From d539a4a7e4239f0da1fdd5e4fd9e74767c54c7fb Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fabi=C3=A1n=20Heredia=20Montiel?= Date: Sat, 14 Dec 2024 09:43:58 -0600 Subject: [PATCH] linux/hardened/patches/6.12: init at v6.12.4-hardened1 --- nixos/tests/kernel-generic.nix | 1 + pkgs/os-specific/linux/kernel/common-config.nix | 7 ++++--- pkgs/os-specific/linux/kernel/hardened/config.nix | 5 +++++ pkgs/os-specific/linux/kernel/hardened/patches.json | 10 ++++++++++ pkgs/top-level/all-packages.nix | 2 ++ pkgs/top-level/linux-kernels.nix | 2 ++ 6 files changed, 24 insertions(+), 3 deletions(-) diff --git a/nixos/tests/kernel-generic.nix b/nixos/tests/kernel-generic.nix index fca4b4f4fe80..de0f016dbcce 100644 --- a/nixos/tests/kernel-generic.nix +++ b/nixos/tests/kernel-generic.nix @@ -41,6 +41,7 @@ let linux_6_1_hardened linux_6_6_hardened linux_6_11_hardened + linux_6_12_hardened linux_rt_5_4 linux_rt_5_10 linux_rt_5_15 diff --git a/pkgs/os-specific/linux/kernel/common-config.nix b/pkgs/os-specific/linux/kernel/common-config.nix index f1abc7cab3fe..e6528bd2583b 100644 --- a/pkgs/os-specific/linux/kernel/common-config.nix +++ b/pkgs/os-specific/linux/kernel/common-config.nix @@ -531,15 +531,16 @@ let }; # Enable Rust and features that depend on it + # Use a lower priority to allow these options to be overridden in hardened/config.nix rust = lib.optionalAttrs withRust { - RUST = yes; + RUST = lib.mkDefault yes; # These don't technically require Rust but we probably want to get some more testing # on the whole DRM panic setup before shipping it by default. DRM_PANIC = whenAtLeast "6.12" yes; DRM_PANIC_SCREEN = whenAtLeast "6.12" (freeform "kmsg"); - DRM_PANIC_SCREEN_QR_CODE = whenAtLeast "6.12" yes; + DRM_PANIC_SCREEN_QR_CODE = lib.mkDefault (whenAtLeast "6.12" yes); }; sound = @@ -1255,7 +1256,7 @@ let LIRC = yes; SCHED_CORE = whenAtLeast "5.14" yes; - SCHED_CLASS_EXT = whenAtLeast "6.12" yes; + SCHED_CLASS_EXT = lib.mkDefault (whenAtLeast "6.12" yes); LRU_GEN = whenAtLeast "6.1" yes; LRU_GEN_ENABLED = whenAtLeast "6.1" yes; diff --git a/pkgs/os-specific/linux/kernel/hardened/config.nix b/pkgs/os-specific/linux/kernel/hardened/config.nix index b3c1d8e45bea..f098cf375c9d 100644 --- a/pkgs/os-specific/linux/kernel/hardened/config.nix +++ b/pkgs/os-specific/linux/kernel/hardened/config.nix @@ -38,6 +38,8 @@ assert (lib.versionAtLeast version "4.9"); DEBUG_PLIST = whenAtLeast "5.2" yes; DEBUG_SG = yes; DEBUG_VIRTUAL = yes; + # Set in common config as whenAtLeast "6.12" yes; Currently errors during config + SCHED_CLASS_EXT = whenAtLeast "6.12" (option yes); SCHED_STACK_END_CHECK = yes; REFCOUNT_FULL = whenOlder "5.4.208" yes; @@ -116,4 +118,7 @@ assert (lib.versionAtLeast version "4.9"); # not needed for less than a decade old glibc versions LEGACY_VSYSCALL_NONE = yes; + + RUST = option yes; # Yes currently erros on 6.12 + DRM_PANIC_SCREEN_QR_CODE = whenAtLeast "6.12" (option yes); } diff --git a/pkgs/os-specific/linux/kernel/hardened/patches.json b/pkgs/os-specific/linux/kernel/hardened/patches.json index b924a1267b63..f2dd29cc2101 100644 --- a/pkgs/os-specific/linux/kernel/hardened/patches.json +++ b/pkgs/os-specific/linux/kernel/hardened/patches.json @@ -49,6 +49,16 @@ "sha256": "1z2913y38clnlmhvwj49h7p4pic24s4d8np7nmd4lk7m2xz8w532", "version": "6.11.11" }, + "6.12": { + "patch": { + "extra": "-hardened1", + "name": "linux-hardened-v6.12.4-hardened1.patch", + "sha256": "0807n36inzq82m8m279q6sfnh7cn2nwkqnf6hi5kw9k9z0x20a8l", + "url": "https://github.com/anthraxx/linux-hardened/releases/download/v6.12.4-hardened1/linux-hardened-v6.12.4-hardened1.patch" + }, + "sha256": "0lhisw9sy0b38j1nifcgjm8w9864qx3hg6b7f6z2311x8chzhdbg", + "version": "6.12.4" + }, "6.6": { "patch": { "extra": "-hardened1", diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix index 26b3134c0623..abee01b6e0ee 100644 --- a/pkgs/top-level/all-packages.nix +++ b/pkgs/top-level/all-packages.nix @@ -12436,6 +12436,8 @@ with pkgs; linux_6_6_hardened = linuxKernel.kernels.linux_6_6_hardened; linuxPackages_6_11_hardened = linuxKernel.packages.linux_6_11_hardened; linux_6_11_hardened = linuxKernel.kernels.linux_6_11_hardened; + linuxPackages_6_12_hardened = linuxKernel.packages.linux_6_12_hardened; + linux_6_12_hardened = linuxKernel.kernels.linux_6_12_hardened; # GNU Linux-libre kernels linuxPackages-libre = linuxKernel.packages.linux_libre; diff --git a/pkgs/top-level/linux-kernels.nix b/pkgs/top-level/linux-kernels.nix index dede77df2bef..25459aef3509 100644 --- a/pkgs/top-level/linux-kernels.nix +++ b/pkgs/top-level/linux-kernels.nix @@ -276,6 +276,7 @@ in { linux_6_1_hardened = hardenedKernelFor kernels.linux_6_1 { }; linux_6_6_hardened = hardenedKernelFor kernels.linux_6_6 { }; linux_6_11_hardened = hardenedKernelFor kernels.linux_6_11 { }; + linux_6_12_hardened = hardenedKernelFor kernels.linux_6_12 { }; } // lib.optionalAttrs config.allowAliases { linux_4_14 = throw "linux 4.14 was removed because it will reach its end of life within 23.11"; @@ -675,6 +676,7 @@ in { linux_6_1_hardened = recurseIntoAttrs (packagesFor kernels.linux_6_1_hardened); linux_6_6_hardened = recurseIntoAttrs (packagesFor kernels.linux_6_6_hardened); linux_6_11_hardened = recurseIntoAttrs (packagesFor kernels.linux_6_11_hardened); + linux_6_12_hardened = recurseIntoAttrs (packagesFor kernels.linux_6_12_hardened); linux_zen = recurseIntoAttrs (packagesFor kernels.linux_zen); linux_lqx = recurseIntoAttrs (packagesFor kernels.linux_lqx);