = "psmisc-23.1"; diff --git a/pkgs/os-specific/linux/s6-linux-utils/default.nix b/pkgs/os-specific/linux/s6-linux-utils/default.nix index db494ec2493f..f24d8d1f875c 100644 --- a/pkgs/os-specific/linux/s6-linux-utils/default.nix +++ b/pkgs/os-specific/linux/s6-linux-utils/default.nix @@ -9,7 +9,7 @@ in stdenv.mkDerivation rec { name = "s6-linux-utils-${version}"; src = fetchurl { - url = "http://www.skarnet.org/software/s6-linux-utils/${name}.tar.gz"; + url = "https://www.skarnet.org/software/s6-linux-utils/${name}.tar.gz"; sha256 = "0245rmk7wfyyfsi4g7f0niprwlvqlwkbyjxflb8kkbvhwfdavqip"; }; diff --git a/pkgs/os-specific/linux/smem/default.nix b/pkgs/os-specific/linux/smem/default.nix index a61a54afc38e..a07eec431c33 100644 --- a/pkgs/os-specific/linux/smem/default.nix +++ b/pkgs/os-specific/linux/smem/default.nix @@ -4,7 +4,7 @@ stdenv.mkDerivation rec { name = "smem-1.4"; src = fetchurl { - url = "http://www.selenic.com/smem/download/${name}.tar.gz"; + url = "https://www.selenic.com/smem/download/${name}.tar.gz"; sha256 = "1v31vy23s7szl6vdrllq9zbg58bp36jf5xy3fikjfg6gyiwgia9f"; }; diff --git a/pkgs/os-specific/linux/smemstat/default.nix b/pkgs/os-specific/linux/smemstat/default.nix index b4b8606197e8..c4d699c395e4 100644 --- a/pkgs/os-specific/linux/smemstat/default.nix +++ b/pkgs/os-specific/linux/smemstat/default.nix @@ -2,10 +2,10 @@ stdenv.mkDerivation rec { name = "smemstat-${version}"; - version = "0.01.18"; + version = "0.02.00"; src = fetchurl { url = "http://kernel.ubuntu.com/~cking/tarballs/smemstat/smemstat-${version}.tar.gz"; - sha256 = "0g262gilj2jk365wj4yl93ifppgvc9rx7dmlw6ychbv72v2pbv6w"; + sha256 = "16in8bzsrrcz7mc5qvyvjkxgpzz4bnq8zvkb7vsv6qfgyd3xr1dp"; }; buildInputs = [ ncurses ]; installFlags = [ "DESTDIR=$(out)" ]; diff --git a/pkgs/os-specific/linux/spl/default.nix b/pkgs/os-specific/linux/spl/default.nix index 7c37d18c8684..af3df245fe67 100644 --- a/pkgs/os-specific/linux/spl/default.nix +++ b/pkgs/os-specific/linux/spl/default.nix @@ -25,7 +25,7 @@ let nativeBuildInputs = [ autoreconfHook ] ++ kernel.moduleBuildDependencies; - hardeningDisable = [ "pic" ]; + hardeningDisable = [ "fortify" "stackprotector" "pic" ]; preConfigure = '' substituteInPlace ./module/spl/spl-generic.c --replace /usr/bin/hostid hostid @@ -62,15 +62,15 @@ in assert kernel != null; { splStable = common { - version = "0.7.8"; - sha256 = "0ypyy7ij280n7rly6ifrvna9k55gxwdx9a7lalf4r1ka714379fi"; - patches = [ ./install_prefix-0.7.8.patch ]; + version = "0.7.9"; + sha256 = "0540m1dv9jvrzk9kw61glg0h0cwj976mr9zb42y3nh17k47ywff0"; + patches = [ ./install_prefix-0.7.9.patch ]; }; splUnstable = common { - version = "2018-04-10"; - rev = "9125f8f5bdb36bfbd2d816d30b6b29b9f89ae3d8"; - sha256 = "00zrbca906rzjd62m4khiw3sdv8x18dapcmvkyaawripwvzc4iri"; + version = "2018-05-07"; + rev = "1149b62d20b7ed9d8ae25d5da7a06213d79b7602"; + sha256 = "07qlx7l23y696gzyy7ynly7n1141w66y21gkmxiia2xwldj8klkx"; patches = [ ./install_prefix.patch ]; }; diff --git a/pkgs/os-specific/linux/spl/install_prefix-0.7.8.patch b/pkgs/os-specific/linux/spl/install_prefix-0.7.9.patch index dc91392bd2fe..114ca1231470 100644 --- a/pkgs/os-specific/linux/spl/install_prefix-0.7.8.patch +++ b/pkgs/os-specific/linux/spl/install_prefix-0.7.9.patch @@ -112,18 +112,6 @@ index 581083e..0c35fb7 100644 +kerneldir = @prefix@/libexec/spl/include/sys/fs kernel_HEADERS = $(KERNEL_H) endif -diff --git a/include/sys/sysevent/Makefile.am b/include/sys/sysevent/Makefile.am -index 63d9af3..de1aa18 100644 ---- a/include/sys/sysevent/Makefile.am -+++ b/include/sys/sysevent/Makefile.am -@@ -8,6 +8,6 @@ USER_H = - EXTRA_DIST = $(COMMON_H) $(KERNEL_H) $(USER_H) - - if CONFIG_KERNEL --kerneldir = @prefix@/src/spl-$(VERSION)/include/sys/sysevent -+kerneldir = @prefix@/libexec/spl/include/sys/sysevent - kernel_HEADERS = $(KERNEL_H) - endif diff --git a/include/util/Makefile.am b/include/util/Makefile.am index e2bf09f..3f5d6ce 100644 --- a/include/util/Makefile.am diff --git a/pkgs/os-specific/linux/sssd/default.nix b/pkgs/os-specific/linux/sssd/default.nix index 3d89fdfdc281..bbc4bc7da464 100644 --- a/pkgs/os-specific/linux/sssd/default.nix +++ b/pkgs/os-specific/linux/sssd/default.nix @@ -11,11 +11,11 @@ let in stdenv.mkDerivation rec { name = "sssd-${version}"; - version = "1.16.1"; + version = "1.16.2"; src = fetchurl { url = "https://fedorahosted.org/released/sssd/${name}.tar.gz"; - sha256 = "0vjh1c5960wh86zjsamdjhljls7bb5fz5jpcazgzrpmga5w6ggrd"; + sha256 = "032ppk57qs1lnvz7pb7lw9ldwm9i1yagh9fzgqgn6na3bg61ynzy"; }; # Something is looking for <libxml/foo.h> instead of <libxml2/libxml/foo.h> diff --git a/pkgs/os-specific/linux/syslinux/default.nix b/pkgs/os-specific/linux/syslinux/default.nix index f1e5cc6e2625..8a87d3fce580 100644 --- a/pkgs/os-specific/linux/syslinux/default.nix +++ b/pkgs/os-specific/linux/syslinux/default.nix @@ -50,6 +50,9 @@ stdenv.mkDerivation rec { postInstall = '' wrapProgram $out/bin/syslinux \ --prefix PATH : "${mtools}/bin" + + # Delete com32 headers to save space, nobody seems to be using them + rm -rf $out/share/syslinux/com32 ''; meta = with stdenv.lib; { diff --git a/pkgs/os-specific/linux/sysstat/default.nix b/pkgs/os-specific/linux/sysstat/default.nix index db9f05f5f4d8..0da32371b351 100644 --- a/pkgs/os-specific/linux/sysstat/default.nix +++ b/pkgs/os-specific/linux/sysstat/default.nix @@ -1,11 +1,11 @@ { stdenv, fetchurl, gettext, bzip2 }: stdenv.mkDerivation rec { - name = "sysstat-11.7.3"; + name = "sysstat-11.7.4"; src = fetchurl { url = "http://perso.orange.fr/sebastien.godard/${name}.tar.xz"; - sha256 = "1sk6rhdqr8xsm456fkhkcmbnqgkymqqs3jkapcf8mrnsx36gz94f"; + sha256 = "144h5fb93s33w3pmgw7qadw1f7c4jq41m5lzcs49ihl44yi6aqm9"; }; buildInputs = [ gettext ]; diff --git a/pkgs/os-specific/linux/systemd/cryptsetup-generator.nix b/pkgs/os-specific/linux/systemd/cryptsetup-generator.nix index f69269347e37..720e3fbbc9fb 100644 --- a/pkgs/os-specific/linux/systemd/cryptsetup-generator.nix +++ b/pkgs/os-specific/linux/systemd/cryptsetup-generator.nix @@ -1,10 +1,8 @@ { stdenv, systemd, cryptsetup }: -assert stdenv.isLinux; - stdenv.lib.overrideDerivation systemd (p: { version = p.version; - name = "systemd-cryptsetup-generator"; + name = "systemd-cryptsetup-generator-${p.version}"; nativeBuildInputs = p.nativeBuildInputs ++ [ cryptsetup ]; outputs = [ "out" ]; @@ -13,6 +11,17 @@ stdenv.lib.overrideDerivation systemd (p: { ninja systemd-cryptsetup systemd-cryptsetup-generator ''; + # As ninja install is not used here, the rpath needs to be manually fixed. + # Otherwise the resulting binary doesn't properly link against systemd-shared.so + postFixup = '' + sharedLib=libsystemd-shared-${p.version}.so + for prog in `find $out -type f -executable`; do + (patchelf --print-needed $prog | grep $sharedLib > /dev/null) && ( + patchelf --set-rpath `patchelf --print-rpath $prog`:"$out/lib/systemd" $prog + ) || true + done + ''; + installPhase = '' mkdir -p $out/lib/systemd/ cp systemd-cryptsetup $out/lib/systemd/systemd-cryptsetup diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix index 615e4f867c4d..307ba9f43fa1 100644 --- a/pkgs/os-specific/linux/systemd/default.nix +++ b/pkgs/os-specific/linux/systemd/default.nix @@ -1,9 +1,9 @@ { stdenv, fetchFromGitHub, fetchpatch, pkgconfig, intltool, gperf, libcap, kmod , zlib, xz, pam, acl, cryptsetup, libuuid, m4, utillinux, libffi , glib, kbd, libxslt, coreutils, libgcrypt, libgpgerror, libidn2, libapparmor -, audit, lz4, bzip2, kexectools, libmicrohttpd +, audit, lz4, bzip2, libmicrohttpd, pcre2 , linuxHeaders ? stdenv.cc.libc.linuxHeaders -, libseccomp, iptables, gnu-efi +, iptables, gnu-efi , autoreconfHook, gettext, docbook_xsl, docbook_xml_dtd_42, docbook_xml_dtd_45 , ninja, meson, python3Packages, glibcLocales , patchelf @@ -11,10 +11,10 @@ , hostPlatform , buildPackages , withSelinux ? false, libselinux +, withLibseccomp ? libseccomp.meta.available, libseccomp +, withKexectools ? kexectools.meta.available, kexectools }: -assert stdenv.isLinux; - let pythonLxmlEnv = buildPackages.python3Packages.python.withPackages ( ps: with ps; [ python3Packages.lxml ]); @@ -43,14 +43,14 @@ in stdenv.mkDerivation rec { buildInputs = [ linuxHeaders libcap kmod xz pam acl /* cryptsetup */ libuuid glib libgcrypt libgpgerror libidn2 - libmicrohttpd ] ++ - stdenv.lib.meta.enableIfAvailable kexectools ++ - stdenv.lib.meta.enableIfAvailable libseccomp ++ + libmicrohttpd pcre2 ] ++ + stdenv.lib.optional withKexectools kexectools ++ + stdenv.lib.optional withLibseccomp libseccomp ++ [ libffi audit lz4 bzip2 libapparmor iptables gnu-efi # This is actually native, but we already pull it from buildPackages pythonLxmlEnv - ] ++ stdenv.lib.optionals withSelinux [ libselinux ]; + ] ++ stdenv.lib.optional withSelinux libselinux; #dontAddPrefix = true; @@ -101,20 +101,10 @@ in stdenv.mkDerivation rec { mesonFlagsArray+=(-Ddbussystemservicedir=$out/share/dbus-1/system-services) mesonFlagsArray+=(-Dpamconfdir=$out/etc/pam.d) mesonFlagsArray+=(-Drootprefix=$out) - mesonFlagsArray+=(-Dlibdir=$lib/lib) mesonFlagsArray+=(-Drootlibdir=$lib/lib) - mesonFlagsArray+=(-Dmandir=$man/lib) - mesonFlagsArray+=(-Dincludedir=$dev/include) mesonFlagsArray+=(-Dpkgconfiglibdir=$dev/lib/pkgconfig) mesonFlagsArray+=(-Dpkgconfigdatadir=$dev/share/pkgconfig) - # FIXME: Why aren't includedir and libdir picked up from mesonFlags while other options are? - substituteInPlace meson.build \ - --replace "includedir = join_paths(prefixdir, get_option('includedir'))" \ - "includedir = '$dev/include'" \ - --replace "libdir = join_paths(prefixdir, get_option('libdir'))" \ - "libdir = '$lib/lib'" - export LC_ALL="en_US.UTF-8"; # FIXME: patch this in systemd properly (and send upstream). # already fixed in f00929ad622c978f8ad83590a15a765b4beecac9: (u)mount @@ -155,6 +145,14 @@ in stdenv.mkDerivation rec { --replace "SYSTEMD_CGROUP_AGENT_PATH" "_SYSTEMD_CGROUP_AGENT_PATH" ''; + patches = [ + # https://github.com/systemd/systemd/pull/8580 + (fetchpatch { + url = https://github.com/systemd/systemd/pull/8580.patch; + sha256 = "1yp07hlpgqq0h2y0qc3kasswzkycz6p8d56d695ck1qa2f5bdfgn"; + }) + ]; + hardeningDisable = [ "stackprotector" ]; NIX_CFLAGS_COMPILE = @@ -170,6 +168,8 @@ in stdenv.mkDerivation rec { "-USYSTEMD_BINARY_PATH" "-DSYSTEMD_BINARY_PATH=\"/run/current-system/systemd/lib/systemd/systemd\"" ]; + doCheck = false; # fails a bunch of tests + postInstall = '' # sysinit.target: Don't depend on # systemd-tmpfiles-setup.service. This interferes with NixOps's diff --git a/pkgs/os-specific/linux/tbs/default.nix b/pkgs/os-specific/linux/tbs/default.nix new file mode 100644 index 000000000000..291666c0b450 --- /dev/null +++ b/pkgs/os-specific/linux/tbs/default.nix @@ -0,0 +1,63 @@ +{ stdenv, lib, fetchFromGitHub, kernel, kmod, perl, patchutils, perlPackages, libelf }: +let + + media = fetchFromGitHub rec { + name = repo; + owner = "tbsdtv"; + repo = "linux_media"; + rev = "efe31531b77efd3a4c94516504a5823d31cdc776"; + sha256 = "1533qi3sb91v00289hl5zaj4l35r2sf9fqc6z5ky1vbb7byxgnlr"; + }; + + build = fetchFromGitHub rec { + name = repo; + owner = "tbsdtv"; + repo = "media_build"; + rev = "a0d62eba4d429e0e9d2c2f910fb203e817cac84b"; + sha256 = "1329s7w9xlqjqwkpaqsd6b5dmzhm97jw0c7c7zzmmbdkl289i4i4"; + }; + +in stdenv.mkDerivation { + name = "tbs-2018.04.18-${kernel.version}"; + + srcs = [ media build ]; + sourceRoot = "${build.name}"; + + preConfigure = '' + make dir DIR=../${media.name} + ''; + + postPatch = '' + patchShebangs . + + sed -i v4l/Makefile \ + -i v4l/scripts/make_makefile.pl \ + -e 's,/sbin/depmod,${kmod}/bin/depmod,g' \ + -e 's,/sbin/lsmod,${kmod}/bin/lsmod,g' + + sed -i v4l/Makefile \ + -e 's,^OUTDIR ?= /lib/modules,OUTDIR ?= ${kernel.dev}/lib/modules,' \ + -e 's,^SRCDIR ?= /lib/modules,SRCDIR ?= ${kernel.dev}/lib/modules,' + ''; + + buildFlags = [ "VER=${kernel.modDirVersion}" ]; + installFlags = [ "DESTDIR=$(out)" ]; + + hardeningDisable = [ "all" ]; + + nativeBuildInputs = [ patchutils kmod perl perlPackages.ProcProcessTable ] + ++ kernel.moduleBuildDependencies; + + postInstall = '' + xz $out/lib/modules/${kernel.modDirVersion}/kernel/drivers/media/dvb-core/dvb-core.ko + xz $out/lib/modules/${kernel.modDirVersion}/kernel/drivers/media/v4l2-core/videodev.ko + ''; + + meta = with lib; { + homepage = https://www.tbsdtv.com/; + description = "Linux driver for TBSDTV cards"; + license = licenses.gpl2; + maintainers = with maintainers; [ ck3d ]; + priority = -1; + }; +} diff --git a/pkgs/os-specific/linux/tcp-wrappers/cdecls.patch b/pkgs/os-specific/linux/tcp-wrappers/cdecls.patch new file mode 100644 index 000000000000..eee640e8a824 --- /dev/null +++ b/pkgs/os-specific/linux/tcp-wrappers/cdecls.patch @@ -0,0 +1,31 @@ +__BEGIN_DECLS/__END_DECLS are BSD specific and not defined in musl +glibc and uclibc had sys/cdefs.h doing it. + +Upstream-Status: Pending +Signed-off-by: Khem Raj <raj.khem@gmail.com> + +Index: tcp_wrappers_7.6/tcpd.h +=================================================================== +--- tcp_wrappers_7.6.orig/tcpd.h ++++ tcp_wrappers_7.6/tcpd.h +@@ -11,7 +11,9 @@ + #include <netinet/in.h> + #include <stdio.h> + +-__BEGIN_DECLS ++#ifdef __cplusplus ++extern "C" { ++#endif + + /* Structure to describe one communications endpoint. */ + +@@ -252,6 +254,8 @@ extern char *fix_strtok(); + extern char *my_strtok(); + #endif + +-__END_DECLS ++#ifdef __cplusplus ++} ++#endif + + #endif diff --git a/pkgs/os-specific/linux/tcp-wrappers/default.nix b/pkgs/os-specific/linux/tcp-wrappers/default.nix index 7da4e39ca6c0..5df7bb827aad 100644 --- a/pkgs/os-specific/linux/tcp-wrappers/default.nix +++ b/pkgs/os-specific/linux/tcp-wrappers/default.nix @@ -20,11 +20,22 @@ in stdenv.mkDerivation rec { prePatch = '' tar -xaf $debian patches="$(cat debian/patches/series | sed 's,^,debian/patches/,') $patches" + + substituteInPlace Makefile --replace STRINGS STRINGDEFS + substituteInPlace debian/patches/13_shlib_weaksym --replace STRINGS STRINGDEFS + ''; + + # Fix __BEGIN_DECLS usage (even if it wasn't non-standard, this doesn't include sys/cdefs.h) + patches = [ ./cdecls.patch ]; + + postPatch = stdenv.lib.optionalString stdenv.hostPlatform.isMusl '' + substituteInPlace Makefile \ + --replace '-DNETGROUP' '-DUSE_GETDOMAIN' ''; buildInputs = [ libnsl ]; - makeFlags = [ "STRINGS=" "REAL_DAEMON_DIR=$(out)/bin" "linux" ]; + makeFlags = [ "REAL_DAEMON_DIR=$(out)/bin" "linux" "AR:=$(AR)" ]; installPhase = '' mkdir -p "$out/bin" diff --git a/pkgs/os-specific/linux/tcp-wrappers/tcp-wrappers-7.6-headers.patch b/pkgs/os-specific/linux/tcp-wrappers/tcp-wrappers-7.6-headers.patch new file mode 100644 index 000000000000..328a4a102618 --- /dev/null +++ b/pkgs/os-specific/linux/tcp-wrappers/tcp-wrappers-7.6-headers.patch @@ -0,0 +1,295 @@ +--- a/options.c ++++ b/options.c +@@ -34,6 +34,8 @@ + + /* System libraries. */ + ++#include <unistd.h> ++#include <stdlib.h> + #include <sys/types.h> + #include <sys/param.h> + #include <sys/socket.h> +--- a/safe_finger.c ++++ b/safe_finger.c +@@ -20,6 +20,11 @@ + + /* System libraries */ + ++#include <unistd.h> ++#include <fcntl.h> ++#include <stdlib.h> ++#include <sys/wait.h> ++#include <grp.h> + #include <sys/types.h> + #include <sys/stat.h> + #include <signal.h> +@@ -27,7 +31,7 @@ + #include <ctype.h> + #include <pwd.h> + +-extern void exit(); ++int pipe_stdin(char **argv); + + /* Local stuff */ + +--- a/scaffold.c ++++ b/scaffold.c +@@ -10,6 +10,7 @@ + + /* System libraries. */ + ++#include <stdlib.h> + #include <sys/types.h> + #include <sys/stat.h> + #include <sys/socket.h> +@@ -27,7 +27,4 @@ + #endif + +-#ifndef INET6 +-extern char *malloc(); +-#endif + + /* Application-specific. */ +--- a/shell_cmd.c ++++ b/shell_cmd.c +@@ -14,6 +14,10 @@ + + /* System libraries. */ + ++#include <unistd.h> ++#include <stdlib.h> ++#include <fcntl.h> ++#include <sys/wait.h> + #include <sys/types.h> + #include <sys/param.h> + #include <signal.h> +@@ -25,8 +25,6 @@ + #include <syslog.h> + #include <string.h> + +-extern void exit(); +- + /* Local stuff. */ + + #include "tcpd.h" +--- a/tcpdchk.c ++++ b/tcpdchk.c +@@ -20,6 +20,8 @@ + + /* System libraries. */ + ++#include <unistd.h> ++#include <stdlib.h> + #include <sys/types.h> + #include <sys/stat.h> + #ifdef INET6 +@@ -35,10 +36,7 @@ + #include <netdb.h> + #include <string.h> + +-extern int errno; +-extern void exit(); +-extern int optind; +-extern char *optarg; ++int cidr_mask_addr(char *str); + + #ifndef INADDR_NONE + #define INADDR_NONE (-1) /* XXX should be 0xffffffff */ +--- a/clean_exit.c ++++ b/clean_exit.c +@@ -13,8 +13,8 @@ + #endif + + #include <stdio.h> +- +-extern void exit(); ++#include <unistd.h> ++#include <stdlib.h> + + #include "tcpd.h" + +--- a/hosts_access.c ++++ b/hosts_access.c +@@ -23,6 +23,7 @@ + + /* System libraries. */ + ++#include <stdlib.h> + #include <sys/types.h> + #ifdef INT32_T + typedef uint32_t u_int32_t; +@@ -43,8 +44,8 @@ + #include <netdb.h> + #endif + +-extern char *fgets(); +-extern int errno; ++static int match_pattern_ylo(const char *s, const char *pattern); ++int cidr_mask_addr(char *str); + + #ifndef INADDR_NONE + #define INADDR_NONE (-1) /* XXX should be 0xffffffff */ +--- a/inetcf.c ++++ b/inetcf.c +@@ -9,15 +9,14 @@ + static char sccsid[] = "@(#) inetcf.c 1.7 97/02/12 02:13:23"; + #endif + ++#include <stdlib.h> + #include <sys/types.h> + #include <sys/stat.h> + #include <stdio.h> + #include <errno.h> + #include <string.h> + +-extern int errno; +-extern void exit(); +- ++#include "scaffold.h" + #include "tcpd.h" + #include "inetcf.h" + +--- a/percent_x.c ++++ b/percent_x.c +@@ -16,12 +16,12 @@ + + /* System libraries. */ + ++#include <unistd.h> ++#include <stdlib.h> + #include <stdio.h> + #include <syslog.h> + #include <string.h> + +-extern void exit(); +- + /* Local stuff. */ + + #include "tcpd.h" +--- a/rfc931.c ++++ b/rfc931.c +@@ -15,6 +15,7 @@ + + /* System libraries. */ + ++#include <unistd.h> + #include <stdio.h> + #include <syslog.h> + #include <sys/types.h> +--- a/tcpd.c ++++ b/tcpd.c +@@ -16,6 +16,7 @@ + + /* System libraries. */ + ++#include <unistd.h> + #include <sys/types.h> + #include <sys/param.h> + #include <sys/stat.h> +@@ -39,6 +39,8 @@ + #include "patchlevel.h" + #include "tcpd.h" + ++void fix_options(struct request_info *request); ++ + int allow_severity = SEVERITY; /* run-time adjustable */ + int deny_severity = LOG_WARNING; /* ditto */ + +--- a/tcpdmatch.c ++++ b/tcpdmatch.c +@@ -19,6 +19,8 @@ + + /* System libraries. */ + ++#include <unistd.h> ++#include <stdlib.h> + #include <sys/types.h> + #include <sys/stat.h> + #include <sys/socket.h> +@@ -30,9 +32,6 @@ + #include <setjmp.h> + #include <string.h> + +-extern void exit(); +-extern int optind; +-extern char *optarg; + + #ifndef INADDR_NONE + #define INADDR_NONE (-1) /* XXX should be 0xffffffff */ +--- a/update.c ++++ b/update.c +@@ -19,6 +19,7 @@ + + /* System libraries */ + ++#include <unistd.h> + #include <stdio.h> + #include <syslog.h> + #include <string.h> +--- a/misc.c ++++ b/misc.c +@@ -14,11 +14,10 @@ + #include <arpa/inet.h> + #include <stdio.h> + #include <string.h> ++#include <stdlib.h> + + #include "tcpd.h" + +-extern char *fgets(); +- + #ifndef INADDR_NONE + #define INADDR_NONE (-1) /* XXX should be 0xffffffff */ + #endif +--- a/fix_options.c ++++ b/fix_options.c +@@ -32,6 +32,7 @@ + + /* fix_options - get rid of IP-level socket options */ + ++void + fix_options(request) + struct request_info *request; + { +@@ -38,11 +38,8 @@ + #ifdef IP_OPTIONS + unsigned char optbuf[BUFFER_SIZE / 3], *cp; + char lbuf[BUFFER_SIZE], *lp; +-#ifdef __GLIBC__ +- size_t optsize = sizeof(optbuf), ipproto; +-#else +- int optsize = sizeof(optbuf), ipproto; +-#endif ++ socklen_t optsize = sizeof(optbuf); ++ int ipproto; + struct protoent *ip; + int fd = request->fd; + unsigned int opt; +--- a/socket.c ++++ b/socket.c +@@ -95,11 +95,7 @@ + static struct sockaddr_in client; + static struct sockaddr_in server; + #endif +-#ifdef __GLIBC__ +- size_t len; +-#else +- int len; +-#endif ++ socklen_t len; + char buf[BUFSIZ]; + int fd = request->fd; + +@@ -430,11 +426,7 @@ + #else + struct sockaddr_in sin; + #endif +-#ifdef __GLIBC__ +- size_t size = sizeof(sin); +-#else +- int size = sizeof(sin); +-#endif ++ socklen_t size; + + /* + * Eat up the not-yet received datagram. Some systems insist on a diff --git a/pkgs/os-specific/linux/tiscamera/allow-pipeline-stop-in-trigger-mode.patch b/pkgs/os-specific/linux/tiscamera/allow-pipeline-stop-in-trigger-mode.patch new file mode 100644 index 000000000000..48a520f6ec3a --- /dev/null +++ b/pkgs/os-specific/linux/tiscamera/allow-pipeline-stop-in-trigger-mode.patch @@ -0,0 +1,48 @@ +diff --git a/src/gstreamer-1.0/gsttcamsrc.cpp b/src/gstreamer-1.0/gsttcamsrc.cpp +index d482e1e..e36afd8 100644 +--- a/src/gstreamer-1.0/gsttcamsrc.cpp ++++ b/src/gstreamer-1.0/gsttcamsrc.cpp +@@ -1112,6 +1112,7 @@ bool gst_tcam_src_init_camera (GstTcamSrc* self) + + static void gst_tcam_src_close_camera (GstTcamSrc* self) + { ++ GST_INFO("Closing device"); + if (self->device != NULL) + { + self->device->dev->stop_stream(); +@@ -1156,7 +1157,7 @@ static gboolean gst_tcam_src_stop (GstBaseSrc* src) + + self->device->dev->stop_stream(); + gst_element_send_event(GST_ELEMENT(self), gst_event_new_eos()); +- GST_DEBUG_OBJECT (self, "Stopped acquisition"); ++ GST_DEBUG("Stopped acquisition"); + + return TRUE; + } +@@ -1556,6 +1557,18 @@ static void gst_tcam_src_get_property (GObject* object, + } + + ++static gboolean gst_tcam_src_unlock (GstBaseSrc* src) ++{ ++ GstTcamSrc* self = GST_TCAM_SRC(src); ++ ++ self->is_running = FALSE; ++ ++ self->cv.notify_all(); ++ ++ return TRUE; ++} ++ ++ + static void gst_tcam_src_class_init (GstTcamSrcClass* klass) + { + GObjectClass *gobject_class = G_OBJECT_CLASS (klass); +@@ -1616,6 +1629,7 @@ static void gst_tcam_src_class_init (GstTcamSrcClass* klass) + gstbasesrc_class->fixate = gst_tcam_src_fixate_caps; + gstbasesrc_class->start = gst_tcam_src_start; + gstbasesrc_class->stop = gst_tcam_src_stop; ++ gstbasesrc_class->unlock = gst_tcam_src_unlock; + gstbasesrc_class->negotiate = gst_tcam_src_negotiate; + gstbasesrc_class->get_times = gst_tcam_src_get_times; + diff --git a/pkgs/os-specific/linux/tiscamera/default.nix b/pkgs/os-specific/linux/tiscamera/default.nix new file mode 100644 index 000000000000..d4d6ae18ce62 --- /dev/null +++ b/pkgs/os-specific/linux/tiscamera/default.nix @@ -0,0 +1,98 @@ +{ lib +, stdenv +, fetchFromGitHub +, cmake +, pkgconfig +, pcre +, tinyxml +, libusb1 +, libzip +, glib +, gobjectIntrospection +, gst_all_1 +, libwebcam +}: + +stdenv.mkDerivation rec { + pname = "tiscamera"; + version = "0.9.1"; + name = "${pname}-${version}"; + + src = fetchFromGitHub { + owner = "TheImagingSource"; + repo = pname; + rev = "v-${name}"; + sha256 = "143yp6bpzj3rqfnrcnlrcwggay37fg6rkphh4w9y9v7v4wllzf87"; + }; + + nativeBuildInputs = [ + cmake + pkgconfig + ]; + + buildInputs = [ + pcre + tinyxml + libusb1 + libzip + glib + gobjectIntrospection + gst_all_1.gstreamer + gst_all_1.gst-plugins-base + libwebcam + ]; + + + cmakeFlags = [ + "-DBUILD_ARAVIS=OFF" # For GigE support. Won't need it as our camera is usb. + "-DBUILD_GST_1_0=ON" + "-DBUILD_TOOLS=ON" + "-DBUILD_V4L2=ON" + "-DBUILD_LIBUSB=ON" + ]; + + + patches = [ + ./allow-pipeline-stop-in-trigger-mode.patch # To be removed next release. + ]; + + postPatch = '' + substituteInPlace ./data/udev/80-theimagingsource-cameras.rules \ + --replace "/usr/bin/uvcdynctrl" "${libwebcam}/bin/uvcdynctrl" \ + --replace "/path/to/tiscamera/uvc-extensions" "$out/share/uvcdynctrl/data/199e" + + substituteInPlace ./src/BackendLoader.cpp \ + --replace '"libtcam-v4l2.so"' "\"$out/lib/tcam-0/libtcam-v4l2.so\"" \ + --replace '"libtcam-aravis.so"' "\"$out/lib/tcam-0/libtcam-aravis.so\"" \ + --replace '"libtcam-libusb.so"' "\"$out/lib/tcam-0/libtcam-libusb.so\"" + ''; + + preConfigure = '' + cmakeFlagsArray=( + $cmakeFlagsArray + "-DCMAKE_INSTALL_PREFIX=$out" + "-DTCAM_INSTALL_UDEV=$out/lib/udev/rules.d" + "-DTCAM_INSTALL_UVCDYNCTRL=$out/share/uvcdynctrl/data/199e" + "-DTCAM_INSTALL_GST_1_0=$out/lib/gstreamer-1.0" + "-DTCAM_INSTALL_GIR=$out/share/gir-1.0" + "-DTCAM_INSTALL_TYPELIB=$out/lib/girepository-1.0" + "-DTCAM_INSTALL_SYSTEMD=$out/etc/systemd/system" + ) + ''; + + + # There are gobject introspection commands launched as part of the build. Those have a runtime + # dependency on `libtcam` (which itself is built as part of this build). In order to allow + # that, we set the dynamic linker's path to point on the build time location of the library. + preBuild = '' + export LD_LIBRARY_PATH=$PWD/src:$LD_LIBRARY_PATH + ''; + + meta = with lib; { + description = "The Linux sources and UVC firmwares for The Imaging Source cameras"; + homepage = https://github.com/TheImagingSource/tiscamera; + license = with licenses; [ asl20 ]; + platforms = platforms.linux; + maintainers = with maintainers; [ jraygauthier ]; + }; +} \ No newline at end of file diff --git a/pkgs/os-specific/linux/tmon/default.nix b/pkgs/os-specific/linux/tmon/default.nix index 01c84a1d1faa..690eb8b2eabb 100644 --- a/pkgs/os-specific/linux/tmon/default.nix +++ b/pkgs/os-specific/linux/tmon/default.nix @@ -12,6 +12,7 @@ stdenv.mkDerivation { ''; makeFlags = kernel.makeFlags ++ [ "INSTALL_ROOT=\"$(out)\"" "BINDIR=bin" ]; + NIX_CFLAGS_LINK = "-lgcc_s"; enableParallelBuilding = true; diff --git a/pkgs/os-specific/linux/uclibc/default.nix b/pkgs/os-specific/linux/uclibc/default.nix index 180aabc94cc6..3da12c41dc12 100644 --- a/pkgs/os-specific/linux/uclibc/default.nix +++ b/pkgs/os-specific/linux/uclibc/default.nix @@ -1,8 +1,8 @@ -{stdenv, fetchzip, linuxHeaders, libiconvReal, cross ? null, gccCross ? null, -extraConfig ? ""}: - -assert stdenv.isLinux; -assert cross != null -> gccCross != null; +{ stdenv, buildPackages +, fetchurl, linuxHeaders, libiconvReal +, buildPlatform, hostPlatform +, extraConfig ? "" +}: let configParser = '' @@ -28,9 +28,6 @@ let } ''; - archMakeFlag = if cross != null then "ARCH=${cross.arch}" else ""; - crossMakeFlag = if cross != null then "CROSS=${cross.config}-" else ""; - # UCLIBC_SUSV4_LEGACY defines 'tmpnam', needed for gcc libstdc++ builds. nixConfig = '' RUNTIME_PREFIX "/" @@ -43,7 +40,7 @@ let UCLIBC_SUSV4_LEGACY y UCLIBC_HAS_THREADS_NATIVE y KERNEL_HEADERS "${linuxHeaders}/include" - '' + stdenv.lib.optionalString (stdenv.isAarch32 && cross == null) '' + '' + stdenv.lib.optionalString (stdenv.isAarch32 && buildPlatform != hostPlatform) '' CONFIG_ARM_EABI y ARCH_WANTS_BIG_ENDIAN n ARCH_BIG_ENDIAN n @@ -52,29 +49,27 @@ let UCLIBC_HAS_FPU n ''; - name = "uclibc-0.9.34-pre-20150131"; - rev = "343f6b8f1f754e397632b0552e4afe586c8b392b"; - + version = "1.0.30"; in stdenv.mkDerivation { - name = name + stdenv.lib.optionalString (cross != null) ("-" + cross.config); + name = "uclibc-ng-${version}"; + inherit version; - src = fetchzip { - name = name + "-source"; - url = "http://git.uclibc.org/uClibc/snapshot/uClibc-${rev}.tar.bz2"; - sha256 = "1kgylzpid7da5i7wz7slh5q9rnq1m8bv5h9ilm76g0xwc2iwlhbw"; + src = fetchurl { + url = "https://downloads.uclibc-ng.org/releases/${version}/uClibc-ng-${version}.tar.bz2"; + # from "${url}.sha256"; + sha256 = "3e0f057f24882823d697126015aa4d7d48fa2542be3939985cb3c26dcbcab5a8"; }; # 'ftw' needed to build acl, a coreutils dependency configurePhase = '' - make defconfig ${archMakeFlag} + make defconfig ${configParser} cat << EOF | parseconfig ${nixConfig} ${extraConfig} - ${if cross != null then stdenv.lib.attrByPath [ "uclibc" "extraConfig" ] "" cross else ""} - $extraCrossConfig + ${hostPlatform.platform.uclibc.extraConfig or ""} EOF ( set +o pipefail; yes "" | make oldconfig ) ''; @@ -82,11 +77,16 @@ stdenv.mkDerivation { hardeningDisable = [ "stackprotector" ]; # Cross stripping hurts. - dontStrip = cross != null; + dontStrip = stdenv.hostPlatform != stdenv.buildPlatform; - makeFlags = [ crossMakeFlag "VERBOSE=1" ]; + depsBuildBuild = [ buildPackages.stdenv.cc ]; - buildInputs = stdenv.lib.optional (gccCross != null) gccCross; + makeFlags = [ + "ARCH=${hostPlatform.parsed.cpu.name}" + "VERBOSE=1" + ] ++ stdenv.lib.optionals (stdenv.buildPlatform != stdenv.hostPlatform) [ + "CROSS=${stdenv.cc.targetPrefix}" + ]; # `make libpthread/nptl/sysdeps/unix/sysv/linux/lowlevelrwlock.h`: # error: bits/sysnum.h: No such file or directory @@ -94,7 +94,7 @@ stdenv.mkDerivation { installPhase = '' mkdir -p $out - make PREFIX=$out VERBOSE=1 install ${crossMakeFlag} + make PREFIX=$out VERBOSE=1 install (cd $out/include && ln -s $(ls -d ${linuxHeaders}/include/* | grep -v "scsi$") .) # libpthread.so may not exist, so I do || true sed -i s@/lib/@$out/lib/@g $out/lib/libc.so $out/lib/libpthread.so || true @@ -106,10 +106,10 @@ stdenv.mkDerivation { }; meta = with stdenv.lib; { - homepage = http://www.uclibc.org/; + homepage = "https://uclibc-ng.org"; description = "A small implementation of the C library"; maintainers = with maintainers; [ rasendubi ]; license = licenses.lgpl2; - platforms = subtractLists ["aarch64-linux"] platforms.linux; + platforms = platforms.linux; }; } diff --git a/pkgs/os-specific/linux/udisks/1-default.nix b/pkgs/os-specific/linux/udisks/1-default.nix index aeb9deac89d2..199523db4281 100644 --- a/pkgs/os-specific/linux/udisks/1-default.nix +++ b/pkgs/os-specific/linux/udisks/1-default.nix @@ -6,7 +6,7 @@ stdenv.mkDerivation rec { name = "udisks-1.0.5"; src = fetchurl { - url = "http://hal.freedesktop.org/releases/${name}.tar.gz"; + url = "https://hal.freedesktop.org/releases/${name}.tar.gz"; sha256 = "0wbg3jrv8limdgvcygf4dqin3y6d30y9pcmmk711vq571vmq5v7j"; }; diff --git a/pkgs/os-specific/linux/udisks/2-default.nix b/pkgs/os-specific/linux/udisks/2-default.nix index 1c8e429c9455..0c0aa84a6bd3 100644 --- a/pkgs/os-specific/linux/udisks/2-default.nix +++ b/pkgs/os-specific/linux/udisks/2-default.nix @@ -1,43 +1,61 @@ -{ stdenv, fetchurl, pkgconfig, intltool, gnused -, expat, acl, systemd, glib, libatasmart, polkit -, libxslt, docbook_xsl, utillinux, mdadm, libgudev -, gobjectIntrospection +{ stdenv, fetchFromGitHub, substituteAll, libtool, pkgconfig, intltool, gnused +, gnome3, gtk-doc, acl, systemd, glib, libatasmart, polkit, coreutils, bash +, expat, libxslt, docbook_xsl, utillinux, mdadm, libgudev, libblockdev, parted +, gobjectIntrospection, docbook_xml_dtd_412, docbook_xml_dtd_43 +, libxfs, f2fs-tools, dosfstools, e2fsprogs, btrfs-progs, exfat, nilfs-utils, udftools, ntfs3g }: -stdenv.mkDerivation rec { - name = "udisks-2.1.8"; +let + version = "2.7.6"; +in stdenv.mkDerivation rec { + name = "udisks-${version}"; - src = fetchurl { - url = "http://udisks.freedesktop.org/releases/${name}.tar.bz2"; - sha256 = "1nkxhnqh39c9pzvm4zfj50rgv6apqawdx09bv3sfaxrah4a6jhfs"; + src = fetchFromGitHub { + owner = "storaged-project"; + repo = "udisks"; + rev = name; + sha256 = "16kf104vv2xbk8cdgaqygszcl69d7lz9gf3vmi7ggywn7nfbp2ks"; }; - outputs = [ "out" "man" "dev" ]; - - patches = [ ./force-path.patch ]; - - # FIXME remove /var/run/current-system/sw/* references - # FIXME add references to parted, cryptsetup, etc (see the sources) - postPatch = - '' - substituteInPlace src/main.c --replace \ - "@path@" \ - "${utillinux}/bin:${mdadm}/bin:/run/current-system/sw/bin" - substituteInPlace data/80-udisks2.rules \ - --replace "/bin/sh" "${stdenv.shell}" \ - --replace "/sbin/mdadm" "${mdadm}/bin/mdadm" \ - --replace " sed " " ${gnused}/bin/sed " - '' + stdenv.lib.optionalString stdenv.hostPlatform.isMusl '' + outputs = [ "out" "man" "dev" "devdoc" ]; + + patches = [ + (substituteAll { + src = ./fix-paths.patch; + bash = "${bash}/bin/bash"; + blkid = "${utillinux}/bin/blkid"; + false = "${coreutils}/bin/false"; + mdadm = "${mdadm}/bin/mdadm"; + sed = "${gnused}/bin/sed"; + sh = "${bash}/bin/sh"; + sleep = "${coreutils}/bin/sleep"; + true = "${coreutils}/bin/true"; + }) + (substituteAll { + src = ./force-path.patch; + path = stdenv.lib.makeBinPath [ btrfs-progs coreutils dosfstools e2fsprogs exfat f2fs-tools nilfs-utils libxfs ntfs3g parted utillinux ]; + }) + ]; + + nativeBuildInputs = [ + pkgconfig gnome3.gnome-common libtool intltool gobjectIntrospection + gtk-doc libxslt docbook_xml_dtd_412 docbook_xml_dtd_43 docbook_xsl + ]; + + postPatch = stdenv.lib.optionalString stdenv.hostPlatform.isMusl '' substituteInPlace udisks/udisksclient.c \ --replace 'defined( __GNUC_PREREQ)' 1 \ --replace '__GNUC_PREREQ(4,6)' 1 ''; - nativeBuildInputs = [ pkgconfig intltool gobjectIntrospection ]; + buildInputs = [ + expat libgudev libblockdev acl systemd glib libatasmart polkit + ]; - buildInputs = [ libxslt docbook_xsl libgudev expat acl systemd glib libatasmart polkit ]; + preConfigure = "./autogen.sh"; configureFlags = [ + "--enable-gtk-doc" "--localstatedir=/var" "--with-systemdsystemunitdir=$(out)/etc/systemd/system" "--with-udevdir=$(out)/lib/udev" @@ -48,9 +66,13 @@ stdenv.mkDerivation rec { "INTROSPECTION_TYPELIBDIR=$(out)/lib/girepository-1.0" ]; - meta = { - homepage = http://www.freedesktop.org/wiki/Software/udisks; - description = "A daemon and command-line utility for querying and manipulating storage devices"; - platforms = stdenv.lib.platforms.linux; + doCheck = false; # fails + + meta = with stdenv.lib; { + description = "A daemon, tools and libraries to access and manipulate disks, storage devices and technologies"; + homepage = https://www.freedesktop.org/wiki/Software/udisks/; + license = licenses.gpl2Plus; # lgpl2Plus for the library, gpl2Plus for the tools & daemon + maintainers = with maintainers; []; + platforms = platforms.linux; }; } diff --git a/pkgs/os-specific/linux/udisks/fix-paths.patch b/pkgs/os-specific/linux/udisks/fix-paths.patch new file mode 100644 index 000000000000..c2744c3b42e1 --- /dev/null +++ b/pkgs/os-specific/linux/udisks/fix-paths.patch @@ -0,0 +1,131 @@ +--- a/Makefile.am ++++ b/Makefile.am +@@ -1,6 +1,6 @@ + ## Process this file with automake to produce Makefile.in + +-SHELL = /bin/bash ++SHELL = @bash@ + .SHELLFLAGS = -o pipefail -c + + PYTHON ?= python3 +--- a/data/80-udisks2.rules ++++ b/data/80-udisks2.rules +@@ -17,9 +17,9 @@ + # + # TODO: file bug against mdadm(8) to have --export-prefix option that can be used with e.g. UDISKS_MD_MEMBER + # +-SUBSYSTEM=="block", ENV{ID_FS_USAGE}=="raid", ENV{ID_FS_TYPE}=="linux_raid_member", ENV{UDISKS_MD_MEMBER_LEVEL}=="", IMPORT{program}="/bin/sh -c '/sbin/mdadm --examine --export $tempnode | /bin/sed s/^MD_/UDISKS_MD_MEMBER_/g'" ++SUBSYSTEM=="block", ENV{ID_FS_USAGE}=="raid", ENV{ID_FS_TYPE}=="linux_raid_member", ENV{UDISKS_MD_MEMBER_LEVEL}=="", IMPORT{program}="@sh@ -c '@mdadm@ --examine --export $tempnode | @sed@ s/^MD_/UDISKS_MD_MEMBER_/g'" + +-SUBSYSTEM=="block", KERNEL=="md*", ENV{DEVTYPE}!="partition", IMPORT{program}="/bin/sh -c '/sbin/mdadm --detail --export $tempnode | /bin/sed s/^MD_/UDISKS_MD_/g'" ++SUBSYSTEM=="block", KERNEL=="md*", ENV{DEVTYPE}!="partition", IMPORT{program}="@sh@ -c '@mdadm@ --detail --export $tempnode | @sed@ s/^MD_/UDISKS_MD_/g'" + + LABEL="udisks_probe_end" + +--- a/modules/zram/udiskslinuxmanagerzram.c ++++ b/modules/zram/udiskslinuxmanagerzram.c +@@ -250,7 +250,7 @@ + + g_snprintf (tmp, 255, "zram%" G_GUINT64_FORMAT, i); + filename = g_build_filename (PACKAGE_ZRAMCONF_DIR, tmp, NULL); +- contents = g_strdup_printf ("#!/bin/bash\n\n" ++ contents = g_strdup_printf ("#!@bash@\n\n" + "ZRAM_NUM_STR=%" G_GUINT64_FORMAT "\n" + "ZRAM_DEV_SIZE=%" G_GUINT64_FORMAT "\n" + "SWAP=n\n", +--- a/src/tests/install-udisks/runtest.sh ++++ b/src/tests/install-udisks/runtest.sh +@@ -1,4 +1,4 @@ +-#!/bin/bash ++#!@bash@ + # vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k + # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + # +--- a/src/tests/integration-test ++++ b/src/tests/integration-test +@@ -414,7 +414,7 @@ + f.write('KERNEL=="sr*", ENV{DISK_EJECT_REQUEST}!="?*", ' + 'ATTRS{model}=="scsi_debug*", ' + 'ENV{ID_CDROM_MEDIA}=="?*", ' +- 'IMPORT{program}="/sbin/blkid -o udev -p -u noraid $tempnode"\n') ++ 'IMPORT{program}="@blkid@ -o udev -p -u noraid $tempnode"\n') + # reload udev + subprocess.call('sync; pkill --signal HUP udevd || ' + 'pkill --signal HUP systemd-udevd', +@@ -1079,7 +1079,7 @@ + self.assertFalse(os.access(f, os.X_OK)) + + f = os.path.join(mount_point, 'simple.exe') +- shutil.copy('/bin/bash', f) ++ shutil.copy('@bash@', f) + self.assertTrue(os.access(f, os.R_OK)) + self.assertTrue(os.access(f, os.W_OK)) + self.assertTrue(os.access(f, os.X_OK)) +@@ -1092,7 +1092,7 @@ + self.assertFalse(os.access(f, os.X_OK)) + + f = os.path.join(mount_point, 'subdir', 'subdir.exe') +- shutil.copy('/bin/bash', f) ++ shutil.copy('@bash@', f) + self.assertTrue(os.access(f, os.R_OK)) + self.assertTrue(os.access(f, os.W_OK)) + self.assertTrue(os.access(f, os.X_OK)) +--- a/src/tests/storadectl/runtest.sh ++++ b/src/tests/storadectl/runtest.sh +@@ -1,4 +1,4 @@ +-#!/bin/bash ++#!@bash@ + # vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k + # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + # +--- a/src/tests/test.c ++++ b/src/tests/test.c +@@ -71,7 +71,7 @@ + { + UDisksSpawnedJob *job; + +- job = udisks_spawned_job_new ("/bin/true", NULL, getuid (), geteuid (), NULL, NULL); ++ job = udisks_spawned_job_new ("@true@", NULL, getuid (), geteuid (), NULL, NULL); + udisks_spawned_job_start (job); + _g_assert_signal_received (job, "completed", G_CALLBACK (on_completed_expect_success), NULL); + g_object_unref (job); +@@ -84,10 +84,10 @@ + { + UDisksSpawnedJob *job; + +- job = udisks_spawned_job_new ("/bin/false", NULL, getuid (), geteuid (), NULL, NULL); ++ job = udisks_spawned_job_new ("@false@", NULL, getuid (), geteuid (), NULL, NULL); + udisks_spawned_job_start (job); + _g_assert_signal_received (job, "completed", G_CALLBACK (on_completed_expect_failure), +- (gpointer) "Command-line `/bin/false' exited with non-zero exit status 1: "); ++ (gpointer) "Command-line `@false@' exited with non-zero exit status 1: "); + g_object_unref (job); + } + +@@ -119,7 +119,7 @@ + + cancellable = g_cancellable_new (); + g_cancellable_cancel (cancellable); +- job = udisks_spawned_job_new ("/bin/true", NULL, getuid (), geteuid (), NULL, cancellable); ++ job = udisks_spawned_job_new ("@true@", NULL, getuid (), geteuid (), NULL, cancellable); + udisks_spawned_job_start (job); + _g_assert_signal_received (job, "completed", G_CALLBACK (on_completed_expect_failure), + (gpointer) "Operation was cancelled (g-io-error-quark, 19)"); +@@ -145,7 +145,7 @@ + GCancellable *cancellable; + + cancellable = g_cancellable_new (); +- job = udisks_spawned_job_new ("/bin/sleep 0.5", NULL, getuid (), geteuid (), NULL, cancellable); ++ job = udisks_spawned_job_new ("@sleep@ 0.5", NULL, getuid (), geteuid (), NULL, cancellable); + udisks_spawned_job_start (job); + g_timeout_add (10, on_timeout, cancellable); /* 10 msec */ + g_main_loop_run (loop); +@@ -199,7 +199,7 @@ + { + UDisksSpawnedJob *job; + +- job = udisks_spawned_job_new ("/bin/sleep 1000", NULL, getuid (), geteuid (), NULL, NULL /* GCancellable */); ++ job = udisks_spawned_job_new ("@sleep@ 1000", NULL, getuid (), geteuid (), NULL, NULL /* GCancellable */); + udisks_spawned_job_start (job); + g_object_unref (job); + } diff --git a/pkgs/os-specific/linux/upower/default.nix b/pkgs/os-specific/linux/upower/default.nix index 713ef974f9fb..1e9101b68afe 100644 --- a/pkgs/os-specific/linux/upower/default.nix +++ b/pkgs/os-specific/linux/upower/default.nix @@ -3,8 +3,6 @@ , useSystemd ? true, systemd, gobjectIntrospection }: -assert stdenv.isLinux; - stdenv.mkDerivation rec { name = "upower-0.99.7"; @@ -30,6 +28,8 @@ stdenv.mkDerivation rec { NIX_CFLAGS_LINK = "-lgcc_s"; + doCheck = false; # fails with "env: './linux/integration-test': No such file or directory" + installFlags = "historydir=$(TMPDIR)/foo"; meta = { diff --git a/pkgs/os-specific/linux/usbutils/default.nix b/pkgs/os-specific/linux/usbutils/default.nix index 31e4a3dd26f6..adb2a0ee2fb1 100644 --- a/pkgs/os-specific/linux/usbutils/default.nix +++ b/pkgs/os-specific/linux/usbutils/default.nix @@ -1,11 +1,11 @@ { stdenv, fetchurl, pkgconfig, libusb1, hwdata }: stdenv.mkDerivation rec { - name = "usbutils-009"; + name = "usbutils-010"; src = fetchurl { url = "mirror://kernel/linux/utils/usb/usbutils/${name}.tar.xz"; - sha256 = "0q3iavmak2bs9xw486w4xfbjl0hbzii93ssgpr95mxmm9kjz1gwb"; + sha256 = "06aag4jfgsfjxk563xsp9ik9nadihmasrr37a1gb0vwqni5kdiv1"; }; nativeBuildInputs = [ pkgconfig ]; diff --git a/pkgs/os-specific/linux/util-linux/default.nix b/pkgs/os-specific/linux/util-linux/default.nix index 618ba42e7416..9ec6c22d32a5 100644 --- a/pkgs/os-specific/linux/util-linux/default.nix +++ b/pkgs/os-specific/linux/util-linux/default.nix @@ -4,15 +4,15 @@ let version = lib.concatStringsSep "." ([ majorVersion ] ++ lib.optional (patchVersion != "") patchVersion); - majorVersion = "2.31"; - patchVersion = "1"; + majorVersion = "2.32"; + patchVersion = ""; in stdenv.mkDerivation rec { name = "util-linux-${version}"; src = fetchurl { url = "mirror://kernel/linux/utils/util-linux/v${majorVersion}/${name}.tar.xz"; - sha256 = "04fzrnrr3pvqskvjn9f81y0knh0jvvqx4lmbz5pd4lfdm5pv2l8s"; + sha256 = "0d2758kjll5xqm5fpp3sww1h66aahx161sf2b60jxqv4qymrfwvc"; }; patches = [ diff --git a/pkgs/os-specific/linux/v4l-utils/default.nix b/pkgs/os-specific/linux/v4l-utils/default.nix index 84b31d4d516b..fee9b0c09d56 100644 --- a/pkgs/os-specific/linux/v4l-utils/default.nix +++ b/pkgs/os-specific/linux/v4l-utils/default.nix @@ -8,11 +8,11 @@ stdenv.mkDerivation rec { name = "v4l-utils-${version}"; - version = "1.12.3"; + version = "1.14.2"; src = fetchurl { - url = "http://linuxtv.org/downloads/v4l-utils/${name}.tar.bz2"; - sha256 = "0vpl3jl0x441y7b5cn7zhdsyi954hp9h2p30jhnr1zkx1rpxsiss"; + url = "https://linuxtv.org/downloads/v4l-utils/${name}.tar.bz2"; + sha256 = "14h6d2p3n4jmxhd8i0p1m5dbwz5vnpb3z88xqd9ghg15n7265fg6"; }; outputs = [ "out" "dev" ]; diff --git a/pkgs/os-specific/linux/wireguard/default.nix b/pkgs/os-specific/linux/wireguard/default.nix index b88646424be5..42982d49ce87 100644 --- a/pkgs/os-specific/linux/wireguard/default.nix +++ b/pkgs/os-specific/linux/wireguard/default.nix @@ -1,73 +1,31 @@ -{ stdenv, fetchurl, libmnl, kernel ? null }: +{ stdenv, fetchzip, kernel, wireguard-tools }: # module requires Linux >= 3.10 https://www.wireguard.io/install/#kernel-requirements -assert kernel != null -> stdenv.lib.versionAtLeast kernel.version "3.10"; +assert stdenv.lib.versionAtLeast kernel.version "3.10"; -let +stdenv.mkDerivation rec { name = "wireguard-${version}"; + inherit (wireguard-tools) src version; - version = "0.0.20180413"; + preConfigure = '' + cd src + sed -i '/depmod/,+1d' Makefile + ''; - src = fetchurl { - url = "https://git.zx2c4.com/WireGuard/snapshot/WireGuard-${version}.tar.xz"; - sha256 = "0lbjx62ihc8prqfhvmi0v1xq1q3ayzj5rfy2p5149nr9qx3z37j1"; - }; - - meta = with stdenv.lib; { - homepage = https://www.wireguard.com/; - downloadPage = https://git.zx2c4.com/WireGuard/refs/; - description = "A prerelease of an experimental VPN tunnel which is not to be depended upon for security"; - maintainers = with maintainers; [ ericsagnes mic92 zx2c4 ]; - license = licenses.gpl2; - platforms = platforms.linux; - }; - - module = stdenv.mkDerivation { - inherit src meta name; - - preConfigure = '' - cd src - sed -i '/depmod/,+1d' Makefile - ''; - - hardeningDisable = [ "pic" ]; - - KERNELDIR = "${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"; - INSTALL_MOD_PATH = "\${out}"; + hardeningDisable = [ "pic" ]; - NIX_CFLAGS = ["-Wno-error=cpp"]; + KERNELDIR = "${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"; + INSTALL_MOD_PATH = "\${out}"; - nativeBuildInputs = kernel.moduleBuildDependencies; + NIX_CFLAGS = ["-Wno-error=cpp"]; - buildPhase = "make module"; - }; - - tools = stdenv.mkDerivation { - inherit src meta name; - - preConfigure = "cd src"; - - buildInputs = [ libmnl ]; + nativeBuildInputs = kernel.moduleBuildDependencies; - enableParallelBuilding = true; + buildPhase = "make module"; - makeFlags = [ - "WITH_BASHCOMPLETION=yes" - "WITH_WGQUICK=yes" - "WITH_SYSTEMDUNITS=yes" - "DESTDIR=$(out)" - "PREFIX=/" - "-C" "tools" - ]; - - buildPhase = "make tools"; - - postInstall = '' - substituteInPlace $out/lib/systemd/system/wg-quick@.service \ - --replace /usr/bin $out/bin - ''; + meta = with stdenv.lib; { + inherit (wireguard-tools.meta) homepage license maintainers; + description = "Kernel module for the WireGuard secure network tunnel"; + platforms = platforms.linux; }; - -in if kernel == null - then tools - else module +} diff --git a/pkgs/os-specific/linux/xf86-input-multitouch/default.nix b/pkgs/os-specific/linux/xf86-input-multitouch/default.nix index e1bafa93ea6f..527471bad328 100644 --- a/pkgs/os-specific/linux/xf86-input-multitouch/default.nix +++ b/pkgs/os-specific/linux/xf86-input-multitouch/default.nix @@ -11,8 +11,6 @@ , libpciaccess }: -assert stdenv.isLinux; - stdenv.mkDerivation { name = "xf86-input-multitouch-20110312"; diff --git a/pkgs/os-specific/linux/zfs/default.nix b/pkgs/os-specific/linux/zfs/default.nix index bdc43a092f7f..6eac54ddf651 100644 --- a/pkgs/os-specific/linux/zfs/default.nix +++ b/pkgs/os-specific/linux/zfs/default.nix @@ -6,6 +6,7 @@ , zlib, libuuid, python, attr, openssl , libtirpc , nfs-utils +, gawk, gnugrep, gnused, systemd # Kernel dependencies , kernel ? null, spl ? null, splUnstable ? null, splLegacyCrypto ? null @@ -60,7 +61,7 @@ let # for zdb to get the rpath to libgcc_s, needed for pthread_cancel to work NIX_CFLAGS_LINK = "-lgcc_s"; - hardeningDisable = [ "pic" ]; + hardeningDisable = [ "fortify" "stackprotector" "pic" ]; preConfigure = '' substituteInPlace ./module/zfs/zfs_ctldir.c --replace "umount -t zfs" "${utillinux}/bin/umount -t zfs" @@ -76,12 +77,15 @@ let substituteInPlace ./cmd/zed/Makefile.am --replace "\$(sysconfdir)" "$out/etc" substituteInPlace ./module/Makefile.in --replace "/bin/cp" "cp" substituteInPlace ./etc/systemd/system/zfs-share.service.in \ - --replace "@bindir@/rm " "${coreutils}/bin/rm " + --replace "/bin/rm " "${coreutils}/bin/rm " for f in ./udev/rules.d/* do substituteInPlace "$f" --replace "/lib/udev/vdev_id" "$out/lib/udev/vdev_id" done + substituteInPlace ./cmd/vdev_id/vdev_id \ + --replace "PATH=/bin:/sbin:/usr/bin:/usr/sbin" \ + "PATH=${makeBinPath [ coreutils gawk gnused gnugrep systemd ]}" ./autogen.sh configureFlagsArray+=("--libexecdir=$out/libexec") @@ -153,12 +157,12 @@ in { # to be adapted zfsStable = common { # comment/uncomment if breaking kernel versions are known - incompatibleKernelVersion = "4.16"; + incompatibleKernelVersion = null; # this package should point to the latest release. - version = "0.7.8"; + version = "0.7.9"; - sha256 = "0m7j5cpz81lqcfbh4w3wvqjjka07wickl27klgy1zplv6vr0baix"; + sha256 = "0krpxrvnda2jx6l71xhw9fsksyp2a6h9l9asppac3szsd1n7fp9n"; extraPatches = [ (fetchpatch { @@ -172,13 +176,13 @@ in { zfsUnstable = common rec { # comment/uncomment if breaking kernel versions are known - incompatibleKernelVersion = "4.16"; + incompatibleKernelVersion = null; # this package should point to a version / git revision compatible with the latest kernel release - version = "2018-04-10"; + version = "2018-05-22"; - rev = "74df0c5e251a920a1966a011c16f960cd7ba562e"; - sha256 = "1x3mipj3ryznnd7kx84r3n607hv6jqs66mb61g3zcdmvk6al4yq4"; + rev = "ba863d0be4cbfbea938b10e49fb6ff459ac9ec20"; + sha256 = "11dhigw1gybalwg2m6si148b6w195dj2lw38snqf6576wb5zndd0"; isUnstable = true; extraPatches = [ @@ -195,7 +199,7 @@ in { # also remove boot.zfs.enableLegacyCrypto zfsLegacyCrypto = common { # comment/uncomment if breaking kernel versions are known - incompatibleKernelVersion = "4.16"; + incompatibleKernelVersion = null; # this package should point to a version / git revision compatible with the latest kernel release version = "2018-02-01"; |