From: Prarit Bhargava on gitlab.com
Merge Request: https://gitlab.com/cki-project/kernel-ark/-/merge_requests/3867
Add a new Python tool for managing kernel CONFIG_* settings in the
redhat/configs directory.
The tool helps maintainers verify and manage kernel configuration options by:
- Analyzing configuration layering and priorities defined in priority.* files
- Identifying and removing redundant CONFIG settings
- Moving common settings between rhel and fedora to the common directory
- Providing detailed analysis of CONFIG values across variants and
architectures
The tool supports several operations:
- Show CONFIG values across all variants (-c/--config)
- Remove redundant CONFIGs (-f/--fix)
- Move common settings to common directory (-j/--common)
- Debug output (-d/--debug)
- List all locations of a CONFIG (-l/--list)
Also add comprehensive documentation in README.evaluate_configs explaining the
tool's
usage, options, and examples.
Signed-off-by: Prarit Bhargava <prarit(a)redhat.com>
---
redhat/configs/README.evaluate_configs | 182 ++---
redhat/configs/evaluate_configs | 981 ---------------------------------
redhat/configs/evaluate_configs.py | 634 +++++++++++++++++++++
3 files changed, 708 insertions(+), 1089 deletions(-)
From: Thomas Huth on gitlab.com
Merge Request: https://gitlab.com/cki-project/kernel-ark/-/merge_requests/3865
While working on a backport to RHEL-9 (https://gitlab.com/redhat/centos-
stream/src/kernel/centos-stream-9/-/merge_requests/6695), we noticed that some
options are still set in a non-optimal way in the ARK kernel:
1. The CONFIG_AP_DEBUG switch can be consolidated between RHEL and Fedora, and
we should make sure that it resides in a s390x sub-folder.
2. We should make explicitly sure that CONFIG_VIRTIO_MEM is disabled on ppc64
in RHEL - if we want to enable it, it should be done consciously in the
future.
Signed-off-by: Thomas Huth <thuth(a)redhat.com>
---
redhat/configs/fedora/generic/s390x/CONFIG_AP_DEBUG => redhat/configs/common/generic/s390x/CONFIG_AP_DEBUG | 0
redhat/configs/rhel/generic/powerpc/CONFIG_VIRTIO_MEM | 1 +
redhat/configs/rhel/generic/CONFIG_AP_DEBUG | 1 -
3 files changed, 1 insertions(+), 1 deletions(-)
From: Souradeep Chowdhury <quic_schowdhu(a)quicinc.com>
Fedora: arm: Updates for QCom devices
Enable these two configs for Qualcomm rb3gen2 boards
as a part of arm system ready. These configs are required
for proper booting of the fedora image.
Signed-off-by: Souradeep Chowdhury <quic_schowdhu(a)quicinc.com>
diff --git a/redhat/configs/fedora/generic/arm/aarch64/CONFIG_INTERCONNECT_QCOM_SC7280 b/redhat/configs/fedora/generic/arm/aarch64/CONFIG_INTERCONNECT_QCOM_SC7280
index blahblah..blahblah 100644
--- a/redhat/configs/fedora/generic/arm/aarch64/CONFIG_INTERCONNECT_QCOM_SC7280
+++ b/redhat/configs/fedora/generic/arm/aarch64/CONFIG_INTERCONNECT_QCOM_SC7280
@@ -1 +1 @@
-CONFIG_INTERCONNECT_QCOM_SC7280=m
+CONFIG_INTERCONNECT_QCOM_SC7280=y
diff --git a/redhat/configs/fedora/generic/arm/aarch64/CONFIG_PINCTRL_SC7280 b/redhat/configs/fedora/generic/arm/aarch64/CONFIG_PINCTRL_SC7280
index blahblah..blahblah 100644
--- a/redhat/configs/fedora/generic/arm/aarch64/CONFIG_PINCTRL_SC7280
+++ b/redhat/configs/fedora/generic/arm/aarch64/CONFIG_PINCTRL_SC7280
@@ -1 +1 @@
-CONFIG_PINCTRL_SC7280=m
+CONFIG_PINCTRL_SC7280=y
--
https://gitlab.com/cki-project/kernel-ark/-/merge_requests/3852
From: Fedora Kernel Team <kernel-team(a)fedoraproject.org>
[redhat] New configs in arch/x86
Hi,
As part of the ongoing rebase effort, the following configuration
options need to be reviewed.
As a reminder, the ARK configuration flow involves moving unreviewed
configuration options from the pending directory to the ark directory.
In the diff below, options are removed from the pending directory and
added to the ark hierarchy. The final options that need to be ACKed
are the files that are being added to the ark hierarchy.
If the value for a file that is added should be changed, please reply
with a better option.
Symbol: MITIGATION_ITS [=y]
Type : bool
Defined at arch/x86/Kconfig:2714
Prompt: Enable Indirect Target Selection mitigation
Depends on: CPU_MITIGATIONS [=y] && CPU_SUP_INTEL [=y] && X86_64 [=y] && MITIGATION_RETPOLINE [=y] && MITIGATION_RETHUNK [=y]
Location:
-> Mitigations for CPU vulnerabilities (CPU_MITIGATIONS [=y])
-> Enable Indirect Target Selection mitigation (MITIGATION_ITS [=y])
Selects: EXECMEM [=y]
Commit: 8754e67ad4ac (x86/its: Add support for ITS-safe indirect thunk)
---
Signed-off-by: Fedora Kernel Team <kernel-team(a)fedoraproject.org>
diff --git a/redhat/configs/pending-rhel/generic/CONFIG_MITIGATION_ITS b/redhat/configs/pending-rhel/generic/CONFIG_MITIGATION_ITS
deleted file mode 100644
index blahblah..blahblah 0
--- a/redhat/configs/pending-rhel/generic/CONFIG_MITIGATION_ITS
+++ /dev/null
@@ -1,14 +0,0 @@
-# Symbol: MITIGATION_ITS [=y]
-# Type : bool
-# Defined at arch/x86/Kconfig:2714
-# Prompt: Enable Indirect Target Selection mitigation
-# Depends on: CPU_MITIGATIONS [=y] && CPU_SUP_INTEL [=y] && X86_64 [=y] && MITIGATION_RETPOLINE [=y] && MITIGATION_RETHUNK [=y]
-# Location:
-# -> Mitigations for CPU vulnerabilities (CPU_MITIGATIONS [=y])
-# -> Enable Indirect Target Selection mitigation (MITIGATION_ITS [=y])
-# Selects: EXECMEM [=y]
-#
-#
-#
-# Commit: 8754e67ad4ac (x86/its: Add support for ITS-safe indirect thunk)
-CONFIG_MITIGATION_ITS=y
diff --git a/redhat/configs/rhel/generic/CONFIG_MITIGATION_ITS b/redhat/configs/rhel/generic/CONFIG_MITIGATION_ITS
new file mode 100644
index blahblah..blahblah 100644
--- /dev/null
+++ b/redhat/configs/rhel/generic/CONFIG_MITIGATION_ITS
@@ -0,0 +1 @@
+CONFIG_MITIGATION_ITS=y
--
https://gitlab.com/cki-project/kernel-ark/-/merge_requests/3866
Hi, we tested your kernel and here are the results:
Overall result: PASSED
Merge: OK
Compile: OK
Test: OK
Tested-by: CKI Project <cki-project(a)redhat.com>
Kernel information:
Brew / Koji Task ID: 132519718
You can find all the details about the test run at
https://datawarehouse.cki-project.org/kcidb/checkouts/redhat:koji-132519718
Tests that were not ran because of internal issues:
Boot test [s390x]
CKI/restraint [s390x]
machineinfo [s390x]
Reboot test [s390x]
SELinux Custom Module Setup [s390x]
stress: stress-ng - cpu [s390x]
stress: stress-ng - cpu-cache [s390x]
stress: stress-ng - interrupt [s390x]
stress: stress-ng - memory [s390x]
If you find a failure unrelated to your changes, please ask the test maintainer to review it.
This will prevent the failures from being incorrectly reported in the future.
Please reply to this email if you have any questions about the tests that we
ran or if you have any suggestions on how to make future tests more effective.
,-. ,-.
( C ) ( K ) Continuous
`-',-.`-' Kernel
( I ) Integration
`-'
______________________________________________________________________________
From: Jeremy Cline on gitlab.com
Merge Request: https://gitlab.com/cki-project/kernel-ark/-/merge_requests/3862
JIRA: https://issues.redhat.com/browse/RHEL-82437
There is RHEL/Fedora specific functionality on x86 and other arches which
enables extra kernel lockdowns
when booted by secureboot. Let's do the same for arm now that secureboot is
working.
This is a rebase of the patch set from Mark that's been submitted for [RHEL
10](https://gitlab.com/redhat/centos-stream/src/kernel/centos-
stream-10/-/merge_requests/609) and [RHEL 9](https://gitlab.com/redhat/centos-
stream/src/kernel/centos-stream-9/-/merge_requests/5192), but which I don't
see in ARK. In particular, I'm interested in getting this into Fedora since,
although we do not currently sign aarch64 for SecureBoot, we're working on
getting the infrastructure ready for that. In the mean time, carrying this
patch is useful for folks who build and sign their own aarch64 kernels.
I hope I'm not stepping on Mark's toes here, I figured the easiest place to
ask about plans for it in Fedora/ARK was in a PR to add it.
Signed-off-by: Mark Salter <msalter(a)redhat.com>
Signed-off-by: Jeremy Cline <jeremycline(a)linux.microsoft.com>
---
arch/arm64/kernel/setup.c | 27 ++++++++++
drivers/firmware/efi/libstub/fdt.c | 5 +
drivers/firmware/efi/libstub/secureboot.c | 14 +++-
redhat/configs/common/generic/arm/aarch64/CONFIG_LOCK_DOWN_IN_EFI_SECURE_BOOT | 1 +
4 files changed, 43 insertions(+), 4 deletions(-)