* [PATCH] MODSIGN: Change default key details [ver #2] @ 2015-04-30 13:58 David Howells 2015-04-30 14:39 ` Sedat Dilek 0 siblings, 1 reply; 44+ messages in thread From: David Howells @ 2015-04-30 13:58 UTC (permalink / raw) To: torvalds Cc: keyrings, rusty, linux-kernel, dhowells, linux-security-module, James Morris, sedat.dilek Change default key details to be more obviously unspecified. Reported-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: David Howells <dhowells@redhat.com> Acked-by: James Morris <james.l.morris@oracle.com> --- Documentation/module-signing.txt | 6 +++--- kernel/Makefile | 6 +++--- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/Documentation/module-signing.txt b/Documentation/module-signing.txt index 09c2382ad055..c72702ec1ded 100644 --- a/Documentation/module-signing.txt +++ b/Documentation/module-signing.txt @@ -119,9 +119,9 @@ Most notably, in the x509.genkey file, the req_distinguished_name section should be altered from the default: [ req_distinguished_name ] - O = Magrathea - CN = Glacier signing key - emailAddress = slartibartfast@magrathea.h2g2 + #O = Unspecified company + CN = Build time autogenerated kernel key + #emailAddress = unspecified.user@unspecified.company The generated RSA key size can also be set with: diff --git a/kernel/Makefile b/kernel/Makefile index 0f8f8b0bc1bf..60c302cfb4d3 100644 --- a/kernel/Makefile +++ b/kernel/Makefile @@ -197,9 +197,9 @@ x509.genkey: @echo >>x509.genkey "x509_extensions = myexts" @echo >>x509.genkey @echo >>x509.genkey "[ req_distinguished_name ]" - @echo >>x509.genkey "O = Magrathea" - @echo >>x509.genkey "CN = Glacier signing key" - @echo >>x509.genkey "emailAddress = slartibartfast@magrathea.h2g2" + @echo >>x509.genkey "#O = Unspecified company" + @echo >>x509.genkey "CN = Build time autogenerated kernel key" + @echo >>x509.genkey "#emailAddress = unspecified.user@unspecified.company" @echo >>x509.genkey @echo >>x509.genkey "[ myexts ]" @echo >>x509.genkey "basicConstraints=critical,CA:FALSE" ^ permalink raw reply related [flat|nested] 44+ messages in thread
* Re: [PATCH] MODSIGN: Change default key details [ver #2] 2015-04-30 13:58 [PATCH] MODSIGN: Change default key details [ver #2] David Howells @ 2015-04-30 14:39 ` Sedat Dilek 2015-04-30 14:50 ` David Howells 0 siblings, 1 reply; 44+ messages in thread From: Sedat Dilek @ 2015-04-30 14:39 UTC (permalink / raw) To: David Howells Cc: Linus Torvalds, keyrings, Rusty Russell, LKML, linux-security-module, James Morris, Greg Kroah-Hartman [-- Attachment #1: Type: text/plain, Size: 3220 bytes --] On Thu, Apr 30, 2015 at 3:58 PM, David Howells <dhowells@redhat.com> wrote: > Change default key details to be more obviously unspecified. > > Reported-by: Linus Torvalds <torvalds@linux-foundation.org> > Signed-off-by: David Howells <dhowells@redhat.com> > Acked-by: James Morris <james.l.morris@oracle.com> > --- > > Documentation/module-signing.txt | 6 +++--- > kernel/Makefile | 6 +++--- > 2 files changed, 6 insertions(+), 6 deletions(-) > > diff --git a/Documentation/module-signing.txt b/Documentation/module-signing.txt > index 09c2382ad055..c72702ec1ded 100644 > --- a/Documentation/module-signing.txt > +++ b/Documentation/module-signing.txt > @@ -119,9 +119,9 @@ Most notably, in the x509.genkey file, the req_distinguished_name section > should be altered from the default: > > [ req_distinguished_name ] > - O = Magrathea > - CN = Glacier signing key > - emailAddress = slartibartfast@magrathea.h2g2 > + #O = Unspecified company > + CN = Build time autogenerated kernel key > + #emailAddress = unspecified.user@unspecified.company > > The generated RSA key size can also be set with: > > diff --git a/kernel/Makefile b/kernel/Makefile > index 0f8f8b0bc1bf..60c302cfb4d3 100644 > --- a/kernel/Makefile > +++ b/kernel/Makefile > @@ -197,9 +197,9 @@ x509.genkey: > @echo >>x509.genkey "x509_extensions = myexts" > @echo >>x509.genkey > @echo >>x509.genkey "[ req_distinguished_name ]" > - @echo >>x509.genkey "O = Magrathea" > - @echo >>x509.genkey "CN = Glacier signing key" > - @echo >>x509.genkey "emailAddress = slartibartfast@magrathea.h2g2" > + @echo >>x509.genkey "#O = Unspecified company" > + @echo >>x509.genkey "CN = Build time autogenerated kernel key" > + @echo >>x509.genkey "#emailAddress = unspecified.user@unspecified.company" > @echo >>x509.genkey > @echo >>x509.genkey "[ myexts ]" > @echo >>x509.genkey "basicConstraints=critical,CA:FALSE" > [ CC Greg ] Thanks for considering me. I reported missing generated files in the "module signature" area. >From [1]... [ 2.117022] Request for unknown module key 'Magrathea: Glacier signing key: 009aa341bb673735a51dc34b238a0ca481d68098' err -11 [ 2.117114] mii: module verification failed: signature and/or required key missing - tainting kernel This happened a 2nd time with a different kernel-series! Not sure why this was the case. It did not happen when rebuilding with the same kernel-config again. Not sure if parallel-make-jobs might be a cause for this (see attached build-script). $ egrep -i 'signature|module_sig' /boot/config-4.0.1-1-iniza-small | grep ^CONFIG CONFIG_MODULE_SIG=y CONFIG_MODULE_SIG_ALL=y CONFIG_MODULE_SIG_SHA512=y CONFIG_MODULE_SIG_HASH="sha512" CONFIG_INTEGRITY_SIGNATURE=y CONFIG_SIGNATURE=y For my quick builds of rcN Linux-kernels I normally do not need signing my modules. I really do not use it (it's taken from the Ubuntu kernel-settings). Attached is my simple build-script for generating Debian/Ubuntu kernel packages via builddeb script. If you have any ideas/hints please let me know. - Sedat - [1] https://lkml.org/lkml/2015/2/9/396 [-- Attachment #2: config-4.0.1-1-iniza-small --] [-- Type: application/octet-stream, Size: 125201 bytes --] # # Automatically generated file; DO NOT EDIT. # Linux/x86 4.0.1 Kernel Configuration # CONFIG_64BIT=y CONFIG_X86_64=y CONFIG_X86=y CONFIG_INSTRUCTION_DECODER=y CONFIG_PERF_EVENTS_INTEL_UNCORE=y CONFIG_OUTPUT_FORMAT="elf64-x86-64" CONFIG_ARCH_DEFCONFIG="arch/x86/configs/x86_64_defconfig" CONFIG_LOCKDEP_SUPPORT=y CONFIG_STACKTRACE_SUPPORT=y CONFIG_HAVE_LATENCYTOP_SUPPORT=y CONFIG_MMU=y CONFIG_NEED_DMA_MAP_STATE=y CONFIG_NEED_SG_DMA_LENGTH=y CONFIG_GENERIC_ISA_DMA=y CONFIG_GENERIC_BUG=y CONFIG_GENERIC_BUG_RELATIVE_POINTERS=y CONFIG_GENERIC_HWEIGHT=y CONFIG_ARCH_MAY_HAVE_PC_FDC=y CONFIG_RWSEM_XCHGADD_ALGORITHM=y CONFIG_GENERIC_CALIBRATE_DELAY=y CONFIG_ARCH_HAS_CPU_RELAX=y CONFIG_ARCH_HAS_CACHE_LINE_SIZE=y CONFIG_HAVE_SETUP_PER_CPU_AREA=y CONFIG_NEED_PER_CPU_EMBED_FIRST_CHUNK=y CONFIG_NEED_PER_CPU_PAGE_FIRST_CHUNK=y CONFIG_ARCH_HIBERNATION_POSSIBLE=y CONFIG_ARCH_SUSPEND_POSSIBLE=y CONFIG_ARCH_WANT_HUGE_PMD_SHARE=y CONFIG_ARCH_WANT_GENERAL_HUGETLB=y CONFIG_ZONE_DMA32=y CONFIG_AUDIT_ARCH=y CONFIG_ARCH_SUPPORTS_OPTIMIZED_INLINING=y CONFIG_ARCH_SUPPORTS_DEBUG_PAGEALLOC=y CONFIG_HAVE_INTEL_TXT=y CONFIG_X86_64_SMP=y CONFIG_X86_HT=y CONFIG_ARCH_HWEIGHT_CFLAGS="-fcall-saved-rdi -fcall-saved-rsi -fcall-saved-rdx -fcall-saved-rcx -fcall-saved-r8 -fcall-saved-r9 -fcall-saved-r10 -fcall-saved-r11" CONFIG_ARCH_SUPPORTS_UPROBES=y CONFIG_FIX_EARLYCON_MEM=y CONFIG_DEFCONFIG_LIST="/lib/modules/$UNAME_RELEASE/.config" CONFIG_IRQ_WORK=y CONFIG_BUILDTIME_EXTABLE_SORT=y # # General setup # CONFIG_INIT_ENV_ARG_LIMIT=32 CONFIG_CROSS_COMPILE="" # CONFIG_COMPILE_TEST is not set CONFIG_LOCALVERSION="" # CONFIG_LOCALVERSION_AUTO is not set CONFIG_HAVE_KERNEL_GZIP=y CONFIG_HAVE_KERNEL_BZIP2=y CONFIG_HAVE_KERNEL_LZMA=y CONFIG_HAVE_KERNEL_XZ=y CONFIG_HAVE_KERNEL_LZO=y CONFIG_HAVE_KERNEL_LZ4=y # CONFIG_KERNEL_GZIP is not set # CONFIG_KERNEL_BZIP2 is not set # CONFIG_KERNEL_LZMA is not set CONFIG_KERNEL_XZ=y # CONFIG_KERNEL_LZO is not set # CONFIG_KERNEL_LZ4 is not set CONFIG_DEFAULT_HOSTNAME="(none)" CONFIG_SWAP=y CONFIG_SYSVIPC=y CONFIG_SYSVIPC_SYSCTL=y CONFIG_POSIX_MQUEUE=y CONFIG_POSIX_MQUEUE_SYSCTL=y CONFIG_CROSS_MEMORY_ATTACH=y CONFIG_FHANDLE=y CONFIG_USELIB=y CONFIG_AUDIT=y CONFIG_HAVE_ARCH_AUDITSYSCALL=y CONFIG_AUDITSYSCALL=y CONFIG_AUDIT_WATCH=y CONFIG_AUDIT_TREE=y # # IRQ subsystem # CONFIG_GENERIC_IRQ_PROBE=y CONFIG_GENERIC_IRQ_SHOW=y CONFIG_GENERIC_IRQ_LEGACY_ALLOC_HWIRQ=y CONFIG_GENERIC_PENDING_IRQ=y CONFIG_IRQ_DOMAIN=y CONFIG_GENERIC_MSI_IRQ=y # CONFIG_IRQ_DOMAIN_DEBUG is not set CONFIG_IRQ_FORCED_THREADING=y CONFIG_SPARSE_IRQ=y CONFIG_CLOCKSOURCE_WATCHDOG=y CONFIG_ARCH_CLOCKSOURCE_DATA=y CONFIG_CLOCKSOURCE_VALIDATE_LAST_CYCLE=y CONFIG_GENERIC_TIME_VSYSCALL=y CONFIG_GENERIC_CLOCKEVENTS=y CONFIG_GENERIC_CLOCKEVENTS_BUILD=y CONFIG_GENERIC_CLOCKEVENTS_BROADCAST=y CONFIG_GENERIC_CLOCKEVENTS_MIN_ADJUST=y CONFIG_GENERIC_CMOS_UPDATE=y # # Timers subsystem # CONFIG_TICK_ONESHOT=y CONFIG_NO_HZ_COMMON=y # CONFIG_HZ_PERIODIC is not set CONFIG_NO_HZ_IDLE=y # CONFIG_NO_HZ_FULL is not set # CONFIG_NO_HZ is not set CONFIG_HIGH_RES_TIMERS=y # # CPU/Task time and stats accounting # CONFIG_VIRT_CPU_ACCOUNTING=y # CONFIG_TICK_CPU_ACCOUNTING is not set CONFIG_VIRT_CPU_ACCOUNTING_GEN=y # CONFIG_IRQ_TIME_ACCOUNTING is not set CONFIG_BSD_PROCESS_ACCT=y CONFIG_BSD_PROCESS_ACCT_V3=y CONFIG_TASKSTATS=y CONFIG_TASK_DELAY_ACCT=y CONFIG_TASK_XACCT=y CONFIG_TASK_IO_ACCOUNTING=y # # RCU Subsystem # CONFIG_TREE_RCU=y CONFIG_SRCU=y # CONFIG_TASKS_RCU is not set CONFIG_RCU_STALL_COMMON=y CONFIG_CONTEXT_TRACKING=y CONFIG_RCU_USER_QS=y CONFIG_CONTEXT_TRACKING_FORCE=y CONFIG_RCU_FANOUT=64 CONFIG_RCU_FANOUT_LEAF=16 # CONFIG_RCU_FANOUT_EXACT is not set # CONFIG_RCU_FAST_NO_HZ is not set # CONFIG_TREE_RCU_TRACE is not set CONFIG_RCU_KTHREAD_PRIO=0 CONFIG_RCU_NOCB_CPU=y CONFIG_RCU_NOCB_CPU_NONE=y # CONFIG_RCU_NOCB_CPU_ZERO is not set # CONFIG_RCU_NOCB_CPU_ALL is not set CONFIG_BUILD_BIN2C=y CONFIG_IKCONFIG=m # CONFIG_IKCONFIG_PROC is not set CONFIG_LOG_BUF_SHIFT=18 CONFIG_LOG_CPU_MAX_BUF_SHIFT=12 CONFIG_HAVE_UNSTABLE_SCHED_CLOCK=y CONFIG_ARCH_SUPPORTS_NUMA_BALANCING=y CONFIG_ARCH_SUPPORTS_INT128=y # CONFIG_NUMA_BALANCING is not set CONFIG_CGROUPS=y # CONFIG_CGROUP_DEBUG is not set CONFIG_CGROUP_FREEZER=y CONFIG_CGROUP_DEVICE=y CONFIG_CPUSETS=y CONFIG_PROC_PID_CPUSET=y CONFIG_CGROUP_CPUACCT=y CONFIG_PAGE_COUNTER=y CONFIG_MEMCG=y CONFIG_MEMCG_SWAP=y # CONFIG_MEMCG_SWAP_ENABLED is not set # CONFIG_MEMCG_KMEM is not set CONFIG_CGROUP_HUGETLB=y CONFIG_CGROUP_PERF=y CONFIG_CGROUP_SCHED=y CONFIG_FAIR_GROUP_SCHED=y CONFIG_CFS_BANDWIDTH=y CONFIG_RT_GROUP_SCHED=y CONFIG_BLK_CGROUP=y # CONFIG_DEBUG_BLK_CGROUP is not set CONFIG_CHECKPOINT_RESTORE=y CONFIG_NAMESPACES=y CONFIG_UTS_NS=y CONFIG_IPC_NS=y # CONFIG_USER_NS is not set CONFIG_PID_NS=y CONFIG_NET_NS=y CONFIG_SCHED_AUTOGROUP=y # CONFIG_SYSFS_DEPRECATED is not set CONFIG_RELAY=y CONFIG_BLK_DEV_INITRD=y CONFIG_INITRAMFS_SOURCE="" CONFIG_RD_GZIP=y CONFIG_RD_BZIP2=y CONFIG_RD_LZMA=y CONFIG_RD_XZ=y CONFIG_RD_LZO=y CONFIG_RD_LZ4=y # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set CONFIG_SYSCTL=y CONFIG_ANON_INODES=y CONFIG_HAVE_UID16=y CONFIG_SYSCTL_EXCEPTION_TRACE=y CONFIG_HAVE_PCSPKR_PLATFORM=y CONFIG_BPF=y CONFIG_EXPERT=y CONFIG_UID16=y CONFIG_SGETMASK_SYSCALL=y CONFIG_SYSFS_SYSCALL=y CONFIG_SYSCTL_SYSCALL=y CONFIG_KALLSYMS=y CONFIG_KALLSYMS_ALL=y CONFIG_PRINTK=y CONFIG_BUG=y CONFIG_ELF_CORE=y CONFIG_PCSPKR_PLATFORM=y CONFIG_BASE_FULL=y CONFIG_FUTEX=y CONFIG_EPOLL=y CONFIG_SIGNALFD=y CONFIG_TIMERFD=y CONFIG_EVENTFD=y # CONFIG_BPF_SYSCALL is not set CONFIG_SHMEM=y CONFIG_AIO=y CONFIG_ADVISE_SYSCALLS=y CONFIG_PCI_QUIRKS=y # CONFIG_EMBEDDED is not set CONFIG_HAVE_PERF_EVENTS=y # # Kernel Performance Events And Counters # CONFIG_PERF_EVENTS=y # CONFIG_DEBUG_PERF_USE_VMALLOC is not set CONFIG_VM_EVENT_COUNTERS=y # CONFIG_COMPAT_BRK is not set CONFIG_SLAB=y # CONFIG_SLUB is not set # CONFIG_SLOB is not set CONFIG_SYSTEM_TRUSTED_KEYRING=y CONFIG_PROFILING=y CONFIG_TRACEPOINTS=y # CONFIG_OPROFILE is not set CONFIG_HAVE_OPROFILE=y CONFIG_OPROFILE_NMI_TIMER=y CONFIG_KPROBES=y CONFIG_JUMP_LABEL=y CONFIG_OPTPROBES=y CONFIG_KPROBES_ON_FTRACE=y CONFIG_UPROBES=y # CONFIG_HAVE_64BIT_ALIGNED_ACCESS is not set CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS=y CONFIG_ARCH_USE_BUILTIN_BSWAP=y CONFIG_KRETPROBES=y CONFIG_HAVE_IOREMAP_PROT=y CONFIG_HAVE_KPROBES=y CONFIG_HAVE_KRETPROBES=y CONFIG_HAVE_OPTPROBES=y CONFIG_HAVE_KPROBES_ON_FTRACE=y CONFIG_HAVE_ARCH_TRACEHOOK=y CONFIG_HAVE_DMA_ATTRS=y CONFIG_HAVE_DMA_CONTIGUOUS=y CONFIG_GENERIC_SMP_IDLE_THREAD=y CONFIG_HAVE_REGS_AND_STACK_ACCESS_API=y CONFIG_HAVE_DMA_API_DEBUG=y CONFIG_HAVE_HW_BREAKPOINT=y CONFIG_HAVE_MIXED_BREAKPOINTS_REGS=y CONFIG_HAVE_USER_RETURN_NOTIFIER=y CONFIG_HAVE_PERF_EVENTS_NMI=y CONFIG_HAVE_PERF_REGS=y CONFIG_HAVE_PERF_USER_STACK_DUMP=y CONFIG_HAVE_ARCH_JUMP_LABEL=y CONFIG_ARCH_HAVE_NMI_SAFE_CMPXCHG=y CONFIG_HAVE_CMPXCHG_LOCAL=y CONFIG_HAVE_CMPXCHG_DOUBLE=y CONFIG_ARCH_WANT_COMPAT_IPC_PARSE_VERSION=y CONFIG_ARCH_WANT_OLD_COMPAT_IPC=y CONFIG_HAVE_ARCH_SECCOMP_FILTER=y CONFIG_SECCOMP_FILTER=y CONFIG_HAVE_CC_STACKPROTECTOR=y # CONFIG_CC_STACKPROTECTOR is not set CONFIG_CC_STACKPROTECTOR_NONE=y # CONFIG_CC_STACKPROTECTOR_REGULAR is not set # CONFIG_CC_STACKPROTECTOR_STRONG is not set CONFIG_HAVE_CONTEXT_TRACKING=y CONFIG_HAVE_VIRT_CPU_ACCOUNTING_GEN=y CONFIG_HAVE_IRQ_TIME_ACCOUNTING=y CONFIG_HAVE_ARCH_TRANSPARENT_HUGEPAGE=y CONFIG_HAVE_ARCH_SOFT_DIRTY=y CONFIG_MODULES_USE_ELF_RELA=y CONFIG_HAVE_IRQ_EXIT_ON_IRQ_STACK=y CONFIG_OLD_SIGSUSPEND3=y CONFIG_COMPAT_OLD_SIGACTION=y # # GCOV-based kernel profiling # # CONFIG_GCOV_KERNEL is not set CONFIG_ARCH_HAS_GCOV_PROFILE_ALL=y # CONFIG_HAVE_GENERIC_DMA_COHERENT is not set CONFIG_SLABINFO=y CONFIG_RT_MUTEXES=y CONFIG_BASE_SMALL=0 CONFIG_MODULES=y # CONFIG_MODULE_FORCE_LOAD is not set CONFIG_MODULE_UNLOAD=y # CONFIG_MODULE_FORCE_UNLOAD is not set CONFIG_MODVERSIONS=y CONFIG_MODULE_SRCVERSION_ALL=y CONFIG_MODULE_SIG=y # CONFIG_MODULE_SIG_FORCE is not set CONFIG_MODULE_SIG_ALL=y # CONFIG_MODULE_SIG_SHA1 is not set # CONFIG_MODULE_SIG_SHA224 is not set # CONFIG_MODULE_SIG_SHA256 is not set # CONFIG_MODULE_SIG_SHA384 is not set CONFIG_MODULE_SIG_SHA512=y CONFIG_MODULE_SIG_HASH="sha512" # CONFIG_MODULE_COMPRESS is not set CONFIG_STOP_MACHINE=y CONFIG_BLOCK=y CONFIG_BLK_DEV_BSG=y CONFIG_BLK_DEV_BSGLIB=y CONFIG_BLK_DEV_INTEGRITY=y CONFIG_BLK_DEV_THROTTLING=y # CONFIG_BLK_CMDLINE_PARSER is not set # # Partition Types # CONFIG_PARTITION_ADVANCED=y CONFIG_ACORN_PARTITION=y # CONFIG_ACORN_PARTITION_CUMANA is not set # CONFIG_ACORN_PARTITION_EESOX is not set CONFIG_ACORN_PARTITION_ICS=y # CONFIG_ACORN_PARTITION_ADFS is not set # CONFIG_ACORN_PARTITION_POWERTEC is not set CONFIG_ACORN_PARTITION_RISCIX=y # CONFIG_AIX_PARTITION is not set CONFIG_OSF_PARTITION=y CONFIG_AMIGA_PARTITION=y CONFIG_ATARI_PARTITION=y CONFIG_MAC_PARTITION=y CONFIG_MSDOS_PARTITION=y CONFIG_BSD_DISKLABEL=y CONFIG_MINIX_SUBPARTITION=y CONFIG_SOLARIS_X86_PARTITION=y CONFIG_UNIXWARE_DISKLABEL=y CONFIG_LDM_PARTITION=y # CONFIG_LDM_DEBUG is not set CONFIG_SGI_PARTITION=y CONFIG_ULTRIX_PARTITION=y CONFIG_SUN_PARTITION=y CONFIG_KARMA_PARTITION=y CONFIG_EFI_PARTITION=y CONFIG_SYSV68_PARTITION=y # CONFIG_CMDLINE_PARTITION is not set CONFIG_BLOCK_COMPAT=y # # IO Schedulers # CONFIG_IOSCHED_NOOP=y CONFIG_IOSCHED_DEADLINE=y CONFIG_IOSCHED_CFQ=y CONFIG_CFQ_GROUP_IOSCHED=y CONFIG_DEFAULT_DEADLINE=y # CONFIG_DEFAULT_CFQ is not set # CONFIG_DEFAULT_NOOP is not set CONFIG_DEFAULT_IOSCHED="deadline" CONFIG_ASN1=y CONFIG_UNINLINE_SPIN_UNLOCK=y CONFIG_ARCH_SUPPORTS_ATOMIC_RMW=y CONFIG_RWSEM_SPIN_ON_OWNER=y CONFIG_LOCK_SPIN_ON_OWNER=y CONFIG_ARCH_USE_QUEUE_RWLOCK=y CONFIG_QUEUE_RWLOCK=y CONFIG_FREEZER=y # # Processor type and features # CONFIG_ZONE_DMA=y CONFIG_SMP=y CONFIG_X86_FEATURE_NAMES=y CONFIG_X86_X2APIC=y CONFIG_X86_MPPARSE=y CONFIG_X86_EXTENDED_PLATFORM=y CONFIG_X86_NUMACHIP=y # CONFIG_X86_VSMP is not set # CONFIG_X86_UV is not set # CONFIG_X86_GOLDFISH is not set # CONFIG_X86_INTEL_LPSS is not set # CONFIG_X86_AMD_PLATFORM_DEVICE is not set # CONFIG_IOSF_MBI is not set CONFIG_X86_SUPPORTS_MEMORY_FAILURE=y CONFIG_SCHED_OMIT_FRAME_POINTER=y CONFIG_HYPERVISOR_GUEST=y CONFIG_PARAVIRT=y # CONFIG_PARAVIRT_DEBUG is not set CONFIG_PARAVIRT_SPINLOCKS=y CONFIG_XEN=y CONFIG_XEN_DOM0=y CONFIG_XEN_PVHVM=y CONFIG_XEN_MAX_DOMAIN_MEMORY=500 CONFIG_XEN_SAVE_RESTORE=y # CONFIG_XEN_DEBUG_FS is not set # CONFIG_XEN_PVH is not set CONFIG_KVM_GUEST=y # CONFIG_KVM_DEBUG_FS is not set # CONFIG_PARAVIRT_TIME_ACCOUNTING is not set CONFIG_PARAVIRT_CLOCK=y CONFIG_NO_BOOTMEM=y CONFIG_MEMTEST=y # CONFIG_MK8 is not set # CONFIG_MPSC is not set # CONFIG_MCORE2 is not set # CONFIG_MATOM is not set CONFIG_GENERIC_CPU=y CONFIG_X86_INTERNODE_CACHE_SHIFT=6 CONFIG_X86_L1_CACHE_SHIFT=6 CONFIG_X86_TSC=y CONFIG_X86_CMPXCHG64=y CONFIG_X86_CMOV=y CONFIG_X86_MINIMUM_CPU_FAMILY=64 CONFIG_X86_DEBUGCTLMSR=y CONFIG_PROCESSOR_SELECT=y CONFIG_CPU_SUP_INTEL=y CONFIG_CPU_SUP_AMD=y CONFIG_CPU_SUP_CENTAUR=y CONFIG_HPET_TIMER=y CONFIG_HPET_EMULATE_RTC=y CONFIG_DMI=y CONFIG_GART_IOMMU=y CONFIG_CALGARY_IOMMU=y CONFIG_CALGARY_IOMMU_ENABLED_BY_DEFAULT=y CONFIG_SWIOTLB=y CONFIG_IOMMU_HELPER=y # CONFIG_MAXSMP is not set CONFIG_NR_CPUS=256 CONFIG_SCHED_SMT=y CONFIG_SCHED_MC=y # CONFIG_PREEMPT_NONE is not set CONFIG_PREEMPT_VOLUNTARY=y # CONFIG_PREEMPT is not set CONFIG_PREEMPT_COUNT=y CONFIG_X86_UP_APIC_MSI=y CONFIG_X86_LOCAL_APIC=y CONFIG_X86_IO_APIC=y CONFIG_X86_REROUTE_FOR_BROKEN_BOOT_IRQS=y CONFIG_X86_MCE=y CONFIG_X86_MCE_INTEL=y CONFIG_X86_MCE_AMD=y CONFIG_X86_MCE_THRESHOLD=y # CONFIG_X86_MCE_INJECT is not set CONFIG_X86_THERMAL_VECTOR=y CONFIG_X86_16BIT=y CONFIG_X86_ESPFIX64=y CONFIG_X86_VSYSCALL_EMULATION=y # CONFIG_I8K is not set CONFIG_MICROCODE=y CONFIG_MICROCODE_INTEL=y CONFIG_MICROCODE_AMD=y CONFIG_MICROCODE_OLD_INTERFACE=y CONFIG_MICROCODE_INTEL_EARLY=y CONFIG_MICROCODE_AMD_EARLY=y CONFIG_MICROCODE_EARLY=y # CONFIG_X86_MSR is not set # CONFIG_X86_CPUID is not set CONFIG_ARCH_PHYS_ADDR_T_64BIT=y CONFIG_ARCH_DMA_ADDR_T_64BIT=y CONFIG_DIRECT_GBPAGES=y CONFIG_NUMA=y CONFIG_AMD_NUMA=y CONFIG_X86_64_ACPI_NUMA=y CONFIG_NODES_SPAN_OTHER_NODES=y # CONFIG_NUMA_EMU is not set CONFIG_NODES_SHIFT=6 CONFIG_ARCH_SPARSEMEM_ENABLE=y CONFIG_ARCH_SPARSEMEM_DEFAULT=y CONFIG_ARCH_SELECT_MEMORY_MODEL=y CONFIG_ARCH_MEMORY_PROBE=y CONFIG_ARCH_PROC_KCORE_TEXT=y CONFIG_ILLEGAL_POINTER_VALUE=0xdead000000000000 CONFIG_SELECT_MEMORY_MODEL=y CONFIG_SPARSEMEM_MANUAL=y CONFIG_SPARSEMEM=y CONFIG_NEED_MULTIPLE_NODES=y CONFIG_HAVE_MEMORY_PRESENT=y CONFIG_SPARSEMEM_EXTREME=y CONFIG_SPARSEMEM_VMEMMAP_ENABLE=y CONFIG_SPARSEMEM_ALLOC_MEM_MAP_TOGETHER=y CONFIG_SPARSEMEM_VMEMMAP=y CONFIG_HAVE_MEMBLOCK=y CONFIG_HAVE_MEMBLOCK_NODE_MAP=y CONFIG_ARCH_DISCARD_MEMBLOCK=y CONFIG_MEMORY_ISOLATION=y # CONFIG_MOVABLE_NODE is not set CONFIG_HAVE_BOOTMEM_INFO_NODE=y CONFIG_MEMORY_HOTPLUG=y CONFIG_MEMORY_HOTPLUG_SPARSE=y CONFIG_MEMORY_HOTREMOVE=y CONFIG_PAGEFLAGS_EXTENDED=y CONFIG_SPLIT_PTLOCK_CPUS=4 CONFIG_ARCH_ENABLE_SPLIT_PMD_PTLOCK=y CONFIG_COMPACTION=y CONFIG_MIGRATION=y CONFIG_ARCH_ENABLE_HUGEPAGE_MIGRATION=y CONFIG_PHYS_ADDR_T_64BIT=y CONFIG_ZONE_DMA_FLAG=1 CONFIG_BOUNCE=y CONFIG_VIRT_TO_BUS=y CONFIG_KSM=y CONFIG_DEFAULT_MMAP_MIN_ADDR=65536 CONFIG_ARCH_SUPPORTS_MEMORY_FAILURE=y CONFIG_MEMORY_FAILURE=y # CONFIG_HWPOISON_INJECT is not set CONFIG_TRANSPARENT_HUGEPAGE=y # CONFIG_TRANSPARENT_HUGEPAGE_ALWAYS is not set CONFIG_TRANSPARENT_HUGEPAGE_MADVISE=y CONFIG_CLEANCACHE=y CONFIG_FRONTSWAP=y # CONFIG_CMA is not set # CONFIG_MEM_SOFT_DIRTY is not set # CONFIG_ZSWAP is not set # CONFIG_ZPOOL is not set # CONFIG_ZBUD is not set CONFIG_ZSMALLOC=y # CONFIG_PGTABLE_MAPPING is not set # CONFIG_ZSMALLOC_STAT is not set CONFIG_GENERIC_EARLY_IOREMAP=y CONFIG_X86_CHECK_BIOS_CORRUPTION=y CONFIG_X86_BOOTPARAM_MEMORY_CORRUPTION_CHECK=y CONFIG_X86_RESERVE_LOW=64 CONFIG_MTRR=y CONFIG_MTRR_SANITIZER=y CONFIG_MTRR_SANITIZER_ENABLE_DEFAULT=1 CONFIG_MTRR_SANITIZER_SPARE_REG_NR_DEFAULT=1 CONFIG_X86_PAT=y CONFIG_ARCH_USES_PG_UNCACHED=y CONFIG_ARCH_RANDOM=y CONFIG_X86_SMAP=y # CONFIG_X86_INTEL_MPX is not set CONFIG_EFI=y CONFIG_EFI_STUB=y # CONFIG_EFI_MIXED is not set CONFIG_SECCOMP=y # CONFIG_HZ_100 is not set CONFIG_HZ_250=y # CONFIG_HZ_300 is not set # CONFIG_HZ_1000 is not set CONFIG_HZ=250 CONFIG_SCHED_HRTICK=y CONFIG_KEXEC=y # CONFIG_KEXEC_FILE is not set CONFIG_CRASH_DUMP=y CONFIG_KEXEC_JUMP=y CONFIG_PHYSICAL_START=0x1000000 CONFIG_RELOCATABLE=y # CONFIG_RANDOMIZE_BASE is not set CONFIG_PHYSICAL_ALIGN=0x1000000 CONFIG_HOTPLUG_CPU=y # CONFIG_BOOTPARAM_HOTPLUG_CPU0 is not set # CONFIG_DEBUG_HOTPLUG_CPU0 is not set # CONFIG_COMPAT_VDSO is not set # CONFIG_CMDLINE_BOOL is not set CONFIG_HAVE_LIVEPATCH=y # CONFIG_LIVEPATCH is not set CONFIG_ARCH_ENABLE_MEMORY_HOTPLUG=y CONFIG_ARCH_ENABLE_MEMORY_HOTREMOVE=y CONFIG_USE_PERCPU_NUMA_NODE_ID=y # # Power management and ACPI options # CONFIG_ARCH_HIBERNATION_HEADER=y CONFIG_SUSPEND=y CONFIG_SUSPEND_FREEZER=y CONFIG_HIBERNATE_CALLBACKS=y CONFIG_HIBERNATION=y CONFIG_PM_STD_PARTITION="" CONFIG_PM_SLEEP=y CONFIG_PM_SLEEP_SMP=y # CONFIG_PM_AUTOSLEEP is not set # CONFIG_PM_WAKELOCKS is not set CONFIG_PM=y # CONFIG_PM_DEBUG is not set # CONFIG_WQ_POWER_EFFICIENT_DEFAULT is not set CONFIG_ACPI=y CONFIG_ACPI_LEGACY_TABLES_LOOKUP=y CONFIG_ARCH_MIGHT_HAVE_ACPI_PDC=y CONFIG_ACPI_SLEEP=y # CONFIG_ACPI_PROCFS_POWER is not set # CONFIG_ACPI_EC_DEBUGFS is not set CONFIG_ACPI_AC=y CONFIG_ACPI_BATTERY=y CONFIG_ACPI_BUTTON=y CONFIG_ACPI_VIDEO=m CONFIG_ACPI_FAN=y CONFIG_ACPI_DOCK=y CONFIG_ACPI_PROCESSOR=y CONFIG_ACPI_HOTPLUG_CPU=y # CONFIG_ACPI_PROCESSOR_AGGREGATOR is not set CONFIG_ACPI_THERMAL=y CONFIG_ACPI_NUMA=y CONFIG_ACPI_CUSTOM_DSDT_FILE="" # CONFIG_ACPI_CUSTOM_DSDT is not set # CONFIG_ACPI_INITRD_TABLE_OVERRIDE is not set # CONFIG_ACPI_DEBUG is not set # CONFIG_ACPI_PCI_SLOT is not set CONFIG_X86_PM_TIMER=y CONFIG_ACPI_CONTAINER=y # CONFIG_ACPI_HOTPLUG_MEMORY is not set CONFIG_ACPI_HOTPLUG_IOAPIC=y # CONFIG_ACPI_SBS is not set CONFIG_ACPI_HED=y # CONFIG_ACPI_CUSTOM_METHOD is not set CONFIG_ACPI_BGRT=y # CONFIG_ACPI_REDUCED_HARDWARE_ONLY is not set CONFIG_HAVE_ACPI_APEI=y CONFIG_HAVE_ACPI_APEI_NMI=y CONFIG_ACPI_APEI=y CONFIG_ACPI_APEI_GHES=y CONFIG_ACPI_APEI_PCIEAER=y CONFIG_ACPI_APEI_MEMORY_FAILURE=y # CONFIG_ACPI_APEI_EINJ is not set # CONFIG_ACPI_APEI_ERST_DEBUG is not set # CONFIG_ACPI_EXTLOG is not set # CONFIG_PMIC_OPREGION is not set CONFIG_SFI=y # # CPU Frequency scaling # CONFIG_CPU_FREQ=y CONFIG_CPU_FREQ_GOV_COMMON=y CONFIG_CPU_FREQ_STAT=y CONFIG_CPU_FREQ_STAT_DETAILS=y CONFIG_CPU_FREQ_DEFAULT_GOV_PERFORMANCE=y # CONFIG_CPU_FREQ_DEFAULT_GOV_POWERSAVE is not set # CONFIG_CPU_FREQ_DEFAULT_GOV_USERSPACE is not set # CONFIG_CPU_FREQ_DEFAULT_GOV_ONDEMAND is not set # CONFIG_CPU_FREQ_DEFAULT_GOV_CONSERVATIVE is not set CONFIG_CPU_FREQ_GOV_PERFORMANCE=y CONFIG_CPU_FREQ_GOV_POWERSAVE=y CONFIG_CPU_FREQ_GOV_USERSPACE=y CONFIG_CPU_FREQ_GOV_ONDEMAND=y CONFIG_CPU_FREQ_GOV_CONSERVATIVE=y # # CPU frequency scaling drivers # CONFIG_X86_INTEL_PSTATE=y CONFIG_X86_PCC_CPUFREQ=y CONFIG_X86_ACPI_CPUFREQ=y CONFIG_X86_ACPI_CPUFREQ_CPB=y CONFIG_X86_POWERNOW_K8=y # CONFIG_X86_AMD_FREQ_SENSITIVITY is not set CONFIG_X86_SPEEDSTEP_CENTRINO=y # CONFIG_X86_P4_CLOCKMOD is not set # # shared options # # CONFIG_X86_SPEEDSTEP_LIB is not set # # CPU Idle # CONFIG_CPU_IDLE=y CONFIG_CPU_IDLE_GOV_LADDER=y CONFIG_CPU_IDLE_GOV_MENU=y # CONFIG_ARCH_NEEDS_CPU_IDLE_COUPLED is not set CONFIG_INTEL_IDLE=y # # Memory power savings # # CONFIG_I7300_IDLE is not set # # Bus options (PCI etc.) # CONFIG_PCI=y CONFIG_PCI_DIRECT=y CONFIG_PCI_MMCONFIG=y CONFIG_PCI_XEN=y CONFIG_PCI_DOMAINS=y # CONFIG_PCI_CNB20LE_QUIRK is not set CONFIG_PCIEPORTBUS=y CONFIG_HOTPLUG_PCI_PCIE=y CONFIG_PCIEAER=y # CONFIG_PCIE_ECRC is not set # CONFIG_PCIEAER_INJECT is not set CONFIG_PCIEASPM=y # CONFIG_PCIEASPM_DEBUG is not set CONFIG_PCIEASPM_DEFAULT=y # CONFIG_PCIEASPM_POWERSAVE is not set # CONFIG_PCIEASPM_PERFORMANCE is not set CONFIG_PCIE_PME=y CONFIG_PCI_MSI=y # CONFIG_PCI_DEBUG is not set CONFIG_PCI_REALLOC_ENABLE_AUTO=y # CONFIG_PCI_STUB is not set # CONFIG_XEN_PCIDEV_FRONTEND is not set CONFIG_HT_IRQ=y CONFIG_PCI_ATS=y CONFIG_PCI_IOV=y CONFIG_PCI_PRI=y CONFIG_PCI_PASID=y CONFIG_PCI_LABEL=y # # PCI host controller drivers # CONFIG_ISA_DMA_API=y CONFIG_AMD_NB=y # CONFIG_PCCARD is not set CONFIG_HOTPLUG_PCI=y # CONFIG_HOTPLUG_PCI_ACPI is not set CONFIG_HOTPLUG_PCI_CPCI=y # CONFIG_HOTPLUG_PCI_CPCI_ZT5550 is not set # CONFIG_HOTPLUG_PCI_CPCI_GENERIC is not set # CONFIG_HOTPLUG_PCI_SHPC is not set CONFIG_RAPIDIO=y CONFIG_RAPIDIO_TSI721=y CONFIG_RAPIDIO_DISC_TIMEOUT=30 # CONFIG_RAPIDIO_ENABLE_RX_TX_PORTS is not set CONFIG_RAPIDIO_DMA_ENGINE=y # CONFIG_RAPIDIO_DEBUG is not set # CONFIG_RAPIDIO_ENUM_BASIC is not set # # RapidIO Switch drivers # CONFIG_RAPIDIO_TSI57X=y CONFIG_RAPIDIO_CPS_XX=y CONFIG_RAPIDIO_TSI568=y CONFIG_RAPIDIO_CPS_GEN2=y # CONFIG_X86_SYSFB is not set # # Executable file formats / Emulations # CONFIG_BINFMT_ELF=y CONFIG_COMPAT_BINFMT_ELF=y CONFIG_ARCH_BINFMT_ELF_RANDOMIZE_PIE=y # CONFIG_CORE_DUMP_DEFAULT_ELF_HEADERS is not set CONFIG_BINFMT_SCRIPT=y # CONFIG_HAVE_AOUT is not set CONFIG_BINFMT_MISC=m CONFIG_COREDUMP=y CONFIG_IA32_EMULATION=y # CONFIG_IA32_AOUT is not set CONFIG_X86_X32=y CONFIG_COMPAT=y CONFIG_COMPAT_FOR_U64_ALIGNMENT=y CONFIG_SYSVIPC_COMPAT=y CONFIG_KEYS_COMPAT=y CONFIG_X86_DEV_DMA_OPS=y CONFIG_PMC_ATOM=y CONFIG_NET=y # # Networking options # CONFIG_PACKET=y # CONFIG_PACKET_DIAG is not set CONFIG_UNIX=y # CONFIG_UNIX_DIAG is not set # CONFIG_XFRM_USER is not set # CONFIG_NET_KEY is not set CONFIG_INET=y CONFIG_IP_MULTICAST=y CONFIG_IP_ADVANCED_ROUTER=y CONFIG_IP_FIB_TRIE_STATS=y CONFIG_IP_MULTIPLE_TABLES=y CONFIG_IP_ROUTE_MULTIPATH=y CONFIG_IP_ROUTE_VERBOSE=y CONFIG_IP_PNP=y CONFIG_IP_PNP_DHCP=y # CONFIG_IP_PNP_BOOTP is not set # CONFIG_IP_PNP_RARP is not set # CONFIG_NET_IPIP is not set # CONFIG_NET_IPGRE_DEMUX is not set # CONFIG_NET_IP_TUNNEL is not set CONFIG_IP_MROUTE=y # CONFIG_IP_MROUTE_MULTIPLE_TABLES is not set CONFIG_IP_PIMSM_V1=y CONFIG_IP_PIMSM_V2=y CONFIG_SYN_COOKIES=y # CONFIG_NET_UDP_TUNNEL is not set # CONFIG_NET_FOU is not set # CONFIG_GENEVE is not set # CONFIG_INET_AH is not set # CONFIG_INET_ESP is not set # CONFIG_INET_IPCOMP is not set # CONFIG_INET_XFRM_TUNNEL is not set # CONFIG_INET_TUNNEL is not set # CONFIG_INET_XFRM_MODE_TRANSPORT is not set # CONFIG_INET_XFRM_MODE_TUNNEL is not set # CONFIG_INET_XFRM_MODE_BEET is not set CONFIG_INET_LRO=y # CONFIG_INET_DIAG is not set CONFIG_TCP_CONG_ADVANCED=y # CONFIG_TCP_CONG_BIC is not set CONFIG_TCP_CONG_CUBIC=y # CONFIG_TCP_CONG_WESTWOOD is not set # CONFIG_TCP_CONG_HTCP is not set # CONFIG_TCP_CONG_HSTCP is not set # CONFIG_TCP_CONG_HYBLA is not set # CONFIG_TCP_CONG_VEGAS is not set # CONFIG_TCP_CONG_SCALABLE is not set # CONFIG_TCP_CONG_LP is not set # CONFIG_TCP_CONG_VENO is not set # CONFIG_TCP_CONG_YEAH is not set # CONFIG_TCP_CONG_ILLINOIS is not set # CONFIG_TCP_CONG_DCTCP is not set CONFIG_DEFAULT_CUBIC=y # CONFIG_DEFAULT_RENO is not set CONFIG_DEFAULT_TCP_CONG="cubic" CONFIG_TCP_MD5SIG=y CONFIG_IPV6=y CONFIG_IPV6_ROUTER_PREF=y CONFIG_IPV6_ROUTE_INFO=y # CONFIG_IPV6_OPTIMISTIC_DAD is not set # CONFIG_INET6_AH is not set # CONFIG_INET6_ESP is not set # CONFIG_INET6_IPCOMP is not set # CONFIG_IPV6_MIP6 is not set # CONFIG_INET6_XFRM_TUNNEL is not set # CONFIG_INET6_TUNNEL is not set # CONFIG_INET6_XFRM_MODE_TRANSPORT is not set # CONFIG_INET6_XFRM_MODE_TUNNEL is not set # CONFIG_INET6_XFRM_MODE_BEET is not set # CONFIG_INET6_XFRM_MODE_ROUTEOPTIMIZATION is not set # CONFIG_IPV6_SIT is not set # CONFIG_IPV6_TUNNEL is not set # CONFIG_IPV6_GRE is not set CONFIG_IPV6_MULTIPLE_TABLES=y CONFIG_IPV6_SUBTREES=y CONFIG_IPV6_MROUTE=y CONFIG_IPV6_MROUTE_MULTIPLE_TABLES=y CONFIG_IPV6_PIMSM_V2=y CONFIG_NETLABEL=y CONFIG_NETWORK_SECMARK=y # CONFIG_NET_PTP_CLASSIFY is not set # CONFIG_NETWORK_PHY_TIMESTAMPING is not set CONFIG_NETFILTER=y # CONFIG_NETFILTER_DEBUG is not set CONFIG_NETFILTER_ADVANCED=y # # Core Netfilter Configuration # # CONFIG_NETFILTER_NETLINK_ACCT is not set # CONFIG_NETFILTER_NETLINK_QUEUE is not set # CONFIG_NETFILTER_NETLINK_LOG is not set # CONFIG_NF_CONNTRACK is not set # CONFIG_NF_TABLES is not set # CONFIG_NETFILTER_XTABLES is not set # CONFIG_IP_SET is not set # CONFIG_IP_VS is not set # # IP: Netfilter Configuration # # CONFIG_NF_DEFRAG_IPV4 is not set # CONFIG_NF_LOG_ARP is not set # CONFIG_NF_LOG_IPV4 is not set # CONFIG_NF_REJECT_IPV4 is not set # CONFIG_IP_NF_IPTABLES is not set # CONFIG_IP_NF_ARPTABLES is not set # # IPv6: Netfilter Configuration # # CONFIG_NF_DEFRAG_IPV6 is not set # CONFIG_NF_REJECT_IPV6 is not set # CONFIG_NF_LOG_IPV6 is not set # CONFIG_IP6_NF_IPTABLES is not set # CONFIG_IP_DCCP is not set # CONFIG_IP_SCTP is not set # CONFIG_RDS is not set # CONFIG_TIPC is not set # CONFIG_ATM is not set # CONFIG_L2TP is not set # CONFIG_BRIDGE is not set CONFIG_HAVE_NET_DSA=y # CONFIG_VLAN_8021Q is not set # CONFIG_DECNET is not set # CONFIG_LLC2 is not set # CONFIG_IPX is not set # CONFIG_ATALK is not set # CONFIG_X25 is not set # CONFIG_LAPB is not set # CONFIG_PHONET is not set # CONFIG_6LOWPAN is not set # CONFIG_IEEE802154 is not set CONFIG_NET_SCHED=y # # Queueing/Scheduling # # CONFIG_NET_SCH_CBQ is not set CONFIG_NET_SCH_HTB=m # CONFIG_NET_SCH_HFSC is not set # CONFIG_NET_SCH_PRIO is not set # CONFIG_NET_SCH_MULTIQ is not set # CONFIG_NET_SCH_RED is not set # CONFIG_NET_SCH_SFB is not set # CONFIG_NET_SCH_SFQ is not set # CONFIG_NET_SCH_TEQL is not set # CONFIG_NET_SCH_TBF is not set # CONFIG_NET_SCH_GRED is not set # CONFIG_NET_SCH_DSMARK is not set # CONFIG_NET_SCH_NETEM is not set # CONFIG_NET_SCH_DRR is not set # CONFIG_NET_SCH_MQPRIO is not set # CONFIG_NET_SCH_CHOKE is not set # CONFIG_NET_SCH_QFQ is not set CONFIG_NET_SCH_CODEL=m CONFIG_NET_SCH_FQ_CODEL=m # CONFIG_NET_SCH_FQ is not set # CONFIG_NET_SCH_HHF is not set # CONFIG_NET_SCH_PIE is not set # CONFIG_NET_SCH_INGRESS is not set # CONFIG_NET_SCH_PLUG is not set # # Classification # CONFIG_NET_CLS=y # CONFIG_NET_CLS_BASIC is not set # CONFIG_NET_CLS_TCINDEX is not set # CONFIG_NET_CLS_ROUTE4 is not set # CONFIG_NET_CLS_FW is not set # CONFIG_NET_CLS_U32 is not set # CONFIG_NET_CLS_RSVP is not set # CONFIG_NET_CLS_RSVP6 is not set # CONFIG_NET_CLS_FLOW is not set # CONFIG_NET_CLS_CGROUP is not set # CONFIG_NET_CLS_BPF is not set CONFIG_NET_EMATCH=y CONFIG_NET_EMATCH_STACK=32 # CONFIG_NET_EMATCH_CMP is not set # CONFIG_NET_EMATCH_NBYTE is not set # CONFIG_NET_EMATCH_U32 is not set # CONFIG_NET_EMATCH_META is not set # CONFIG_NET_EMATCH_TEXT is not set CONFIG_NET_CLS_ACT=y # CONFIG_NET_ACT_POLICE is not set # CONFIG_NET_ACT_GACT is not set # CONFIG_NET_ACT_MIRRED is not set # CONFIG_NET_ACT_NAT is not set # CONFIG_NET_ACT_PEDIT is not set # CONFIG_NET_ACT_SIMP is not set # CONFIG_NET_ACT_SKBEDIT is not set # CONFIG_NET_ACT_CSUM is not set # CONFIG_NET_ACT_VLAN is not set # CONFIG_NET_ACT_BPF is not set CONFIG_NET_SCH_FIFO=y CONFIG_DCB=y CONFIG_DNS_RESOLVER=y # CONFIG_BATMAN_ADV is not set # CONFIG_OPENVSWITCH is not set # CONFIG_VSOCKETS is not set # CONFIG_NETLINK_MMAP is not set # CONFIG_NETLINK_DIAG is not set # CONFIG_NET_MPLS_GSO is not set # CONFIG_HSR is not set # CONFIG_NET_SWITCHDEV is not set CONFIG_RPS=y CONFIG_RFS_ACCEL=y CONFIG_XPS=y # CONFIG_CGROUP_NET_PRIO is not set # CONFIG_CGROUP_NET_CLASSID is not set CONFIG_NET_RX_BUSY_POLL=y CONFIG_BQL=y CONFIG_BPF_JIT=y CONFIG_NET_FLOW_LIMIT=y # # Network testing # # CONFIG_NET_PKTGEN is not set # CONFIG_NET_TCPPROBE is not set # CONFIG_NET_DROP_MONITOR is not set CONFIG_HAMRADIO=y # # Packet Radio protocols # # CONFIG_AX25 is not set # CONFIG_CAN is not set # CONFIG_IRDA is not set CONFIG_BT=m CONFIG_BT_BREDR=y CONFIG_BT_RFCOMM=m CONFIG_BT_RFCOMM_TTY=y CONFIG_BT_BNEP=m CONFIG_BT_BNEP_MC_FILTER=y CONFIG_BT_BNEP_PROTO_FILTER=y # CONFIG_BT_HIDP is not set CONFIG_BT_LE=y # CONFIG_BT_SELFTEST is not set # # Bluetooth device drivers # CONFIG_BT_HCIBTUSB=m # CONFIG_BT_HCIBTSDIO is not set # CONFIG_BT_HCIUART is not set # CONFIG_BT_HCIBCM203X is not set # CONFIG_BT_HCIBPA10X is not set # CONFIG_BT_HCIBFUSB is not set # CONFIG_BT_HCIVHCI is not set # CONFIG_BT_MRVL is not set # CONFIG_BT_ATH3K is not set # CONFIG_AF_RXRPC is not set CONFIG_FIB_RULES=y CONFIG_WIRELESS=y CONFIG_CFG80211=m CONFIG_NL80211_TESTMODE=y # CONFIG_CFG80211_DEVELOPER_WARNINGS is not set # CONFIG_CFG80211_REG_DEBUG is not set # CONFIG_CFG80211_CERTIFICATION_ONUS is not set CONFIG_CFG80211_DEFAULT_PS=y CONFIG_CFG80211_DEBUGFS=y # CONFIG_CFG80211_INTERNAL_REGDB is not set # CONFIG_CFG80211_WEXT is not set # CONFIG_LIB80211 is not set CONFIG_MAC80211=m CONFIG_MAC80211_HAS_RC=y CONFIG_MAC80211_RC_MINSTREL=y CONFIG_MAC80211_RC_MINSTREL_HT=y # CONFIG_MAC80211_RC_MINSTREL_VHT is not set CONFIG_MAC80211_RC_DEFAULT_MINSTREL=y CONFIG_MAC80211_RC_DEFAULT="minstrel_ht" CONFIG_MAC80211_MESH=y CONFIG_MAC80211_LEDS=y CONFIG_MAC80211_DEBUGFS=y # CONFIG_MAC80211_MESSAGE_TRACING is not set # CONFIG_MAC80211_DEBUG_MENU is not set # CONFIG_WIMAX is not set CONFIG_RFKILL=y CONFIG_RFKILL_LEDS=y CONFIG_RFKILL_INPUT=y # CONFIG_RFKILL_REGULATOR is not set # CONFIG_RFKILL_GPIO is not set # CONFIG_NET_9P is not set # CONFIG_CAIF is not set # CONFIG_CEPH_LIB is not set # CONFIG_NFC is not set CONFIG_HAVE_BPF_JIT=y # # Device Drivers # # # Generic Driver Options # CONFIG_UEVENT_HELPER=y CONFIG_UEVENT_HELPER_PATH="" CONFIG_DEVTMPFS=y CONFIG_DEVTMPFS_MOUNT=y # CONFIG_STANDALONE is not set CONFIG_PREVENT_FIRMWARE_BUILD=y CONFIG_FW_LOADER=y CONFIG_FIRMWARE_IN_KERNEL=y CONFIG_EXTRA_FIRMWARE="" # CONFIG_FW_LOADER_USER_HELPER_FALLBACK is not set CONFIG_ALLOW_DEV_COREDUMP=y # CONFIG_DEBUG_DRIVER is not set # CONFIG_DEBUG_DEVRES is not set CONFIG_SYS_HYPERVISOR=y # CONFIG_GENERIC_CPU_DEVICES is not set CONFIG_GENERIC_CPU_AUTOPROBE=y CONFIG_REGMAP=y CONFIG_REGMAP_I2C=y CONFIG_REGMAP_SPI=y CONFIG_REGMAP_IRQ=y CONFIG_DMA_SHARED_BUFFER=y # CONFIG_FENCE_TRACE is not set # # Bus devices # CONFIG_CONNECTOR=y CONFIG_PROC_EVENTS=y # CONFIG_MTD is not set CONFIG_ARCH_MIGHT_HAVE_PC_PARPORT=y CONFIG_PARPORT=m CONFIG_PARPORT_PC=m # CONFIG_PARPORT_SERIAL is not set CONFIG_PARPORT_PC_FIFO=y # CONFIG_PARPORT_PC_SUPERIO is not set # CONFIG_PARPORT_GSC is not set # CONFIG_PARPORT_AX88796 is not set CONFIG_PARPORT_1284=y CONFIG_PNP=y # CONFIG_PNP_DEBUG_MESSAGES is not set # # Protocols # CONFIG_PNPACPI=y CONFIG_BLK_DEV=y # CONFIG_BLK_DEV_NULL_BLK is not set # CONFIG_BLK_DEV_FD is not set # CONFIG_PARIDE is not set # CONFIG_BLK_DEV_PCIESSD_MTIP32XX is not set # CONFIG_ZRAM is not set # CONFIG_BLK_CPQ_CISS_DA is not set # CONFIG_BLK_DEV_DAC960 is not set # CONFIG_BLK_DEV_UMEM is not set # CONFIG_BLK_DEV_COW_COMMON is not set CONFIG_BLK_DEV_LOOP=y CONFIG_BLK_DEV_LOOP_MIN_COUNT=8 # CONFIG_BLK_DEV_CRYPTOLOOP is not set # CONFIG_BLK_DEV_DRBD is not set # CONFIG_BLK_DEV_NBD is not set # CONFIG_BLK_DEV_NVME is not set # CONFIG_BLK_DEV_SKD is not set # CONFIG_BLK_DEV_SX8 is not set CONFIG_BLK_DEV_RAM=y CONFIG_BLK_DEV_RAM_COUNT=16 CONFIG_BLK_DEV_RAM_SIZE=65536 # CONFIG_CDROM_PKTCDVD is not set # CONFIG_ATA_OVER_ETH is not set CONFIG_XEN_BLKDEV_FRONTEND=y # CONFIG_XEN_BLKDEV_BACKEND is not set CONFIG_VIRTIO_BLK=y # CONFIG_BLK_DEV_HD is not set # CONFIG_BLK_DEV_RBD is not set # CONFIG_BLK_DEV_RSXX is not set # # Misc devices # # CONFIG_SENSORS_LIS3LV02D is not set # CONFIG_AD525X_DPOT is not set # CONFIG_DUMMY_IRQ is not set # CONFIG_IBM_ASM is not set # CONFIG_PHANTOM is not set # CONFIG_SGI_IOC4 is not set # CONFIG_TIFM_CORE is not set # CONFIG_ICS932S401 is not set # CONFIG_ENCLOSURE_SERVICES is not set # CONFIG_HP_ILO is not set # CONFIG_APDS9802ALS is not set # CONFIG_ISL29003 is not set # CONFIG_ISL29020 is not set # CONFIG_SENSORS_TSL2550 is not set # CONFIG_SENSORS_BH1780 is not set # CONFIG_SENSORS_BH1770 is not set # CONFIG_SENSORS_APDS990X is not set # CONFIG_HMC6352 is not set # CONFIG_DS1682 is not set # CONFIG_TI_DAC7512 is not set # CONFIG_VMWARE_BALLOON is not set # CONFIG_BMP085_I2C is not set # CONFIG_BMP085_SPI is not set # CONFIG_USB_SWITCH_FSA9480 is not set # CONFIG_LATTICE_ECP3_CONFIG is not set # CONFIG_SRAM is not set # CONFIG_C2PORT is not set # # EEPROM support # # CONFIG_EEPROM_AT24 is not set # CONFIG_EEPROM_AT25 is not set # CONFIG_EEPROM_LEGACY is not set # CONFIG_EEPROM_MAX6875 is not set # CONFIG_EEPROM_93CX6 is not set # CONFIG_EEPROM_93XX46 is not set # CONFIG_CB710_CORE is not set # # Texas Instruments shared transport line discipline # # CONFIG_TI_ST is not set # CONFIG_SENSORS_LIS3_I2C is not set # # Altera FPGA firmware download module # # CONFIG_ALTERA_STAPL is not set CONFIG_INTEL_MEI=y CONFIG_INTEL_MEI_ME=y # CONFIG_INTEL_MEI_TXE is not set # CONFIG_VMWARE_VMCI is not set # # Intel MIC Bus Driver # # CONFIG_INTEL_MIC_BUS is not set # # Intel MIC Host Driver # # # Intel MIC Card Driver # # CONFIG_GENWQE is not set # CONFIG_ECHO is not set # CONFIG_CXL_BASE is not set CONFIG_HAVE_IDE=y # CONFIG_IDE is not set # # SCSI device support # CONFIG_SCSI_MOD=y # CONFIG_RAID_ATTRS is not set CONFIG_SCSI=y CONFIG_SCSI_DMA=y # CONFIG_SCSI_NETLINK is not set # CONFIG_SCSI_MQ_DEFAULT is not set CONFIG_SCSI_PROC_FS=y # # SCSI support type (disk, tape, CD-ROM) # CONFIG_BLK_DEV_SD=y # CONFIG_CHR_DEV_ST is not set # CONFIG_CHR_DEV_OSST is not set CONFIG_BLK_DEV_SR=y # CONFIG_BLK_DEV_SR_VENDOR is not set CONFIG_CHR_DEV_SG=y # CONFIG_CHR_DEV_SCH is not set CONFIG_SCSI_CONSTANTS=y CONFIG_SCSI_LOGGING=y CONFIG_SCSI_SCAN_ASYNC=y # # SCSI Transports # CONFIG_SCSI_SPI_ATTRS=y # CONFIG_SCSI_FC_ATTRS is not set # CONFIG_SCSI_ISCSI_ATTRS is not set # CONFIG_SCSI_SAS_ATTRS is not set # CONFIG_SCSI_SAS_LIBSAS is not set # CONFIG_SCSI_SRP_ATTRS is not set CONFIG_SCSI_LOWLEVEL=y # CONFIG_ISCSI_TCP is not set # CONFIG_ISCSI_BOOT_SYSFS is not set # CONFIG_SCSI_CXGB3_ISCSI is not set # CONFIG_SCSI_CXGB4_ISCSI is not set # CONFIG_SCSI_BNX2_ISCSI is not set # CONFIG_BE2ISCSI is not set # CONFIG_BLK_DEV_3W_XXXX_RAID is not set # CONFIG_SCSI_HPSA is not set # CONFIG_SCSI_3W_9XXX is not set # CONFIG_SCSI_3W_SAS is not set # CONFIG_SCSI_ACARD is not set # CONFIG_SCSI_AACRAID is not set # CONFIG_SCSI_AIC7XXX is not set # CONFIG_SCSI_AIC79XX is not set # CONFIG_SCSI_AIC94XX is not set # CONFIG_SCSI_MVSAS is not set # CONFIG_SCSI_MVUMI is not set # CONFIG_SCSI_DPT_I2O is not set # CONFIG_SCSI_ADVANSYS is not set # CONFIG_SCSI_ARCMSR is not set # CONFIG_SCSI_ESAS2R is not set CONFIG_MEGARAID_NEWGEN=y # CONFIG_MEGARAID_MM is not set # CONFIG_MEGARAID_LEGACY is not set # CONFIG_MEGARAID_SAS is not set # CONFIG_SCSI_MPT2SAS is not set # CONFIG_SCSI_MPT3SAS is not set # CONFIG_SCSI_UFSHCD is not set # CONFIG_SCSI_HPTIOP is not set # CONFIG_SCSI_BUSLOGIC is not set # CONFIG_VMWARE_PVSCSI is not set # CONFIG_XEN_SCSI_FRONTEND is not set # CONFIG_SCSI_DMX3191D is not set # CONFIG_SCSI_EATA is not set # CONFIG_SCSI_FUTURE_DOMAIN is not set # CONFIG_SCSI_GDTH is not set # CONFIG_SCSI_ISCI is not set # CONFIG_SCSI_IPS is not set # CONFIG_SCSI_INITIO is not set # CONFIG_SCSI_INIA100 is not set # CONFIG_SCSI_PPA is not set # CONFIG_SCSI_IMM is not set # CONFIG_SCSI_STEX is not set # CONFIG_SCSI_SYM53C8XX_2 is not set # CONFIG_SCSI_IPR is not set # CONFIG_SCSI_QLOGIC_1280 is not set # CONFIG_SCSI_QLA_ISCSI is not set # CONFIG_SCSI_DC395x is not set # CONFIG_SCSI_AM53C974 is not set # CONFIG_SCSI_WD719X is not set # CONFIG_SCSI_DEBUG is not set # CONFIG_SCSI_PMCRAID is not set # CONFIG_SCSI_PM8001 is not set # CONFIG_SCSI_VIRTIO is not set # CONFIG_SCSI_DH is not set # CONFIG_SCSI_OSD_INITIATOR is not set CONFIG_ATA=y # CONFIG_ATA_NONSTANDARD is not set CONFIG_ATA_VERBOSE_ERROR=y CONFIG_ATA_ACPI=y # CONFIG_SATA_ZPODD is not set CONFIG_SATA_PMP=y # # Controllers with non-SFF native interface # CONFIG_SATA_AHCI=y # CONFIG_SATA_AHCI_PLATFORM is not set # CONFIG_SATA_INIC162X is not set # CONFIG_SATA_ACARD_AHCI is not set # CONFIG_SATA_SIL24 is not set CONFIG_ATA_SFF=y # # SFF controllers with custom DMA interface # # CONFIG_PDC_ADMA is not set # CONFIG_SATA_QSTOR is not set # CONFIG_SATA_SX4 is not set CONFIG_ATA_BMDMA=y # # SATA SFF controllers with BMDMA # CONFIG_ATA_PIIX=y # CONFIG_SATA_MV is not set # CONFIG_SATA_NV is not set # CONFIG_SATA_PROMISE is not set # CONFIG_SATA_SIL is not set # CONFIG_SATA_SIS is not set # CONFIG_SATA_SVW is not set # CONFIG_SATA_ULI is not set # CONFIG_SATA_VIA is not set # CONFIG_SATA_VITESSE is not set # # PATA SFF controllers with BMDMA # # CONFIG_PATA_ALI is not set # CONFIG_PATA_AMD is not set # CONFIG_PATA_ARTOP is not set # CONFIG_PATA_ATIIXP is not set # CONFIG_PATA_ATP867X is not set # CONFIG_PATA_CMD64X is not set # CONFIG_PATA_CYPRESS is not set # CONFIG_PATA_EFAR is not set # CONFIG_PATA_HPT366 is not set # CONFIG_PATA_HPT37X is not set # CONFIG_PATA_HPT3X2N is not set # CONFIG_PATA_HPT3X3 is not set # CONFIG_PATA_IT8213 is not set # CONFIG_PATA_IT821X is not set # CONFIG_PATA_JMICRON is not set # CONFIG_PATA_MARVELL is not set # CONFIG_PATA_NETCELL is not set # CONFIG_PATA_NINJA32 is not set # CONFIG_PATA_NS87415 is not set # CONFIG_PATA_OLDPIIX is not set # CONFIG_PATA_OPTIDMA is not set # CONFIG_PATA_PDC2027X is not set # CONFIG_PATA_PDC_OLD is not set # CONFIG_PATA_RADISYS is not set # CONFIG_PATA_RDC is not set # CONFIG_PATA_SCH is not set # CONFIG_PATA_SERVERWORKS is not set # CONFIG_PATA_SIL680 is not set CONFIG_PATA_SIS=y # CONFIG_PATA_TOSHIBA is not set # CONFIG_PATA_TRIFLEX is not set # CONFIG_PATA_VIA is not set # CONFIG_PATA_WINBOND is not set # # PIO-only SFF controllers # # CONFIG_PATA_CMD640_PCI is not set # CONFIG_PATA_MPIIX is not set # CONFIG_PATA_NS87410 is not set # CONFIG_PATA_OPTI is not set # CONFIG_PATA_PLATFORM is not set # CONFIG_PATA_RZ1000 is not set # # Generic fallback / legacy drivers # CONFIG_PATA_ACPI=y CONFIG_ATA_GENERIC=y # CONFIG_PATA_LEGACY is not set CONFIG_MD=y CONFIG_BLK_DEV_MD=y CONFIG_MD_AUTODETECT=y # CONFIG_MD_LINEAR is not set # CONFIG_MD_RAID0 is not set # CONFIG_MD_RAID1 is not set # CONFIG_MD_RAID10 is not set # CONFIG_MD_RAID456 is not set # CONFIG_MD_MULTIPATH is not set # CONFIG_MD_FAULTY is not set # CONFIG_BCACHE is not set CONFIG_BLK_DEV_DM_BUILTIN=y CONFIG_BLK_DEV_DM=y # CONFIG_DM_DEBUG is not set # CONFIG_DM_CRYPT is not set # CONFIG_DM_SNAPSHOT is not set # CONFIG_DM_THIN_PROVISIONING is not set # CONFIG_DM_CACHE is not set # CONFIG_DM_ERA is not set # CONFIG_DM_MIRROR is not set # CONFIG_DM_RAID is not set # CONFIG_DM_ZERO is not set # CONFIG_DM_MULTIPATH is not set # CONFIG_DM_DELAY is not set CONFIG_DM_UEVENT=y # CONFIG_DM_FLAKEY is not set # CONFIG_DM_VERITY is not set # CONFIG_DM_SWITCH is not set # CONFIG_TARGET_CORE is not set CONFIG_FUSION=y # CONFIG_FUSION_SPI is not set # CONFIG_FUSION_SAS is not set CONFIG_FUSION_MAX_SGE=128 CONFIG_FUSION_LOGGING=y # # IEEE 1394 (FireWire) support # # CONFIG_FIREWIRE is not set # CONFIG_FIREWIRE_NOSY is not set CONFIG_MACINTOSH_DRIVERS=y CONFIG_MAC_EMUMOUSEBTN=m CONFIG_NETDEVICES=y CONFIG_MII=m CONFIG_NET_CORE=y # CONFIG_BONDING is not set # CONFIG_DUMMY is not set # CONFIG_EQUALIZER is not set CONFIG_NET_FC=y # CONFIG_IFB is not set # CONFIG_NET_TEAM is not set # CONFIG_MACVLAN is not set # CONFIG_IPVLAN is not set # CONFIG_VXLAN is not set # CONFIG_NETCONSOLE is not set # CONFIG_NETPOLL is not set # CONFIG_NET_POLL_CONTROLLER is not set # CONFIG_RIONET is not set CONFIG_TUN=y # CONFIG_VETH is not set CONFIG_VIRTIO_NET=y # CONFIG_NLMON is not set # CONFIG_ARCNET is not set # # CAIF transport drivers # # CONFIG_VHOST_NET is not set # # Distributed Switch Architecture drivers # # CONFIG_NET_DSA_MV88E6XXX is not set # CONFIG_NET_DSA_MV88E6060 is not set # CONFIG_NET_DSA_MV88E6XXX_NEED_PPU is not set # CONFIG_NET_DSA_MV88E6131 is not set # CONFIG_NET_DSA_MV88E6123_61_65 is not set # CONFIG_NET_DSA_MV88E6171 is not set # CONFIG_NET_DSA_MV88E6352 is not set # CONFIG_NET_DSA_BCM_SF2 is not set CONFIG_ETHERNET=y CONFIG_NET_VENDOR_3COM=y # CONFIG_VORTEX is not set # CONFIG_TYPHOON is not set CONFIG_NET_VENDOR_ADAPTEC=y # CONFIG_ADAPTEC_STARFIRE is not set CONFIG_NET_VENDOR_AGERE=y # CONFIG_ET131X is not set CONFIG_NET_VENDOR_ALTEON=y # CONFIG_ACENIC is not set # CONFIG_ALTERA_TSE is not set CONFIG_NET_VENDOR_AMD=y # CONFIG_AMD8111_ETH is not set # CONFIG_PCNET32 is not set # CONFIG_AMD_XGBE is not set # CONFIG_NET_XGENE is not set CONFIG_NET_VENDOR_ARC=y CONFIG_NET_VENDOR_ATHEROS=y # CONFIG_ATL2 is not set # CONFIG_ATL1 is not set # CONFIG_ATL1E is not set # CONFIG_ATL1C is not set # CONFIG_ALX is not set CONFIG_NET_VENDOR_BROADCOM=y # CONFIG_B44 is not set # CONFIG_BCMGENET is not set # CONFIG_BNX2 is not set # CONFIG_CNIC is not set # CONFIG_TIGON3 is not set # CONFIG_BNX2X is not set CONFIG_NET_VENDOR_BROCADE=y # CONFIG_BNA is not set CONFIG_NET_VENDOR_CHELSIO=y # CONFIG_CHELSIO_T1 is not set # CONFIG_CHELSIO_T3 is not set # CONFIG_CHELSIO_T4 is not set # CONFIG_CHELSIO_T4VF is not set CONFIG_NET_VENDOR_CISCO=y # CONFIG_ENIC is not set # CONFIG_CX_ECAT is not set # CONFIG_DNET is not set CONFIG_NET_VENDOR_DEC=y CONFIG_NET_TULIP=y # CONFIG_DE2104X is not set # CONFIG_TULIP is not set # CONFIG_DE4X5 is not set # CONFIG_WINBOND_840 is not set # CONFIG_DM9102 is not set # CONFIG_ULI526X is not set CONFIG_NET_VENDOR_DLINK=y # CONFIG_DL2K is not set # CONFIG_SUNDANCE is not set CONFIG_NET_VENDOR_EMULEX=y # CONFIG_BE2NET is not set CONFIG_NET_VENDOR_EXAR=y # CONFIG_S2IO is not set # CONFIG_VXGE is not set CONFIG_NET_VENDOR_HP=y # CONFIG_HP100 is not set CONFIG_NET_VENDOR_INTEL=y # CONFIG_E100 is not set # CONFIG_E1000 is not set # CONFIG_E1000E is not set # CONFIG_IGB is not set # CONFIG_IGBVF is not set # CONFIG_IXGB is not set # CONFIG_IXGBE is not set # CONFIG_IXGBEVF is not set # CONFIG_I40E is not set # CONFIG_I40EVF is not set # CONFIG_FM10K is not set CONFIG_NET_VENDOR_I825XX=y # CONFIG_IP1000 is not set # CONFIG_JME is not set CONFIG_NET_VENDOR_MARVELL=y # CONFIG_MVMDIO is not set # CONFIG_SKGE is not set # CONFIG_SKY2 is not set CONFIG_NET_VENDOR_MELLANOX=y # CONFIG_MLX4_EN is not set # CONFIG_MLX4_CORE is not set # CONFIG_MLX5_CORE is not set CONFIG_NET_VENDOR_MICREL=y # CONFIG_KS8842 is not set # CONFIG_KS8851 is not set # CONFIG_KS8851_MLL is not set # CONFIG_KSZ884X_PCI is not set CONFIG_NET_VENDOR_MICROCHIP=y # CONFIG_ENC28J60 is not set CONFIG_NET_VENDOR_MYRI=y # CONFIG_MYRI10GE is not set # CONFIG_FEALNX is not set CONFIG_NET_VENDOR_NATSEMI=y # CONFIG_NATSEMI is not set # CONFIG_NS83820 is not set CONFIG_NET_VENDOR_8390=y # CONFIG_NE2K_PCI is not set CONFIG_NET_VENDOR_NVIDIA=y # CONFIG_FORCEDETH is not set CONFIG_NET_VENDOR_OKI=y # CONFIG_ETHOC is not set CONFIG_NET_PACKET_ENGINE=y # CONFIG_HAMACHI is not set # CONFIG_YELLOWFIN is not set CONFIG_NET_VENDOR_QLOGIC=y # CONFIG_QLA3XXX is not set # CONFIG_QLCNIC is not set # CONFIG_QLGE is not set # CONFIG_NETXEN_NIC is not set CONFIG_NET_VENDOR_QUALCOMM=y CONFIG_NET_VENDOR_REALTEK=y # CONFIG_ATP is not set # CONFIG_8139CP is not set # CONFIG_8139TOO is not set CONFIG_R8169=m CONFIG_NET_VENDOR_RDC=y # CONFIG_R6040 is not set CONFIG_NET_VENDOR_ROCKER=y CONFIG_NET_VENDOR_SAMSUNG=y # CONFIG_SXGBE_ETH is not set CONFIG_NET_VENDOR_SEEQ=y CONFIG_NET_VENDOR_SILAN=y # CONFIG_SC92031 is not set CONFIG_NET_VENDOR_SIS=y # CONFIG_SIS900 is not set # CONFIG_SIS190 is not set # CONFIG_SFC is not set CONFIG_NET_VENDOR_SMSC=y # CONFIG_EPIC100 is not set # CONFIG_SMSC911X is not set # CONFIG_SMSC9420 is not set CONFIG_NET_VENDOR_STMICRO=y # CONFIG_STMMAC_ETH is not set CONFIG_NET_VENDOR_SUN=y # CONFIG_HAPPYMEAL is not set # CONFIG_SUNGEM is not set # CONFIG_CASSINI is not set # CONFIG_NIU is not set CONFIG_NET_VENDOR_TEHUTI=y # CONFIG_TEHUTI is not set CONFIG_NET_VENDOR_TI=y # CONFIG_TI_CPSW_ALE is not set # CONFIG_TLAN is not set CONFIG_NET_VENDOR_VIA=y # CONFIG_VIA_RHINE is not set # CONFIG_VIA_VELOCITY is not set CONFIG_NET_VENDOR_WIZNET=y # CONFIG_WIZNET_W5100 is not set # CONFIG_WIZNET_W5300 is not set CONFIG_FDDI=y # CONFIG_DEFXX is not set # CONFIG_SKFP is not set # CONFIG_HIPPI is not set # CONFIG_NET_SB1000 is not set CONFIG_PHYLIB=y # # MII PHY device drivers # CONFIG_AT803X_PHY=y CONFIG_AMD_PHY=y # CONFIG_AMD_XGBE_PHY is not set CONFIG_MARVELL_PHY=y CONFIG_DAVICOM_PHY=y CONFIG_QSEMI_PHY=y CONFIG_LXT_PHY=y CONFIG_CICADA_PHY=y CONFIG_VITESSE_PHY=y CONFIG_SMSC_PHY=y CONFIG_BROADCOM_PHY=y # CONFIG_BCM7XXX_PHY is not set CONFIG_BCM87XX_PHY=y CONFIG_ICPLUS_PHY=y CONFIG_REALTEK_PHY=y CONFIG_NATIONAL_PHY=y CONFIG_STE10XP=y CONFIG_LSI_ET1011C_PHY=y CONFIG_MICREL_PHY=y CONFIG_FIXED_PHY=y CONFIG_MDIO_BITBANG=y CONFIG_MDIO_GPIO=y # CONFIG_MDIO_BCM_UNIMAC is not set # CONFIG_MICREL_KS8995MA is not set # CONFIG_PLIP is not set CONFIG_PPP=y CONFIG_PPP_BSDCOMP=m CONFIG_PPP_DEFLATE=m CONFIG_PPP_FILTER=y # CONFIG_PPP_MPPE is not set CONFIG_PPP_MULTILINK=y # CONFIG_PPPOE is not set CONFIG_PPP_ASYNC=m # CONFIG_PPP_SYNC_TTY is not set # CONFIG_SLIP is not set CONFIG_SLHC=y CONFIG_USB_NET_DRIVERS=y # CONFIG_USB_CATC is not set # CONFIG_USB_KAWETH is not set # CONFIG_USB_PEGASUS is not set # CONFIG_USB_RTL8150 is not set # CONFIG_USB_RTL8152 is not set CONFIG_USB_USBNET=m # CONFIG_USB_NET_AX8817X is not set # CONFIG_USB_NET_AX88179_178A is not set CONFIG_USB_NET_CDCETHER=m # CONFIG_USB_NET_CDC_EEM is not set # CONFIG_USB_NET_CDC_NCM is not set # CONFIG_USB_NET_HUAWEI_CDC_NCM is not set # CONFIG_USB_NET_CDC_MBIM is not set # CONFIG_USB_NET_DM9601 is not set # CONFIG_USB_NET_SR9700 is not set # CONFIG_USB_NET_SR9800 is not set # CONFIG_USB_NET_SMSC75XX is not set # CONFIG_USB_NET_SMSC95XX is not set # CONFIG_USB_NET_GL620A is not set # CONFIG_USB_NET_NET1080 is not set # CONFIG_USB_NET_PLUSB is not set # CONFIG_USB_NET_MCS7830 is not set # CONFIG_USB_NET_RNDIS_HOST is not set # CONFIG_USB_NET_CDC_SUBSET is not set # CONFIG_USB_NET_ZAURUS is not set # CONFIG_USB_NET_CX82310_ETH is not set # CONFIG_USB_NET_KALMIA is not set # CONFIG_USB_NET_QMI_WWAN is not set # CONFIG_USB_HSO is not set # CONFIG_USB_NET_INT51X1 is not set # CONFIG_USB_IPHETH is not set # CONFIG_USB_SIERRA_NET is not set # CONFIG_USB_VL600 is not set CONFIG_WLAN=y # CONFIG_LIBERTAS_THINFIRM is not set # CONFIG_AIRO is not set # CONFIG_ATMEL is not set # CONFIG_AT76C50X_USB is not set # CONFIG_PRISM54 is not set # CONFIG_USB_ZD1201 is not set # CONFIG_USB_NET_RNDIS_WLAN is not set # CONFIG_RTL8180 is not set # CONFIG_RTL8187 is not set # CONFIG_ADM8211 is not set # CONFIG_MAC80211_HWSIM is not set # CONFIG_MWL8K is not set # CONFIG_ATH_CARDS is not set # CONFIG_B43 is not set # CONFIG_B43LEGACY is not set # CONFIG_BRCMSMAC is not set # CONFIG_BRCMFMAC is not set # CONFIG_HOSTAP is not set # CONFIG_IPW2100 is not set # CONFIG_IPW2200 is not set CONFIG_IWLWIFI=m CONFIG_IWLWIFI_LEDS=y CONFIG_IWLDVM=m # CONFIG_IWLMVM is not set CONFIG_IWLWIFI_OPMODE_MODULAR=y # # Debugging Options # # CONFIG_IWLWIFI_DEBUG is not set CONFIG_IWLWIFI_DEBUGFS=y CONFIG_IWLWIFI_DEVICE_TRACING=y # CONFIG_IWL4965 is not set # CONFIG_IWL3945 is not set # CONFIG_LIBERTAS is not set # CONFIG_HERMES is not set # CONFIG_P54_COMMON is not set # CONFIG_RT2X00 is not set # CONFIG_RTL_CARDS is not set CONFIG_WL_TI=y # CONFIG_WL1251 is not set # CONFIG_WL12XX is not set # CONFIG_WL18XX is not set # CONFIG_WLCORE is not set # CONFIG_ZD1211RW is not set # CONFIG_MWIFIEX is not set # CONFIG_CW1200 is not set # CONFIG_RSI_91X is not set # # Enable WiMAX (Networking options) to see the WiMAX drivers # CONFIG_WAN=y # CONFIG_HDLC is not set # CONFIG_DLCI is not set # CONFIG_SBNI is not set CONFIG_XEN_NETDEV_FRONTEND=y # CONFIG_XEN_NETDEV_BACKEND is not set # CONFIG_VMXNET3 is not set CONFIG_ISDN=y # CONFIG_ISDN_I4L is not set # CONFIG_ISDN_CAPI is not set # CONFIG_ISDN_DRV_GIGASET is not set # CONFIG_HYSDN is not set # CONFIG_MISDN is not set # # Input device support # CONFIG_INPUT=y # CONFIG_INPUT_FF_MEMLESS is not set # CONFIG_INPUT_POLLDEV is not set # CONFIG_INPUT_SPARSEKMAP is not set # CONFIG_INPUT_MATRIXKMAP is not set # # Userland interfaces # CONFIG_INPUT_MOUSEDEV=y CONFIG_INPUT_MOUSEDEV_PSAUX=y CONFIG_INPUT_MOUSEDEV_SCREEN_X=1024 CONFIG_INPUT_MOUSEDEV_SCREEN_Y=768 CONFIG_INPUT_JOYDEV=m CONFIG_INPUT_EVDEV=y # CONFIG_INPUT_EVBUG is not set # # Input Device Drivers # CONFIG_INPUT_KEYBOARD=y # CONFIG_KEYBOARD_ADP5520 is not set # CONFIG_KEYBOARD_ADP5588 is not set # CONFIG_KEYBOARD_ADP5589 is not set CONFIG_KEYBOARD_ATKBD=y # CONFIG_KEYBOARD_QT1070 is not set # CONFIG_KEYBOARD_QT2160 is not set # CONFIG_KEYBOARD_LKKBD is not set # CONFIG_KEYBOARD_GPIO is not set # CONFIG_KEYBOARD_GPIO_POLLED is not set # CONFIG_KEYBOARD_TCA6416 is not set # CONFIG_KEYBOARD_TCA8418 is not set # CONFIG_KEYBOARD_MATRIX is not set # CONFIG_KEYBOARD_LM8323 is not set # CONFIG_KEYBOARD_LM8333 is not set # CONFIG_KEYBOARD_MAX7359 is not set # CONFIG_KEYBOARD_MCS is not set # CONFIG_KEYBOARD_MPR121 is not set # CONFIG_KEYBOARD_NEWTON is not set # CONFIG_KEYBOARD_OPENCORES is not set # CONFIG_KEYBOARD_STOWAWAY is not set # CONFIG_KEYBOARD_SUNKBD is not set # CONFIG_KEYBOARD_TC3589X is not set # CONFIG_KEYBOARD_XTKBD is not set CONFIG_INPUT_MOUSE=y CONFIG_MOUSE_PS2=m CONFIG_MOUSE_PS2_ALPS=y CONFIG_MOUSE_PS2_LOGIPS2PP=y CONFIG_MOUSE_PS2_SYNAPTICS=y CONFIG_MOUSE_PS2_CYPRESS=y CONFIG_MOUSE_PS2_LIFEBOOK=y CONFIG_MOUSE_PS2_TRACKPOINT=y CONFIG_MOUSE_PS2_ELANTECH=y CONFIG_MOUSE_PS2_SENTELIC=y CONFIG_MOUSE_PS2_TOUCHKIT=y CONFIG_MOUSE_PS2_FOCALTECH=y # CONFIG_MOUSE_SERIAL is not set # CONFIG_MOUSE_APPLETOUCH is not set # CONFIG_MOUSE_BCM5974 is not set # CONFIG_MOUSE_CYAPA is not set # CONFIG_MOUSE_ELAN_I2C is not set # CONFIG_MOUSE_VSXXXAA is not set # CONFIG_MOUSE_GPIO is not set # CONFIG_MOUSE_SYNAPTICS_I2C is not set # CONFIG_MOUSE_SYNAPTICS_USB is not set CONFIG_INPUT_JOYSTICK=y # CONFIG_JOYSTICK_ANALOG is not set # CONFIG_JOYSTICK_A3D is not set # CONFIG_JOYSTICK_ADI is not set # CONFIG_JOYSTICK_COBRA is not set # CONFIG_JOYSTICK_GF2K is not set # CONFIG_JOYSTICK_GRIP is not set # CONFIG_JOYSTICK_GRIP_MP is not set # CONFIG_JOYSTICK_GUILLEMOT is not set # CONFIG_JOYSTICK_INTERACT is not set # CONFIG_JOYSTICK_SIDEWINDER is not set # CONFIG_JOYSTICK_TMDC is not set # CONFIG_JOYSTICK_IFORCE is not set # CONFIG_JOYSTICK_WARRIOR is not set # CONFIG_JOYSTICK_MAGELLAN is not set # CONFIG_JOYSTICK_SPACEORB is not set # CONFIG_JOYSTICK_SPACEBALL is not set # CONFIG_JOYSTICK_STINGER is not set # CONFIG_JOYSTICK_TWIDJOY is not set # CONFIG_JOYSTICK_ZHENHUA is not set # CONFIG_JOYSTICK_DB9 is not set # CONFIG_JOYSTICK_GAMECON is not set # CONFIG_JOYSTICK_TURBOGRAFX is not set # CONFIG_JOYSTICK_AS5011 is not set # CONFIG_JOYSTICK_JOYDUMP is not set # CONFIG_JOYSTICK_XPAD is not set # CONFIG_JOYSTICK_WALKERA0701 is not set CONFIG_INPUT_TABLET=y # CONFIG_TABLET_USB_ACECAD is not set # CONFIG_TABLET_USB_AIPTEK is not set # CONFIG_TABLET_USB_GTCO is not set # CONFIG_TABLET_USB_HANWANG is not set # CONFIG_TABLET_USB_KBTAB is not set # CONFIG_TABLET_SERIAL_WACOM4 is not set CONFIG_INPUT_TOUCHSCREEN=y # CONFIG_TOUCHSCREEN_88PM860X is not set # CONFIG_TOUCHSCREEN_ADS7846 is not set # CONFIG_TOUCHSCREEN_AD7877 is not set # CONFIG_TOUCHSCREEN_AD7879 is not set # CONFIG_TOUCHSCREEN_ATMEL_MXT is not set # CONFIG_TOUCHSCREEN_AUO_PIXCIR is not set # CONFIG_TOUCHSCREEN_BU21013 is not set # CONFIG_TOUCHSCREEN_CY8CTMG110 is not set # CONFIG_TOUCHSCREEN_CYTTSP_CORE is not set # CONFIG_TOUCHSCREEN_CYTTSP4_CORE is not set # CONFIG_TOUCHSCREEN_DA9034 is not set # CONFIG_TOUCHSCREEN_DA9052 is not set # CONFIG_TOUCHSCREEN_DYNAPRO is not set # CONFIG_TOUCHSCREEN_HAMPSHIRE is not set # CONFIG_TOUCHSCREEN_EETI is not set # CONFIG_TOUCHSCREEN_FUJITSU is not set # CONFIG_TOUCHSCREEN_GOODIX is not set # CONFIG_TOUCHSCREEN_ILI210X is not set # CONFIG_TOUCHSCREEN_GUNZE is not set # CONFIG_TOUCHSCREEN_ELAN is not set # CONFIG_TOUCHSCREEN_ELO is not set # CONFIG_TOUCHSCREEN_WACOM_W8001 is not set # CONFIG_TOUCHSCREEN_WACOM_I2C is not set # CONFIG_TOUCHSCREEN_MAX11801 is not set # CONFIG_TOUCHSCREEN_MCS5000 is not set # CONFIG_TOUCHSCREEN_MMS114 is not set # CONFIG_TOUCHSCREEN_MTOUCH is not set # CONFIG_TOUCHSCREEN_INEXIO is not set # CONFIG_TOUCHSCREEN_MK712 is not set # CONFIG_TOUCHSCREEN_PENMOUNT is not set # CONFIG_TOUCHSCREEN_EDT_FT5X06 is not set # CONFIG_TOUCHSCREEN_TOUCHRIGHT is not set # CONFIG_TOUCHSCREEN_TOUCHWIN is not set # CONFIG_TOUCHSCREEN_PIXCIR is not set # CONFIG_TOUCHSCREEN_WM831X is not set # CONFIG_TOUCHSCREEN_USB_COMPOSITE is not set # CONFIG_TOUCHSCREEN_TOUCHIT213 is not set # CONFIG_TOUCHSCREEN_TSC_SERIO is not set # CONFIG_TOUCHSCREEN_TSC2005 is not set # CONFIG_TOUCHSCREEN_TSC2007 is not set # CONFIG_TOUCHSCREEN_PCAP is not set # CONFIG_TOUCHSCREEN_ST1232 is not set # CONFIG_TOUCHSCREEN_SUR40 is not set # CONFIG_TOUCHSCREEN_TPS6507X is not set # CONFIG_TOUCHSCREEN_ZFORCE is not set CONFIG_INPUT_MISC=y # CONFIG_INPUT_88PM860X_ONKEY is not set # CONFIG_INPUT_AD714X is not set # CONFIG_INPUT_BMA150 is not set # CONFIG_INPUT_E3X0_BUTTON is not set # CONFIG_INPUT_PCSPKR is not set # CONFIG_INPUT_MAX77693_HAPTIC is not set # CONFIG_INPUT_MAX8925_ONKEY is not set # CONFIG_INPUT_MAX8997_HAPTIC is not set # CONFIG_INPUT_MMA8450 is not set # CONFIG_INPUT_MPU3050 is not set # CONFIG_INPUT_APANEL is not set # CONFIG_INPUT_GP2A is not set # CONFIG_INPUT_GPIO_BEEPER is not set # CONFIG_INPUT_GPIO_TILT_POLLED is not set # CONFIG_INPUT_ATLAS_BTNS is not set # CONFIG_INPUT_ATI_REMOTE2 is not set # CONFIG_INPUT_KEYSPAN_REMOTE is not set # CONFIG_INPUT_KXTJ9 is not set # CONFIG_INPUT_POWERMATE is not set # CONFIG_INPUT_YEALINK is not set # CONFIG_INPUT_CM109 is not set # CONFIG_INPUT_REGULATOR_HAPTIC is not set # CONFIG_INPUT_TWL6040_VIBRA is not set CONFIG_INPUT_UINPUT=y # CONFIG_INPUT_PALMAS_PWRBUTTON is not set # CONFIG_INPUT_PCF8574 is not set # CONFIG_INPUT_PWM_BEEPER is not set # CONFIG_INPUT_GPIO_ROTARY_ENCODER is not set # CONFIG_INPUT_DA9052_ONKEY is not set # CONFIG_INPUT_DA9055_ONKEY is not set # CONFIG_INPUT_WM831X_ON is not set # CONFIG_INPUT_PCAP is not set # CONFIG_INPUT_ADXL34X is not set # CONFIG_INPUT_IMS_PCU is not set # CONFIG_INPUT_CMA3000 is not set # CONFIG_INPUT_XEN_KBDDEV_FRONTEND is not set # CONFIG_INPUT_IDEAPAD_SLIDEBAR is not set # CONFIG_INPUT_DRV260X_HAPTICS is not set # CONFIG_INPUT_DRV2667_HAPTICS is not set # # Hardware I/O ports # CONFIG_SERIO=y CONFIG_ARCH_MIGHT_HAVE_PC_SERIO=y CONFIG_SERIO_I8042=y # CONFIG_SERIO_SERPORT is not set # CONFIG_SERIO_CT82C710 is not set # CONFIG_SERIO_PARKBD is not set # CONFIG_SERIO_PCIPS2 is not set CONFIG_SERIO_LIBPS2=y CONFIG_SERIO_RAW=m # CONFIG_SERIO_ALTERA_PS2 is not set # CONFIG_SERIO_PS2MULT is not set # CONFIG_SERIO_ARC_PS2 is not set # CONFIG_GAMEPORT is not set # # Character devices # CONFIG_TTY=y CONFIG_VT=y CONFIG_CONSOLE_TRANSLATIONS=y CONFIG_VT_CONSOLE=y CONFIG_VT_CONSOLE_SLEEP=y CONFIG_HW_CONSOLE=y CONFIG_VT_HW_CONSOLE_BINDING=y CONFIG_UNIX98_PTYS=y CONFIG_DEVPTS_MULTIPLE_INSTANCES=y CONFIG_LEGACY_PTYS=y CONFIG_LEGACY_PTY_COUNT=0 CONFIG_SERIAL_NONSTANDARD=y # CONFIG_ROCKETPORT is not set # CONFIG_CYCLADES is not set # CONFIG_MOXA_INTELLIO is not set # CONFIG_MOXA_SMARTIO is not set # CONFIG_SYNCLINK is not set # CONFIG_SYNCLINKMP is not set # CONFIG_SYNCLINK_GT is not set # CONFIG_NOZOMI is not set # CONFIG_ISI is not set # CONFIG_N_HDLC is not set # CONFIG_N_GSM is not set # CONFIG_TRACE_SINK is not set CONFIG_DEVMEM=y # CONFIG_DEVKMEM is not set # # Serial drivers # CONFIG_SERIAL_EARLYCON=y CONFIG_SERIAL_8250=y CONFIG_SERIAL_8250_DEPRECATED_OPTIONS=y CONFIG_SERIAL_8250_PNP=y CONFIG_SERIAL_8250_CONSOLE=y CONFIG_SERIAL_8250_DMA=y CONFIG_SERIAL_8250_PCI=y CONFIG_SERIAL_8250_NR_UARTS=48 CONFIG_SERIAL_8250_RUNTIME_UARTS=32 CONFIG_SERIAL_8250_EXTENDED=y CONFIG_SERIAL_8250_MANY_PORTS=y CONFIG_SERIAL_8250_SHARE_IRQ=y # CONFIG_SERIAL_8250_DETECT_IRQ is not set CONFIG_SERIAL_8250_RSA=y # CONFIG_SERIAL_8250_DW is not set # CONFIG_SERIAL_8250_FINTEK is not set # # Non-8250 serial port support # CONFIG_SERIAL_KGDB_NMI=y # CONFIG_SERIAL_MAX3100 is not set CONFIG_SERIAL_MAX310X=y # CONFIG_SERIAL_MFD_HSU is not set CONFIG_SERIAL_CORE=y CONFIG_SERIAL_CORE_CONSOLE=y CONFIG_CONSOLE_POLL=y # CONFIG_SERIAL_JSM is not set CONFIG_SERIAL_SCCNXP=y CONFIG_SERIAL_SCCNXP_CONSOLE=y # CONFIG_SERIAL_SC16IS7XX is not set # CONFIG_SERIAL_ALTERA_JTAGUART is not set # CONFIG_SERIAL_ALTERA_UART is not set # CONFIG_SERIAL_IFX6X60 is not set # CONFIG_SERIAL_ARC is not set # CONFIG_SERIAL_RP2 is not set # CONFIG_SERIAL_FSL_LPUART is not set CONFIG_TTY_PRINTK=y CONFIG_PRINTER=m # CONFIG_LP_CONSOLE is not set CONFIG_PPDEV=m CONFIG_HVC_DRIVER=y CONFIG_HVC_IRQ=y CONFIG_HVC_XEN=y CONFIG_HVC_XEN_FRONTEND=y # CONFIG_VIRTIO_CONSOLE is not set # CONFIG_IPMI_HANDLER is not set CONFIG_HW_RANDOM=y # CONFIG_HW_RANDOM_TIMERIOMEM is not set # CONFIG_HW_RANDOM_INTEL is not set # CONFIG_HW_RANDOM_AMD is not set # CONFIG_HW_RANDOM_VIA is not set # CONFIG_HW_RANDOM_VIRTIO is not set # CONFIG_HW_RANDOM_TPM is not set # CONFIG_NVRAM is not set # CONFIG_R3964 is not set # CONFIG_APPLICOM is not set # CONFIG_MWAVE is not set # CONFIG_RAW_DRIVER is not set CONFIG_HPET=y CONFIG_HPET_MMAP=y CONFIG_HPET_MMAP_DEFAULT=y # CONFIG_HANGCHECK_TIMER is not set CONFIG_TCG_TPM=y # CONFIG_TCG_TIS is not set # CONFIG_TCG_TIS_I2C_ATMEL is not set # CONFIG_TCG_TIS_I2C_INFINEON is not set # CONFIG_TCG_TIS_I2C_NUVOTON is not set # CONFIG_TCG_NSC is not set # CONFIG_TCG_ATMEL is not set # CONFIG_TCG_INFINEON is not set # CONFIG_TCG_TIS_I2C_ST33 is not set # CONFIG_TCG_XEN is not set # CONFIG_TCG_CRB is not set # CONFIG_TELCLOCK is not set CONFIG_DEVPORT=y # CONFIG_XILLYBUS is not set # # I2C support # CONFIG_I2C=y CONFIG_ACPI_I2C_OPREGION=y CONFIG_I2C_BOARDINFO=y CONFIG_I2C_COMPAT=y # CONFIG_I2C_CHARDEV is not set CONFIG_I2C_MUX=m # # Multiplexer I2C Chip support # # CONFIG_I2C_MUX_GPIO is not set # CONFIG_I2C_MUX_PCA9541 is not set # CONFIG_I2C_MUX_PCA954x is not set CONFIG_I2C_HELPER_AUTO=y CONFIG_I2C_ALGOBIT=m # # I2C Hardware Bus support # # # PC SMBus host controller drivers # # CONFIG_I2C_ALI1535 is not set # CONFIG_I2C_ALI1563 is not set # CONFIG_I2C_ALI15X3 is not set # CONFIG_I2C_AMD756 is not set # CONFIG_I2C_AMD8111 is not set # CONFIG_I2C_I801 is not set # CONFIG_I2C_ISCH is not set # CONFIG_I2C_ISMT is not set # CONFIG_I2C_PIIX4 is not set # CONFIG_I2C_NFORCE2 is not set # CONFIG_I2C_SIS5595 is not set # CONFIG_I2C_SIS630 is not set # CONFIG_I2C_SIS96X is not set # CONFIG_I2C_VIA is not set # CONFIG_I2C_VIAPRO is not set # # ACPI drivers # # CONFIG_I2C_SCMI is not set # # I2C system bus drivers (mostly embedded / system-on-chip) # # CONFIG_I2C_CBUS_GPIO is not set # CONFIG_I2C_DESIGNWARE_PCI is not set # CONFIG_I2C_GPIO is not set # CONFIG_I2C_OCORES is not set # CONFIG_I2C_PCA_PLATFORM is not set # CONFIG_I2C_PXA_PCI is not set # CONFIG_I2C_SIMTEC is not set # CONFIG_I2C_XILINX is not set # # External I2C/SMBus adapter drivers # # CONFIG_I2C_DIOLAN_U2C is not set # CONFIG_I2C_PARPORT is not set # CONFIG_I2C_PARPORT_LIGHT is not set # CONFIG_I2C_ROBOTFUZZ_OSIF is not set # CONFIG_I2C_TAOS_EVM is not set # CONFIG_I2C_TINY_USB is not set # # Other I2C/SMBus bus drivers # # CONFIG_I2C_STUB is not set # CONFIG_I2C_SLAVE is not set # CONFIG_I2C_DEBUG_CORE is not set # CONFIG_I2C_DEBUG_ALGO is not set # CONFIG_I2C_DEBUG_BUS is not set CONFIG_SPI=y # CONFIG_SPI_DEBUG is not set CONFIG_SPI_MASTER=y # # SPI Master Controller Drivers # # CONFIG_SPI_ALTERA is not set # CONFIG_SPI_BITBANG is not set # CONFIG_SPI_BUTTERFLY is not set # CONFIG_SPI_GPIO is not set # CONFIG_SPI_LM70_LLP is not set # CONFIG_SPI_OC_TINY is not set # CONFIG_SPI_PXA2XX is not set # CONFIG_SPI_PXA2XX_PCI is not set # CONFIG_SPI_SC18IS602 is not set # CONFIG_SPI_XCOMM is not set # CONFIG_SPI_XILINX is not set # CONFIG_SPI_DESIGNWARE is not set # # SPI Protocol Masters # # CONFIG_SPI_SPIDEV is not set # CONFIG_SPI_TLE62X0 is not set # CONFIG_SPMI is not set # CONFIG_HSI is not set # # PPS support # # CONFIG_PPS is not set # # PPS generators support # # # PTP clock support # # CONFIG_PTP_1588_CLOCK is not set # # Enable PHYLIB and NETWORK_PHY_TIMESTAMPING to see the additional clocks. # CONFIG_ARCH_WANT_OPTIONAL_GPIOLIB=y CONFIG_GPIOLIB=y CONFIG_GPIO_DEVRES=y CONFIG_GPIO_ACPI=y CONFIG_GPIOLIB_IRQCHIP=y # CONFIG_DEBUG_GPIO is not set # CONFIG_GPIO_SYSFS is not set # CONFIG_GPIO_DA9052 is not set # CONFIG_GPIO_DA9055 is not set # # Memory mapped GPIO drivers: # # CONFIG_GPIO_GENERIC_PLATFORM is not set # CONFIG_GPIO_IT8761E is not set # CONFIG_GPIO_F7188X is not set # CONFIG_GPIO_SCH311X is not set # CONFIG_GPIO_SCH is not set # CONFIG_GPIO_ICH is not set # CONFIG_GPIO_VX855 is not set # CONFIG_GPIO_LYNXPOINT is not set # # I2C GPIO expanders: # # CONFIG_GPIO_MAX7300 is not set # CONFIG_GPIO_MAX732X is not set # CONFIG_GPIO_PCA953X is not set # CONFIG_GPIO_PCF857X is not set CONFIG_GPIO_RC5T583=y CONFIG_GPIO_SX150X=y CONFIG_GPIO_TC3589X=y # CONFIG_GPIO_TPS65912 is not set # CONFIG_GPIO_TWL6040 is not set # CONFIG_GPIO_WM831X is not set # CONFIG_GPIO_WM8350 is not set # CONFIG_GPIO_WM8994 is not set # CONFIG_GPIO_ADP5520 is not set # CONFIG_GPIO_ADP5588 is not set # # PCI GPIO expanders: # # CONFIG_GPIO_BT8XX is not set # CONFIG_GPIO_AMD8111 is not set # CONFIG_GPIO_INTEL_MID is not set # CONFIG_GPIO_ML_IOH is not set # CONFIG_GPIO_RDC321X is not set # # SPI GPIO expanders: # # CONFIG_GPIO_MAX7301 is not set # CONFIG_GPIO_MCP23S08 is not set # CONFIG_GPIO_MC33880 is not set # # AC97 GPIO expanders: # # # LPC GPIO expanders: # # # MODULbus GPIO expanders: # # CONFIG_GPIO_PALMAS is not set CONFIG_GPIO_TPS6586X=y CONFIG_GPIO_TPS65910=y # # USB GPIO expanders: # # CONFIG_W1 is not set CONFIG_POWER_SUPPLY=y # CONFIG_POWER_SUPPLY_DEBUG is not set # CONFIG_PDA_POWER is not set # CONFIG_MAX8925_POWER is not set # CONFIG_WM831X_BACKUP is not set # CONFIG_WM831X_POWER is not set # CONFIG_WM8350_POWER is not set # CONFIG_TEST_POWER is not set # CONFIG_BATTERY_88PM860X is not set # CONFIG_BATTERY_DS2780 is not set # CONFIG_BATTERY_DS2781 is not set # CONFIG_BATTERY_DS2782 is not set # CONFIG_BATTERY_SBS is not set # CONFIG_BATTERY_BQ27x00 is not set # CONFIG_BATTERY_DA9030 is not set # CONFIG_BATTERY_DA9052 is not set # CONFIG_BATTERY_MAX17040 is not set # CONFIG_BATTERY_MAX17042 is not set # CONFIG_CHARGER_MAX8903 is not set # CONFIG_CHARGER_LP8727 is not set # CONFIG_CHARGER_GPIO is not set CONFIG_CHARGER_MANAGER=y # CONFIG_CHARGER_MAX77693 is not set # CONFIG_CHARGER_BQ2415X is not set # CONFIG_CHARGER_BQ24190 is not set # CONFIG_CHARGER_BQ24735 is not set # CONFIG_CHARGER_SMB347 is not set # CONFIG_CHARGER_TPS65090 is not set # CONFIG_BATTERY_GAUGE_LTC2941 is not set # CONFIG_POWER_RESET is not set CONFIG_POWER_AVS=y CONFIG_HWMON=y # CONFIG_HWMON_VID is not set # CONFIG_HWMON_DEBUG_CHIP is not set # # Native drivers # # CONFIG_SENSORS_ABITUGURU is not set # CONFIG_SENSORS_ABITUGURU3 is not set # CONFIG_SENSORS_AD7314 is not set # CONFIG_SENSORS_AD7414 is not set # CONFIG_SENSORS_AD7418 is not set # CONFIG_SENSORS_ADM1021 is not set # CONFIG_SENSORS_ADM1025 is not set # CONFIG_SENSORS_ADM1026 is not set # CONFIG_SENSORS_ADM1029 is not set # CONFIG_SENSORS_ADM1031 is not set # CONFIG_SENSORS_ADM9240 is not set # CONFIG_SENSORS_ADT7310 is not set # CONFIG_SENSORS_ADT7410 is not set # CONFIG_SENSORS_ADT7411 is not set # CONFIG_SENSORS_ADT7462 is not set # CONFIG_SENSORS_ADT7470 is not set # CONFIG_SENSORS_ADT7475 is not set # CONFIG_SENSORS_ASC7621 is not set # CONFIG_SENSORS_K8TEMP is not set # CONFIG_SENSORS_K10TEMP is not set # CONFIG_SENSORS_FAM15H_POWER is not set # CONFIG_SENSORS_APPLESMC is not set # CONFIG_SENSORS_ASB100 is not set # CONFIG_SENSORS_ATXP1 is not set # CONFIG_SENSORS_DS620 is not set # CONFIG_SENSORS_DS1621 is not set # CONFIG_SENSORS_DA9052_ADC is not set # CONFIG_SENSORS_DA9055 is not set # CONFIG_SENSORS_I5K_AMB is not set # CONFIG_SENSORS_F71805F is not set # CONFIG_SENSORS_F71882FG is not set # CONFIG_SENSORS_F75375S is not set # CONFIG_SENSORS_FSCHMD is not set # CONFIG_SENSORS_GL518SM is not set # CONFIG_SENSORS_GL520SM is not set # CONFIG_SENSORS_G760A is not set # CONFIG_SENSORS_G762 is not set # CONFIG_SENSORS_GPIO_FAN is not set # CONFIG_SENSORS_HIH6130 is not set # CONFIG_SENSORS_I5500 is not set # CONFIG_SENSORS_CORETEMP is not set # CONFIG_SENSORS_IT87 is not set # CONFIG_SENSORS_JC42 is not set # CONFIG_SENSORS_POWR1220 is not set # CONFIG_SENSORS_LINEAGE is not set # CONFIG_SENSORS_LTC2945 is not set # CONFIG_SENSORS_LTC4151 is not set # CONFIG_SENSORS_LTC4215 is not set # CONFIG_SENSORS_LTC4222 is not set # CONFIG_SENSORS_LTC4245 is not set # CONFIG_SENSORS_LTC4260 is not set # CONFIG_SENSORS_LTC4261 is not set # CONFIG_SENSORS_MAX1111 is not set # CONFIG_SENSORS_MAX16065 is not set # CONFIG_SENSORS_MAX1619 is not set # CONFIG_SENSORS_MAX1668 is not set # CONFIG_SENSORS_MAX197 is not set # CONFIG_SENSORS_MAX6639 is not set # CONFIG_SENSORS_MAX6642 is not set # CONFIG_SENSORS_MAX6650 is not set # CONFIG_SENSORS_MAX6697 is not set # CONFIG_SENSORS_HTU21 is not set # CONFIG_SENSORS_MCP3021 is not set # CONFIG_SENSORS_ADCXX is not set # CONFIG_SENSORS_LM63 is not set # CONFIG_SENSORS_LM70 is not set # CONFIG_SENSORS_LM73 is not set # CONFIG_SENSORS_LM75 is not set # CONFIG_SENSORS_LM77 is not set # CONFIG_SENSORS_LM78 is not set # CONFIG_SENSORS_LM80 is not set # CONFIG_SENSORS_LM83 is not set # CONFIG_SENSORS_LM85 is not set # CONFIG_SENSORS_LM87 is not set # CONFIG_SENSORS_LM90 is not set # CONFIG_SENSORS_LM92 is not set # CONFIG_SENSORS_LM93 is not set # CONFIG_SENSORS_LM95234 is not set # CONFIG_SENSORS_LM95241 is not set # CONFIG_SENSORS_LM95245 is not set # CONFIG_SENSORS_PC87360 is not set # CONFIG_SENSORS_PC87427 is not set # CONFIG_SENSORS_NTC_THERMISTOR is not set # CONFIG_SENSORS_NCT6683 is not set # CONFIG_SENSORS_NCT6775 is not set # CONFIG_SENSORS_NCT7802 is not set # CONFIG_SENSORS_PCF8591 is not set # CONFIG_PMBUS is not set # CONFIG_SENSORS_SHT15 is not set # CONFIG_SENSORS_SHT21 is not set # CONFIG_SENSORS_SHTC1 is not set # CONFIG_SENSORS_SIS5595 is not set # CONFIG_SENSORS_DME1737 is not set # CONFIG_SENSORS_EMC1403 is not set # CONFIG_SENSORS_EMC2103 is not set # CONFIG_SENSORS_EMC6W201 is not set # CONFIG_SENSORS_SMSC47M1 is not set # CONFIG_SENSORS_SMSC47M192 is not set # CONFIG_SENSORS_SMSC47B397 is not set # CONFIG_SENSORS_SCH56XX_COMMON is not set # CONFIG_SENSORS_SCH5627 is not set # CONFIG_SENSORS_SCH5636 is not set # CONFIG_SENSORS_SMM665 is not set # CONFIG_SENSORS_ADC128D818 is not set # CONFIG_SENSORS_ADS1015 is not set # CONFIG_SENSORS_ADS7828 is not set # CONFIG_SENSORS_ADS7871 is not set # CONFIG_SENSORS_AMC6821 is not set # CONFIG_SENSORS_INA209 is not set # CONFIG_SENSORS_INA2XX is not set # CONFIG_SENSORS_THMC50 is not set # CONFIG_SENSORS_TMP102 is not set # CONFIG_SENSORS_TMP103 is not set # CONFIG_SENSORS_TMP401 is not set # CONFIG_SENSORS_TMP421 is not set # CONFIG_SENSORS_VIA_CPUTEMP is not set # CONFIG_SENSORS_VIA686A is not set # CONFIG_SENSORS_VT1211 is not set # CONFIG_SENSORS_VT8231 is not set # CONFIG_SENSORS_W83781D is not set # CONFIG_SENSORS_W83791D is not set # CONFIG_SENSORS_W83792D is not set # CONFIG_SENSORS_W83793 is not set # CONFIG_SENSORS_W83795 is not set # CONFIG_SENSORS_W83L785TS is not set # CONFIG_SENSORS_W83L786NG is not set # CONFIG_SENSORS_W83627HF is not set # CONFIG_SENSORS_W83627EHF is not set # CONFIG_SENSORS_WM831X is not set # CONFIG_SENSORS_WM8350 is not set # # ACPI drivers # # CONFIG_SENSORS_ACPI_POWER is not set # CONFIG_SENSORS_ATK0110 is not set CONFIG_THERMAL=y CONFIG_THERMAL_HWMON=y CONFIG_THERMAL_DEFAULT_GOV_STEP_WISE=y # CONFIG_THERMAL_DEFAULT_GOV_FAIR_SHARE is not set # CONFIG_THERMAL_DEFAULT_GOV_USER_SPACE is not set # CONFIG_THERMAL_GOV_FAIR_SHARE is not set CONFIG_THERMAL_GOV_STEP_WISE=y # CONFIG_THERMAL_GOV_BANG_BANG is not set CONFIG_THERMAL_GOV_USER_SPACE=y # CONFIG_THERMAL_EMULATION is not set # CONFIG_INTEL_POWERCLAMP is not set # CONFIG_X86_PKG_TEMP_THERMAL is not set # CONFIG_INT340X_THERMAL is not set # # Texas Instruments thermal drivers # CONFIG_WATCHDOG=y CONFIG_WATCHDOG_CORE=y # CONFIG_WATCHDOG_NOWAYOUT is not set # # Watchdog Device Drivers # # CONFIG_SOFT_WATCHDOG is not set # CONFIG_DA9052_WATCHDOG is not set # CONFIG_DA9055_WATCHDOG is not set # CONFIG_WM831X_WATCHDOG is not set # CONFIG_WM8350_WATCHDOG is not set # CONFIG_XILINX_WATCHDOG is not set # CONFIG_DW_WATCHDOG is not set # CONFIG_ACQUIRE_WDT is not set # CONFIG_ADVANTECH_WDT is not set # CONFIG_ALIM1535_WDT is not set # CONFIG_ALIM7101_WDT is not set # CONFIG_F71808E_WDT is not set # CONFIG_SP5100_TCO is not set # CONFIG_SBC_FITPC2_WATCHDOG is not set # CONFIG_EUROTECH_WDT is not set # CONFIG_IB700_WDT is not set # CONFIG_IBMASR is not set # CONFIG_WAFER_WDT is not set # CONFIG_I6300ESB_WDT is not set # CONFIG_IE6XX_WDT is not set # CONFIG_ITCO_WDT is not set # CONFIG_IT8712F_WDT is not set # CONFIG_IT87_WDT is not set # CONFIG_HP_WATCHDOG is not set # CONFIG_SC1200_WDT is not set # CONFIG_PC87413_WDT is not set # CONFIG_NV_TCO is not set # CONFIG_60XX_WDT is not set # CONFIG_CPU5_WDT is not set # CONFIG_SMSC_SCH311X_WDT is not set # CONFIG_SMSC37B787_WDT is not set # CONFIG_VIA_WDT is not set # CONFIG_W83627HF_WDT is not set # CONFIG_W83877F_WDT is not set # CONFIG_W83977F_WDT is not set # CONFIG_MACHZ_WDT is not set # CONFIG_SBC_EPX_C3_WATCHDOG is not set # CONFIG_MEN_A21_WDT is not set # CONFIG_XEN_WDT is not set # # PCI-based Watchdog Cards # # CONFIG_PCIPCWATCHDOG is not set # CONFIG_WDTPCI is not set # # USB-based Watchdog Cards # # CONFIG_USBPCWATCHDOG is not set CONFIG_SSB_POSSIBLE=y # # Sonics Silicon Backplane # # CONFIG_SSB is not set CONFIG_BCMA_POSSIBLE=y # # Broadcom specific AMBA # # CONFIG_BCMA is not set # # Multifunction device drivers # CONFIG_MFD_CORE=y # CONFIG_MFD_AS3711 is not set CONFIG_PMIC_ADP5520=y CONFIG_MFD_AAT2870_CORE=y # CONFIG_MFD_BCM590XX is not set # CONFIG_MFD_AXP20X is not set # CONFIG_MFD_CROS_EC is not set CONFIG_PMIC_DA903X=y CONFIG_PMIC_DA9052=y CONFIG_MFD_DA9052_SPI=y CONFIG_MFD_DA9052_I2C=y CONFIG_MFD_DA9055=y # CONFIG_MFD_DA9063 is not set # CONFIG_MFD_DA9150 is not set # CONFIG_MFD_DLN2 is not set # CONFIG_MFD_MC13XXX_SPI is not set # CONFIG_MFD_MC13XXX_I2C is not set # CONFIG_HTC_PASIC3 is not set CONFIG_HTC_I2CPLD=y CONFIG_LPC_ICH=m # CONFIG_LPC_SCH is not set # CONFIG_INTEL_SOC_PMIC is not set # CONFIG_MFD_JANZ_CMODIO is not set # CONFIG_MFD_KEMPLD is not set # CONFIG_MFD_88PM800 is not set # CONFIG_MFD_88PM805 is not set CONFIG_MFD_88PM860X=y # CONFIG_MFD_MAX14577 is not set CONFIG_MFD_MAX77693=y # CONFIG_MFD_MAX8907 is not set CONFIG_MFD_MAX8925=y CONFIG_MFD_MAX8997=y CONFIG_MFD_MAX8998=y # CONFIG_MFD_MENF21BMC is not set CONFIG_EZX_PCAP=y # CONFIG_MFD_VIPERBOARD is not set # CONFIG_MFD_RETU is not set # CONFIG_MFD_PCF50633 is not set # CONFIG_MFD_RDC321X is not set # CONFIG_MFD_RTSX_PCI is not set # CONFIG_MFD_RT5033 is not set # CONFIG_MFD_RTSX_USB is not set CONFIG_MFD_RC5T583=y # CONFIG_MFD_RN5T618 is not set CONFIG_MFD_SEC_CORE=y # CONFIG_MFD_SI476X_CORE is not set # CONFIG_MFD_SM501 is not set CONFIG_MFD_SMSC=y CONFIG_ABX500_CORE=y CONFIG_AB3100_CORE=y # CONFIG_AB3100_OTP is not set # CONFIG_MFD_SYSCON is not set # CONFIG_MFD_TI_AM335X_TSCADC is not set # CONFIG_MFD_LP3943 is not set CONFIG_MFD_LP8788=y CONFIG_MFD_PALMAS=y # CONFIG_TPS6105X is not set # CONFIG_TPS65010 is not set # CONFIG_TPS6507X is not set CONFIG_MFD_TPS65090=y # CONFIG_MFD_TPS65217 is not set # CONFIG_MFD_TPS65218 is not set CONFIG_MFD_TPS6586X=y CONFIG_MFD_TPS65910=y CONFIG_MFD_TPS65912=y CONFIG_MFD_TPS65912_I2C=y CONFIG_MFD_TPS65912_SPI=y # CONFIG_MFD_TPS80031 is not set # CONFIG_TWL4030_CORE is not set CONFIG_TWL6040_CORE=y # CONFIG_MFD_WL1273_CORE is not set # CONFIG_MFD_LM3533 is not set CONFIG_MFD_TC3589X=y # CONFIG_MFD_TMIO is not set # CONFIG_MFD_VX855 is not set # CONFIG_MFD_ARIZONA_I2C is not set # CONFIG_MFD_ARIZONA_SPI is not set CONFIG_MFD_WM8400=y CONFIG_MFD_WM831X=y CONFIG_MFD_WM831X_I2C=y CONFIG_MFD_WM831X_SPI=y CONFIG_MFD_WM8350=y CONFIG_MFD_WM8350_I2C=y CONFIG_MFD_WM8994=y CONFIG_REGULATOR=y # CONFIG_REGULATOR_DEBUG is not set # CONFIG_REGULATOR_FIXED_VOLTAGE is not set # CONFIG_REGULATOR_VIRTUAL_CONSUMER is not set # CONFIG_REGULATOR_USERSPACE_CONSUMER is not set CONFIG_REGULATOR_88PM8607=y # CONFIG_REGULATOR_ACT8865 is not set # CONFIG_REGULATOR_AD5398 is not set # CONFIG_REGULATOR_AAT2870 is not set # CONFIG_REGULATOR_AB3100 is not set # CONFIG_REGULATOR_DA903X is not set # CONFIG_REGULATOR_DA9052 is not set # CONFIG_REGULATOR_DA9055 is not set # CONFIG_REGULATOR_DA9210 is not set # CONFIG_REGULATOR_DA9211 is not set # CONFIG_REGULATOR_FAN53555 is not set # CONFIG_REGULATOR_GPIO is not set # CONFIG_REGULATOR_ISL9305 is not set # CONFIG_REGULATOR_ISL6271A is not set # CONFIG_REGULATOR_LP3971 is not set # CONFIG_REGULATOR_LP3972 is not set CONFIG_REGULATOR_LP872X=y # CONFIG_REGULATOR_LP8755 is not set CONFIG_REGULATOR_LP8788=y # CONFIG_REGULATOR_LTC3589 is not set # CONFIG_REGULATOR_MAX1586 is not set # CONFIG_REGULATOR_MAX8649 is not set # CONFIG_REGULATOR_MAX8660 is not set # CONFIG_REGULATOR_MAX8925 is not set # CONFIG_REGULATOR_MAX8952 is not set # CONFIG_REGULATOR_MAX8973 is not set # CONFIG_REGULATOR_MAX8997 is not set # CONFIG_REGULATOR_MAX8998 is not set # CONFIG_REGULATOR_MAX77693 is not set # CONFIG_REGULATOR_PALMAS is not set # CONFIG_REGULATOR_PCAP is not set # CONFIG_REGULATOR_PFUZE100 is not set # CONFIG_REGULATOR_PWM is not set # CONFIG_REGULATOR_RC5T583 is not set # CONFIG_REGULATOR_S2MPA01 is not set # CONFIG_REGULATOR_S2MPS11 is not set # CONFIG_REGULATOR_S5M8767 is not set # CONFIG_REGULATOR_TPS51632 is not set # CONFIG_REGULATOR_TPS62360 is not set # CONFIG_REGULATOR_TPS65023 is not set # CONFIG_REGULATOR_TPS6507X is not set # CONFIG_REGULATOR_TPS65090 is not set # CONFIG_REGULATOR_TPS6524X is not set # CONFIG_REGULATOR_TPS6586X is not set # CONFIG_REGULATOR_TPS65910 is not set # CONFIG_REGULATOR_TPS65912 is not set # CONFIG_REGULATOR_WM831X is not set # CONFIG_REGULATOR_WM8350 is not set # CONFIG_REGULATOR_WM8400 is not set # CONFIG_REGULATOR_WM8994 is not set CONFIG_MEDIA_SUPPORT=m # # Multimedia core support # CONFIG_MEDIA_CAMERA_SUPPORT=y CONFIG_MEDIA_ANALOG_TV_SUPPORT=y CONFIG_MEDIA_DIGITAL_TV_SUPPORT=y CONFIG_MEDIA_RADIO_SUPPORT=y # CONFIG_MEDIA_SDR_SUPPORT is not set CONFIG_MEDIA_RC_SUPPORT=y # CONFIG_MEDIA_CONTROLLER is not set CONFIG_VIDEO_DEV=m CONFIG_VIDEO_V4L2=m # CONFIG_VIDEO_ADV_DEBUG is not set # CONFIG_VIDEO_FIXED_MINOR_RANGES is not set CONFIG_VIDEOBUF2_CORE=m CONFIG_VIDEOBUF2_MEMOPS=m CONFIG_VIDEOBUF2_VMALLOC=m CONFIG_DVB_CORE=m CONFIG_DVB_NET=y # CONFIG_TTPCI_EEPROM is not set CONFIG_DVB_MAX_ADAPTERS=8 CONFIG_DVB_DYNAMIC_MINORS=y # # Media drivers # CONFIG_RC_CORE=m # CONFIG_RC_MAP is not set CONFIG_RC_DECODERS=y # CONFIG_LIRC is not set # CONFIG_IR_NEC_DECODER is not set # CONFIG_IR_RC5_DECODER is not set # CONFIG_IR_RC6_DECODER is not set # CONFIG_IR_JVC_DECODER is not set # CONFIG_IR_SONY_DECODER is not set # CONFIG_IR_SANYO_DECODER is not set # CONFIG_IR_SHARP_DECODER is not set # CONFIG_IR_MCE_KBD_DECODER is not set # CONFIG_IR_XMP_DECODER is not set CONFIG_RC_DEVICES=y # CONFIG_RC_ATI_REMOTE is not set # CONFIG_IR_ENE is not set # CONFIG_IR_HIX5HD2 is not set # CONFIG_IR_IMON is not set # CONFIG_IR_MCEUSB is not set # CONFIG_IR_ITE_CIR is not set # CONFIG_IR_FINTEK is not set # CONFIG_IR_NUVOTON is not set # CONFIG_IR_REDRAT3 is not set # CONFIG_IR_STREAMZAP is not set # CONFIG_IR_WINBOND_CIR is not set # CONFIG_IR_IGORPLUGUSB is not set # CONFIG_IR_IGUANA is not set # CONFIG_IR_TTUSBIR is not set # CONFIG_RC_LOOPBACK is not set # CONFIG_IR_GPIO_CIR is not set CONFIG_MEDIA_USB_SUPPORT=y # # Webcam devices # CONFIG_USB_VIDEO_CLASS=m CONFIG_USB_VIDEO_CLASS_INPUT_EVDEV=y # CONFIG_USB_GSPCA is not set # CONFIG_USB_PWC is not set # CONFIG_VIDEO_CPIA2 is not set # CONFIG_USB_ZR364XX is not set # CONFIG_USB_STKWEBCAM is not set # CONFIG_USB_S2255 is not set # CONFIG_VIDEO_USBTV is not set # # Analog TV USB devices # # CONFIG_VIDEO_PVRUSB2 is not set # CONFIG_VIDEO_HDPVR is not set # CONFIG_VIDEO_USBVISION is not set # CONFIG_VIDEO_STK1160_COMMON is not set # CONFIG_VIDEO_GO7007 is not set # # Analog/digital TV USB devices # # CONFIG_VIDEO_AU0828 is not set # CONFIG_VIDEO_CX231XX is not set # CONFIG_VIDEO_TM6000 is not set # # Digital TV USB devices # # CONFIG_DVB_USB is not set # CONFIG_DVB_USB_V2 is not set # CONFIG_DVB_TTUSB_BUDGET is not set # CONFIG_DVB_TTUSB_DEC is not set # CONFIG_SMS_USB_DRV is not set # CONFIG_DVB_B2C2_FLEXCOP_USB is not set # CONFIG_DVB_AS102 is not set # # Webcam, TV (analog/digital) USB devices # # CONFIG_VIDEO_EM28XX is not set CONFIG_MEDIA_PCI_SUPPORT=y # # Media capture support # # # Media capture/analog TV support # # CONFIG_VIDEO_IVTV is not set # CONFIG_VIDEO_ZORAN is not set # CONFIG_VIDEO_HEXIUM_GEMINI is not set # CONFIG_VIDEO_HEXIUM_ORION is not set # CONFIG_VIDEO_MXB is not set # CONFIG_VIDEO_SOLO6X10 is not set # CONFIG_VIDEO_TW68 is not set # # Media capture/analog/hybrid TV support # # CONFIG_VIDEO_CX18 is not set # CONFIG_VIDEO_CX23885 is not set # CONFIG_VIDEO_CX25821 is not set # CONFIG_VIDEO_CX88 is not set # CONFIG_VIDEO_BT848 is not set # CONFIG_VIDEO_SAA7134 is not set # CONFIG_VIDEO_SAA7164 is not set # # Media digital TV PCI Adapters # # CONFIG_DVB_AV7110 is not set # CONFIG_DVB_BUDGET_CORE is not set # CONFIG_DVB_B2C2_FLEXCOP_PCI is not set # CONFIG_DVB_PLUTO2 is not set # CONFIG_DVB_DM1105 is not set # CONFIG_DVB_PT1 is not set # CONFIG_DVB_PT3 is not set # CONFIG_MANTIS_CORE is not set # CONFIG_DVB_NGENE is not set # CONFIG_DVB_DDBRIDGE is not set # CONFIG_DVB_SMIPCIE is not set CONFIG_V4L_PLATFORM_DRIVERS=y # CONFIG_VIDEO_CAFE_CCIC is not set # CONFIG_SOC_CAMERA is not set CONFIG_V4L_MEM2MEM_DRIVERS=y # CONFIG_VIDEO_MEM2MEM_DEINTERLACE is not set # CONFIG_VIDEO_SH_VEU is not set CONFIG_V4L_TEST_DRIVERS=y # CONFIG_VIDEO_VIVID is not set # CONFIG_VIDEO_VIM2M is not set # # Supported MMC/SDIO adapters # # CONFIG_SMS_SDIO_DRV is not set CONFIG_RADIO_ADAPTERS=y CONFIG_RADIO_SI470X=y # CONFIG_USB_SI470X is not set # CONFIG_I2C_SI470X is not set # CONFIG_RADIO_SI4713 is not set # CONFIG_USB_MR800 is not set # CONFIG_USB_DSBR is not set # CONFIG_RADIO_MAXIRADIO is not set # CONFIG_RADIO_SHARK is not set # CONFIG_RADIO_SHARK2 is not set # CONFIG_USB_KEENE is not set # CONFIG_USB_RAREMONO is not set # CONFIG_USB_MA901 is not set # CONFIG_RADIO_TEA5764 is not set # CONFIG_RADIO_SAA7706H is not set # CONFIG_RADIO_TEF6862 is not set # CONFIG_RADIO_WL1273 is not set # # Texas Instruments WL128x FM driver (ST based) # # CONFIG_RADIO_WL128X is not set # CONFIG_CYPRESS_FIRMWARE is not set # # Media ancillary drivers (tuners, sensors, i2c, frontends) # CONFIG_MEDIA_SUBDRV_AUTOSELECT=y CONFIG_MEDIA_ATTACH=y CONFIG_VIDEO_IR_I2C=m # # Audio decoders, processors and mixers # # # RDS decoders # # # Video decoders # # # Video and audio decoders # # # Video encoders # # # Camera sensor devices # # # Flash devices # # # Video improvement chips # # # Audio/Video compression chips # # # Miscellaneous helper chips # # # Sensors used on soc_camera driver # CONFIG_MEDIA_TUNER=m CONFIG_MEDIA_TUNER_SIMPLE=m CONFIG_MEDIA_TUNER_TDA8290=m CONFIG_MEDIA_TUNER_TDA827X=m CONFIG_MEDIA_TUNER_TDA18271=m CONFIG_MEDIA_TUNER_TDA9887=m CONFIG_MEDIA_TUNER_TEA5761=m CONFIG_MEDIA_TUNER_TEA5767=m CONFIG_MEDIA_TUNER_MT20XX=m CONFIG_MEDIA_TUNER_XC2028=m CONFIG_MEDIA_TUNER_XC5000=m CONFIG_MEDIA_TUNER_XC4000=m CONFIG_MEDIA_TUNER_MC44S803=m # # Multistandard (satellite) frontends # # # Multistandard (cable + terrestrial) frontends # # # DVB-S (satellite) frontends # # # DVB-T (terrestrial) frontends # # CONFIG_DVB_AS102_FE is not set # # DVB-C (cable) frontends # # # ATSC (North American/Korean Terrestrial/Cable DTV) frontends # # # ISDB-T (terrestrial) frontends # # # ISDB-S (satellite) & ISDB-T (terrestrial) frontends # # # Digital terrestrial only tuners/PLL # # # SEC control devices for DVB-S # # # Tools to develop new frontends # # CONFIG_DVB_DUMMY_FE is not set # # Graphics support # CONFIG_AGP=y CONFIG_AGP_AMD64=y CONFIG_AGP_INTEL=y # CONFIG_AGP_SIS is not set CONFIG_AGP_VIA=y CONFIG_INTEL_GTT=y CONFIG_VGA_ARB=y CONFIG_VGA_ARB_MAX_GPUS=16 CONFIG_VGA_SWITCHEROO=y # # Direct Rendering Manager # CONFIG_DRM=m CONFIG_DRM_MIPI_DSI=y CONFIG_DRM_KMS_HELPER=m CONFIG_DRM_KMS_FB_HELPER=y CONFIG_DRM_LOAD_EDID_FIRMWARE=y # # I2C encoder or helper chips # # CONFIG_DRM_I2C_ADV7511 is not set # CONFIG_DRM_I2C_CH7006 is not set # CONFIG_DRM_I2C_SIL164 is not set # CONFIG_DRM_I2C_NXP_TDA998X is not set # CONFIG_DRM_TDFX is not set # CONFIG_DRM_R128 is not set # CONFIG_DRM_RADEON is not set # CONFIG_DRM_NOUVEAU is not set # CONFIG_DRM_I810 is not set CONFIG_DRM_I915=m CONFIG_DRM_I915_KMS=y CONFIG_DRM_I915_FBDEV=y # CONFIG_DRM_I915_PRELIMINARY_HW_SUPPORT is not set # CONFIG_DRM_MGA is not set # CONFIG_DRM_SIS is not set # CONFIG_DRM_VIA is not set # CONFIG_DRM_SAVAGE is not set # CONFIG_DRM_VMWGFX is not set # CONFIG_DRM_GMA500 is not set # CONFIG_DRM_UDL is not set # CONFIG_DRM_AST is not set # CONFIG_DRM_MGAG200 is not set # CONFIG_DRM_CIRRUS_QEMU is not set # CONFIG_DRM_QXL is not set # CONFIG_DRM_BOCHS is not set CONFIG_DRM_PANEL=y # # Display Panels # # # Frame buffer Devices # CONFIG_FB=y CONFIG_FIRMWARE_EDID=y CONFIG_FB_CMDLINE=y # CONFIG_FB_DDC is not set # CONFIG_FB_BOOT_VESA_SUPPORT is not set CONFIG_FB_CFB_FILLRECT=y CONFIG_FB_CFB_COPYAREA=y CONFIG_FB_CFB_IMAGEBLIT=y # CONFIG_FB_CFB_REV_PIXELS_IN_BYTE is not set # CONFIG_FB_SYS_FILLRECT is not set # CONFIG_FB_SYS_COPYAREA is not set # CONFIG_FB_SYS_IMAGEBLIT is not set # CONFIG_FB_FOREIGN_ENDIAN is not set # CONFIG_FB_SYS_FOPS is not set # CONFIG_FB_SVGALIB is not set # CONFIG_FB_MACMODES is not set # CONFIG_FB_BACKLIGHT is not set CONFIG_FB_MODE_HELPERS=y CONFIG_FB_TILEBLITTING=y # # Frame buffer hardware drivers # # CONFIG_FB_CIRRUS is not set # CONFIG_FB_PM2 is not set # CONFIG_FB_CYBER2000 is not set # CONFIG_FB_ARC is not set CONFIG_FB_ASILIANT=y CONFIG_FB_IMSTT=y # CONFIG_FB_VGA16 is not set # CONFIG_FB_UVESA is not set # CONFIG_FB_VESA is not set CONFIG_FB_EFI=y # CONFIG_FB_N411 is not set # CONFIG_FB_HGA is not set # CONFIG_FB_OPENCORES is not set # CONFIG_FB_S1D13XXX is not set # CONFIG_FB_NVIDIA is not set # CONFIG_FB_RIVA is not set # CONFIG_FB_I740 is not set # CONFIG_FB_LE80578 is not set # CONFIG_FB_INTEL is not set # CONFIG_FB_MATROX is not set # CONFIG_FB_RADEON is not set # CONFIG_FB_ATY128 is not set # CONFIG_FB_ATY is not set # CONFIG_FB_S3 is not set # CONFIG_FB_SAVAGE is not set # CONFIG_FB_SIS is not set # CONFIG_FB_VIA is not set # CONFIG_FB_NEOMAGIC is not set # CONFIG_FB_KYRO is not set # CONFIG_FB_3DFX is not set # CONFIG_FB_VOODOO1 is not set # CONFIG_FB_VT8623 is not set # CONFIG_FB_TRIDENT is not set # CONFIG_FB_ARK is not set # CONFIG_FB_PM3 is not set # CONFIG_FB_CARMINE is not set # CONFIG_FB_SMSCUFX is not set # CONFIG_FB_UDL is not set # CONFIG_FB_VIRTUAL is not set # CONFIG_XEN_FBDEV_FRONTEND is not set # CONFIG_FB_METRONOME is not set # CONFIG_FB_MB862XX is not set # CONFIG_FB_BROADSHEET is not set # CONFIG_FB_AUO_K190X is not set # CONFIG_FB_SIMPLE is not set CONFIG_BACKLIGHT_LCD_SUPPORT=y # CONFIG_LCD_CLASS_DEVICE is not set CONFIG_BACKLIGHT_CLASS_DEVICE=y # CONFIG_BACKLIGHT_GENERIC is not set # CONFIG_BACKLIGHT_PWM is not set # CONFIG_BACKLIGHT_DA903X is not set # CONFIG_BACKLIGHT_DA9052 is not set # CONFIG_BACKLIGHT_MAX8925 is not set # CONFIG_BACKLIGHT_APPLE is not set # CONFIG_BACKLIGHT_SAHARA is not set # CONFIG_BACKLIGHT_WM831X is not set # CONFIG_BACKLIGHT_ADP5520 is not set # CONFIG_BACKLIGHT_ADP8860 is not set # CONFIG_BACKLIGHT_ADP8870 is not set # CONFIG_BACKLIGHT_88PM860X is not set # CONFIG_BACKLIGHT_AAT2870 is not set # CONFIG_BACKLIGHT_LM3630A is not set # CONFIG_BACKLIGHT_LM3639 is not set # CONFIG_BACKLIGHT_LP855X is not set # CONFIG_BACKLIGHT_LP8788 is not set # CONFIG_BACKLIGHT_GPIO is not set # CONFIG_BACKLIGHT_LV5207LP is not set # CONFIG_BACKLIGHT_BD6107 is not set # CONFIG_VGASTATE is not set CONFIG_HDMI=y # # Console display driver support # CONFIG_VGA_CONSOLE=y # CONFIG_VGACON_SOFT_SCROLLBACK is not set CONFIG_DUMMY_CONSOLE=y CONFIG_DUMMY_CONSOLE_COLUMNS=80 CONFIG_DUMMY_CONSOLE_ROWS=25 CONFIG_FRAMEBUFFER_CONSOLE=y CONFIG_FRAMEBUFFER_CONSOLE_DETECT_PRIMARY=y # CONFIG_FRAMEBUFFER_CONSOLE_ROTATION is not set # CONFIG_LOGO is not set CONFIG_SOUND=m # CONFIG_SOUND_OSS_CORE is not set CONFIG_SND=m CONFIG_SND_TIMER=m CONFIG_SND_PCM=m CONFIG_SND_HWDEP=m CONFIG_SND_RAWMIDI=m CONFIG_SND_JACK=y CONFIG_SND_SEQUENCER=m # CONFIG_SND_SEQ_DUMMY is not set # CONFIG_SND_MIXER_OSS is not set # CONFIG_SND_PCM_OSS is not set # CONFIG_SND_SEQUENCER_OSS is not set # CONFIG_SND_HRTIMER is not set CONFIG_SND_DYNAMIC_MINORS=y CONFIG_SND_MAX_CARDS=32 CONFIG_SND_SUPPORT_OLD_API=y CONFIG_SND_VERBOSE_PROCFS=y # CONFIG_SND_VERBOSE_PRINTK is not set # CONFIG_SND_DEBUG is not set CONFIG_SND_VMASTER=y CONFIG_SND_KCTL_JACK=y CONFIG_SND_DMA_SGBUF=y CONFIG_SND_RAWMIDI_SEQ=m # CONFIG_SND_OPL3_LIB_SEQ is not set # CONFIG_SND_OPL4_LIB_SEQ is not set # CONFIG_SND_SBAWE_SEQ is not set # CONFIG_SND_EMU10K1_SEQ is not set CONFIG_SND_DRIVERS=y # CONFIG_SND_PCSP is not set # CONFIG_SND_DUMMY is not set # CONFIG_SND_ALOOP is not set CONFIG_SND_VIRMIDI=m # CONFIG_SND_MTPAV is not set # CONFIG_SND_MTS64 is not set # CONFIG_SND_SERIAL_U16550 is not set # CONFIG_SND_MPU401 is not set # CONFIG_SND_PORTMAN2X4 is not set CONFIG_SND_PCI=y # CONFIG_SND_AD1889 is not set # CONFIG_SND_ALS300 is not set # CONFIG_SND_ALS4000 is not set # CONFIG_SND_ALI5451 is not set # CONFIG_SND_ASIHPI is not set # CONFIG_SND_ATIIXP is not set # CONFIG_SND_ATIIXP_MODEM is not set # CONFIG_SND_AU8810 is not set # CONFIG_SND_AU8820 is not set # CONFIG_SND_AU8830 is not set # CONFIG_SND_AW2 is not set # CONFIG_SND_AZT3328 is not set # CONFIG_SND_BT87X is not set # CONFIG_SND_CA0106 is not set # CONFIG_SND_CMIPCI is not set # CONFIG_SND_OXYGEN is not set # CONFIG_SND_CS4281 is not set # CONFIG_SND_CS46XX is not set # CONFIG_SND_CTXFI is not set # CONFIG_SND_DARLA20 is not set # CONFIG_SND_GINA20 is not set # CONFIG_SND_LAYLA20 is not set # CONFIG_SND_DARLA24 is not set # CONFIG_SND_GINA24 is not set # CONFIG_SND_LAYLA24 is not set # CONFIG_SND_MONA is not set # CONFIG_SND_MIA is not set # CONFIG_SND_ECHO3G is not set # CONFIG_SND_INDIGO is not set # CONFIG_SND_INDIGOIO is not set # CONFIG_SND_INDIGODJ is not set # CONFIG_SND_INDIGOIOX is not set # CONFIG_SND_INDIGODJX is not set # CONFIG_SND_EMU10K1 is not set # CONFIG_SND_EMU10K1X is not set # CONFIG_SND_ENS1370 is not set # CONFIG_SND_ENS1371 is not set # CONFIG_SND_ES1938 is not set # CONFIG_SND_ES1968 is not set # CONFIG_SND_FM801 is not set # CONFIG_SND_HDSP is not set # CONFIG_SND_HDSPM is not set # CONFIG_SND_ICE1712 is not set # CONFIG_SND_ICE1724 is not set # CONFIG_SND_INTEL8X0 is not set # CONFIG_SND_INTEL8X0M is not set # CONFIG_SND_KORG1212 is not set # CONFIG_SND_LOLA is not set # CONFIG_SND_LX6464ES is not set # CONFIG_SND_MAESTRO3 is not set # CONFIG_SND_MIXART is not set # CONFIG_SND_NM256 is not set # CONFIG_SND_PCXHR is not set # CONFIG_SND_RIPTIDE is not set # CONFIG_SND_RME32 is not set # CONFIG_SND_RME96 is not set # CONFIG_SND_RME9652 is not set # CONFIG_SND_SE6X is not set # CONFIG_SND_SONICVIBES is not set # CONFIG_SND_TRIDENT is not set # CONFIG_SND_VIA82XX is not set # CONFIG_SND_VIA82XX_MODEM is not set # CONFIG_SND_VIRTUOSO is not set # CONFIG_SND_VX222 is not set # CONFIG_SND_YMFPCI is not set # # HD-Audio # CONFIG_SND_HDA=m CONFIG_SND_HDA_INTEL=m CONFIG_SND_HDA_PREALLOC_SIZE=64 CONFIG_SND_HDA_HWDEP=y CONFIG_SND_HDA_RECONFIG=y CONFIG_SND_HDA_INPUT_BEEP=y CONFIG_SND_HDA_INPUT_BEEP_MODE=0 CONFIG_SND_HDA_INPUT_JACK=y CONFIG_SND_HDA_PATCH_LOADER=y CONFIG_SND_HDA_CODEC_REALTEK=m # CONFIG_SND_HDA_CODEC_ANALOG is not set # CONFIG_SND_HDA_CODEC_SIGMATEL is not set # CONFIG_SND_HDA_CODEC_VIA is not set CONFIG_SND_HDA_CODEC_HDMI=m CONFIG_SND_HDA_I915=y # CONFIG_SND_HDA_CODEC_CIRRUS is not set # CONFIG_SND_HDA_CODEC_CONEXANT is not set # CONFIG_SND_HDA_CODEC_CA0110 is not set # CONFIG_SND_HDA_CODEC_CA0132 is not set # CONFIG_SND_HDA_CODEC_CMEDIA is not set # CONFIG_SND_HDA_CODEC_SI3054 is not set CONFIG_SND_HDA_GENERIC=m CONFIG_SND_HDA_POWER_SAVE_DEFAULT=0 CONFIG_SND_SPI=y CONFIG_SND_USB=y # CONFIG_SND_USB_AUDIO is not set # CONFIG_SND_USB_UA101 is not set # CONFIG_SND_USB_USX2Y is not set # CONFIG_SND_USB_CAIAQ is not set # CONFIG_SND_USB_US122L is not set # CONFIG_SND_USB_6FIRE is not set # CONFIG_SND_USB_HIFACE is not set # CONFIG_SND_BCD2000 is not set # CONFIG_SND_USB_POD is not set # CONFIG_SND_USB_PODHD is not set # CONFIG_SND_USB_TONEPORT is not set # CONFIG_SND_USB_VARIAX is not set # CONFIG_SND_SOC is not set # CONFIG_SOUND_PRIME is not set # # HID support # CONFIG_HID=m # CONFIG_HID_BATTERY_STRENGTH is not set # CONFIG_HIDRAW is not set # CONFIG_UHID is not set CONFIG_HID_GENERIC=m # # Special HID drivers # # CONFIG_HID_A4TECH is not set # CONFIG_HID_ACRUX is not set # CONFIG_HID_APPLE is not set # CONFIG_HID_APPLEIR is not set # CONFIG_HID_AUREAL is not set # CONFIG_HID_BELKIN is not set # CONFIG_HID_BETOP_FF is not set # CONFIG_HID_CHERRY is not set # CONFIG_HID_CHICONY is not set # CONFIG_HID_PRODIKEYS is not set # CONFIG_HID_CP2112 is not set # CONFIG_HID_CYPRESS is not set # CONFIG_HID_DRAGONRISE is not set # CONFIG_HID_EMS_FF is not set # CONFIG_HID_ELECOM is not set # CONFIG_HID_ELO is not set # CONFIG_HID_EZKEY is not set # CONFIG_HID_HOLTEK is not set # CONFIG_HID_GT683R is not set # CONFIG_HID_HUION is not set # CONFIG_HID_KEYTOUCH is not set # CONFIG_HID_KYE is not set # CONFIG_HID_UCLOGIC is not set # CONFIG_HID_WALTOP is not set # CONFIG_HID_GYRATION is not set # CONFIG_HID_ICADE is not set # CONFIG_HID_TWINHAN is not set # CONFIG_HID_KENSINGTON is not set # CONFIG_HID_LCPOWER is not set # CONFIG_HID_LENOVO is not set # CONFIG_HID_LOGITECH is not set # CONFIG_HID_MAGICMOUSE is not set # CONFIG_HID_MICROSOFT is not set # CONFIG_HID_MONTEREY is not set # CONFIG_HID_MULTITOUCH is not set # CONFIG_HID_NTRIG is not set # CONFIG_HID_ORTEK is not set # CONFIG_HID_PANTHERLORD is not set # CONFIG_HID_PENMOUNT is not set # CONFIG_HID_PETALYNX is not set # CONFIG_HID_PICOLCD is not set # CONFIG_HID_PLANTRONICS is not set # CONFIG_HID_PRIMAX is not set # CONFIG_HID_ROCCAT is not set # CONFIG_HID_SAITEK is not set # CONFIG_HID_SAMSUNG is not set # CONFIG_HID_SONY is not set # CONFIG_HID_SPEEDLINK is not set # CONFIG_HID_STEELSERIES is not set # CONFIG_HID_SUNPLUS is not set # CONFIG_HID_RMI is not set # CONFIG_HID_GREENASIA is not set # CONFIG_HID_SMARTJOYPLUS is not set # CONFIG_HID_TIVO is not set # CONFIG_HID_TOPSEED is not set # CONFIG_HID_THINGM is not set # CONFIG_HID_THRUSTMASTER is not set # CONFIG_HID_WACOM is not set # CONFIG_HID_WIIMOTE is not set # CONFIG_HID_XINMO is not set # CONFIG_HID_ZEROPLUS is not set # CONFIG_HID_ZYDACRON is not set # CONFIG_HID_SENSOR_HUB is not set # # USB HID support # CONFIG_USB_HID=m CONFIG_HID_PID=y CONFIG_USB_HIDDEV=y # # USB HID Boot Protocol drivers # CONFIG_USB_KBD=m CONFIG_USB_MOUSE=m # # I2C HID support # # CONFIG_I2C_HID is not set CONFIG_USB_OHCI_LITTLE_ENDIAN=y CONFIG_USB_SUPPORT=y CONFIG_USB_COMMON=y CONFIG_USB_ARCH_HAS_HCD=y CONFIG_USB=y CONFIG_USB_ANNOUNCE_NEW_DEVICES=y # # Miscellaneous USB options # CONFIG_USB_DEFAULT_PERSIST=y CONFIG_USB_DYNAMIC_MINORS=y # CONFIG_USB_OTG is not set # CONFIG_USB_OTG_WHITELIST is not set # CONFIG_USB_OTG_BLACKLIST_HUB is not set # CONFIG_USB_OTG_FSM is not set # CONFIG_USB_MON is not set # CONFIG_USB_WUSB_CBAF is not set # # USB Host Controller Drivers # # CONFIG_USB_C67X00_HCD is not set CONFIG_USB_XHCI_HCD=y CONFIG_USB_XHCI_PCI=y CONFIG_USB_EHCI_HCD=y CONFIG_USB_EHCI_ROOT_HUB_TT=y CONFIG_USB_EHCI_TT_NEWSCHED=y CONFIG_USB_EHCI_PCI=y CONFIG_USB_EHCI_HCD_PLATFORM=y # CONFIG_USB_OXU210HP_HCD is not set # CONFIG_USB_ISP116X_HCD is not set # CONFIG_USB_ISP1362_HCD is not set # CONFIG_USB_FUSBH200_HCD is not set # CONFIG_USB_FOTG210_HCD is not set # CONFIG_USB_MAX3421_HCD is not set CONFIG_USB_OHCI_HCD=y CONFIG_USB_OHCI_HCD_PCI=y CONFIG_USB_OHCI_HCD_PLATFORM=y CONFIG_USB_UHCI_HCD=y # CONFIG_USB_SL811_HCD is not set # CONFIG_USB_R8A66597_HCD is not set # CONFIG_USB_HCD_TEST_MODE is not set # # USB Device Class drivers # # CONFIG_USB_ACM is not set CONFIG_USB_PRINTER=m # CONFIG_USB_WDM is not set # CONFIG_USB_TMC is not set # # NOTE: USB_STORAGE depends on SCSI but BLK_DEV_SD may # # # also be needed; see USB_STORAGE Help for more info # CONFIG_USB_STORAGE=m # CONFIG_USB_STORAGE_DEBUG is not set # CONFIG_USB_STORAGE_REALTEK is not set # CONFIG_USB_STORAGE_DATAFAB is not set # CONFIG_USB_STORAGE_FREECOM is not set # CONFIG_USB_STORAGE_ISD200 is not set # CONFIG_USB_STORAGE_USBAT is not set # CONFIG_USB_STORAGE_SDDR09 is not set # CONFIG_USB_STORAGE_SDDR55 is not set # CONFIG_USB_STORAGE_JUMPSHOT is not set # CONFIG_USB_STORAGE_ALAUDA is not set # CONFIG_USB_STORAGE_ONETOUCH is not set # CONFIG_USB_STORAGE_KARMA is not set # CONFIG_USB_STORAGE_CYPRESS_ATACB is not set # CONFIG_USB_STORAGE_ENE_UB6250 is not set # CONFIG_USB_UAS is not set # # USB Imaging devices # # CONFIG_USB_MDC800 is not set # CONFIG_USB_MICROTEK is not set # CONFIG_USBIP_CORE is not set # CONFIG_USB_MUSB_HDRC is not set # CONFIG_USB_DWC3 is not set # CONFIG_USB_DWC2 is not set # CONFIG_USB_CHIPIDEA is not set # CONFIG_USB_ISP1760 is not set # # USB port drivers # # CONFIG_USB_USS720 is not set CONFIG_USB_SERIAL=m # CONFIG_USB_SERIAL_GENERIC is not set # CONFIG_USB_SERIAL_SIMPLE is not set # CONFIG_USB_SERIAL_AIRCABLE is not set # CONFIG_USB_SERIAL_ARK3116 is not set # CONFIG_USB_SERIAL_BELKIN is not set # CONFIG_USB_SERIAL_CH341 is not set # CONFIG_USB_SERIAL_WHITEHEAT is not set # CONFIG_USB_SERIAL_DIGI_ACCELEPORT is not set # CONFIG_USB_SERIAL_CP210X is not set # CONFIG_USB_SERIAL_CYPRESS_M8 is not set # CONFIG_USB_SERIAL_EMPEG is not set # CONFIG_USB_SERIAL_FTDI_SIO is not set # CONFIG_USB_SERIAL_VISOR is not set # CONFIG_USB_SERIAL_IPAQ is not set # CONFIG_USB_SERIAL_IR is not set # CONFIG_USB_SERIAL_EDGEPORT is not set # CONFIG_USB_SERIAL_EDGEPORT_TI is not set # CONFIG_USB_SERIAL_F81232 is not set # CONFIG_USB_SERIAL_GARMIN is not set # CONFIG_USB_SERIAL_IPW is not set # CONFIG_USB_SERIAL_IUU is not set # CONFIG_USB_SERIAL_KEYSPAN_PDA is not set # CONFIG_USB_SERIAL_KEYSPAN is not set # CONFIG_USB_SERIAL_KLSI is not set # CONFIG_USB_SERIAL_KOBIL_SCT is not set # CONFIG_USB_SERIAL_MCT_U232 is not set # CONFIG_USB_SERIAL_METRO is not set # CONFIG_USB_SERIAL_MOS7720 is not set # CONFIG_USB_SERIAL_MOS7840 is not set # CONFIG_USB_SERIAL_MXUPORT is not set # CONFIG_USB_SERIAL_NAVMAN is not set # CONFIG_USB_SERIAL_PL2303 is not set # CONFIG_USB_SERIAL_OTI6858 is not set # CONFIG_USB_SERIAL_QCAUX is not set # CONFIG_USB_SERIAL_QUALCOMM is not set # CONFIG_USB_SERIAL_SPCP8X5 is not set # CONFIG_USB_SERIAL_SAFE is not set # CONFIG_USB_SERIAL_SIERRAWIRELESS is not set # CONFIG_USB_SERIAL_SYMBOL is not set # CONFIG_USB_SERIAL_TI is not set # CONFIG_USB_SERIAL_CYBERJACK is not set # CONFIG_USB_SERIAL_XIRCOM is not set CONFIG_USB_SERIAL_WWAN=m CONFIG_USB_SERIAL_OPTION=m # CONFIG_USB_SERIAL_OMNINET is not set # CONFIG_USB_SERIAL_OPTICON is not set # CONFIG_USB_SERIAL_XSENS_MT is not set # CONFIG_USB_SERIAL_WISHBONE is not set # CONFIG_USB_SERIAL_SSU100 is not set # CONFIG_USB_SERIAL_QT2 is not set # CONFIG_USB_SERIAL_DEBUG is not set # # USB Miscellaneous drivers # # CONFIG_USB_EMI62 is not set # CONFIG_USB_EMI26 is not set # CONFIG_USB_ADUTUX is not set # CONFIG_USB_SEVSEG is not set # CONFIG_USB_RIO500 is not set # CONFIG_USB_LEGOTOWER is not set # CONFIG_USB_LCD is not set # CONFIG_USB_LED is not set # CONFIG_USB_CYPRESS_CY7C63 is not set # CONFIG_USB_CYTHERM is not set # CONFIG_USB_IDMOUSE is not set # CONFIG_USB_FTDI_ELAN is not set # CONFIG_USB_APPLEDISPLAY is not set # CONFIG_USB_SISUSBVGA is not set # CONFIG_USB_LD is not set # CONFIG_USB_TRANCEVIBRATOR is not set # CONFIG_USB_IOWARRIOR is not set # CONFIG_USB_TEST is not set # CONFIG_USB_EHSET_TEST_FIXTURE is not set # CONFIG_USB_ISIGHTFW is not set # CONFIG_USB_YUREX is not set # CONFIG_USB_EZUSB_FX2 is not set # CONFIG_USB_HSIC_USB3503 is not set # CONFIG_USB_LINK_LAYER_TEST is not set # # USB Physical Layer drivers # # CONFIG_USB_PHY is not set # CONFIG_NOP_USB_XCEIV is not set # CONFIG_USB_GPIO_VBUS is not set # CONFIG_USB_ISP1301 is not set # CONFIG_USB_GADGET is not set # CONFIG_USB_LED_TRIG is not set # CONFIG_UWB is not set CONFIG_MMC=y # CONFIG_MMC_DEBUG is not set # CONFIG_MMC_CLKGATE is not set # # MMC/SD/SDIO Card Drivers # CONFIG_MMC_BLOCK=m CONFIG_MMC_BLOCK_MINORS=8 CONFIG_MMC_BLOCK_BOUNCE=y # CONFIG_SDIO_UART is not set # CONFIG_MMC_TEST is not set # # MMC/SD/SDIO Host Controller Drivers # CONFIG_MMC_SDHCI=m # CONFIG_MMC_SDHCI_PCI is not set # CONFIG_MMC_SDHCI_ACPI is not set # CONFIG_MMC_SDHCI_PLTFM is not set # CONFIG_MMC_WBSD is not set # CONFIG_MMC_TIFM_SD is not set # CONFIG_MMC_SPI is not set # CONFIG_MMC_CB710 is not set # CONFIG_MMC_VIA_SDMMC is not set # CONFIG_MMC_VUB300 is not set # CONFIG_MMC_USHC is not set # CONFIG_MMC_USDHI6ROL0 is not set # CONFIG_MMC_TOSHIBA_PCI is not set # CONFIG_MEMSTICK is not set CONFIG_NEW_LEDS=y CONFIG_LEDS_CLASS=y # CONFIG_LEDS_CLASS_FLASH is not set # # LED drivers # # CONFIG_LEDS_88PM860X is not set # CONFIG_LEDS_LM3530 is not set # CONFIG_LEDS_LM3642 is not set # CONFIG_LEDS_PCA9532 is not set # CONFIG_LEDS_GPIO is not set # CONFIG_LEDS_LP3944 is not set # CONFIG_LEDS_LP5521 is not set # CONFIG_LEDS_LP5523 is not set # CONFIG_LEDS_LP5562 is not set # CONFIG_LEDS_LP8501 is not set # CONFIG_LEDS_LP8788 is not set # CONFIG_LEDS_LP8860 is not set # CONFIG_LEDS_CLEVO_MAIL is not set # CONFIG_LEDS_PCA955X is not set # CONFIG_LEDS_PCA963X is not set # CONFIG_LEDS_WM831X_STATUS is not set # CONFIG_LEDS_WM8350 is not set # CONFIG_LEDS_DA903X is not set # CONFIG_LEDS_DA9052 is not set # CONFIG_LEDS_DAC124S085 is not set # CONFIG_LEDS_PWM is not set # CONFIG_LEDS_REGULATOR is not set # CONFIG_LEDS_BD2802 is not set # CONFIG_LEDS_INTEL_SS4200 is not set # CONFIG_LEDS_LT3593 is not set # CONFIG_LEDS_ADP5520 is not set # CONFIG_LEDS_DELL_NETBOOKS is not set # CONFIG_LEDS_TCA6507 is not set # CONFIG_LEDS_MAX8997 is not set # CONFIG_LEDS_LM355x is not set # # LED driver for blink(1) USB RGB LED is under Special HID drivers (HID_THINGM) # # CONFIG_LEDS_BLINKM is not set # # LED Triggers # CONFIG_LEDS_TRIGGERS=y # CONFIG_LEDS_TRIGGER_TIMER is not set # CONFIG_LEDS_TRIGGER_ONESHOT is not set # CONFIG_LEDS_TRIGGER_HEARTBEAT is not set # CONFIG_LEDS_TRIGGER_BACKLIGHT is not set CONFIG_LEDS_TRIGGER_CPU=y # CONFIG_LEDS_TRIGGER_GPIO is not set # CONFIG_LEDS_TRIGGER_DEFAULT_ON is not set # # iptables trigger is under Netfilter config (LED target) # # CONFIG_LEDS_TRIGGER_TRANSIENT is not set # CONFIG_LEDS_TRIGGER_CAMERA is not set # CONFIG_ACCESSIBILITY is not set # CONFIG_INFINIBAND is not set CONFIG_EDAC=y CONFIG_EDAC_LEGACY_SYSFS=y # CONFIG_EDAC_DEBUG is not set # CONFIG_EDAC_DECODE_MCE is not set # CONFIG_EDAC_MM_EDAC is not set CONFIG_RTC_LIB=y CONFIG_RTC_CLASS=y CONFIG_RTC_HCTOSYS=y CONFIG_RTC_SYSTOHC=y CONFIG_RTC_HCTOSYS_DEVICE="rtc0" # CONFIG_RTC_DEBUG is not set # # RTC interfaces # CONFIG_RTC_INTF_SYSFS=y CONFIG_RTC_INTF_PROC=y CONFIG_RTC_INTF_DEV=y # CONFIG_RTC_INTF_DEV_UIE_EMUL is not set # CONFIG_RTC_DRV_TEST is not set # # I2C RTC drivers # # CONFIG_RTC_DRV_88PM860X is not set # CONFIG_RTC_DRV_ABB5ZES3 is not set # CONFIG_RTC_DRV_DS1307 is not set # CONFIG_RTC_DRV_DS1374 is not set # CONFIG_RTC_DRV_DS1672 is not set # CONFIG_RTC_DRV_DS3232 is not set # CONFIG_RTC_DRV_LP8788 is not set # CONFIG_RTC_DRV_MAX6900 is not set # CONFIG_RTC_DRV_MAX8925 is not set # CONFIG_RTC_DRV_MAX8998 is not set # CONFIG_RTC_DRV_MAX8997 is not set # CONFIG_RTC_DRV_RS5C372 is not set # CONFIG_RTC_DRV_ISL1208 is not set # CONFIG_RTC_DRV_ISL12022 is not set # CONFIG_RTC_DRV_ISL12057 is not set # CONFIG_RTC_DRV_X1205 is not set # CONFIG_RTC_DRV_PALMAS is not set # CONFIG_RTC_DRV_PCF2127 is not set # CONFIG_RTC_DRV_PCF8523 is not set # CONFIG_RTC_DRV_PCF8563 is not set # CONFIG_RTC_DRV_PCF85063 is not set # CONFIG_RTC_DRV_PCF8583 is not set # CONFIG_RTC_DRV_M41T80 is not set # CONFIG_RTC_DRV_BQ32K is not set # CONFIG_RTC_DRV_TPS6586X is not set # CONFIG_RTC_DRV_TPS65910 is not set # CONFIG_RTC_DRV_RC5T583 is not set # CONFIG_RTC_DRV_S35390A is not set # CONFIG_RTC_DRV_FM3130 is not set # CONFIG_RTC_DRV_RX8581 is not set # CONFIG_RTC_DRV_RX8025 is not set # CONFIG_RTC_DRV_EM3027 is not set # CONFIG_RTC_DRV_RV3029C2 is not set # CONFIG_RTC_DRV_S5M is not set # # SPI RTC drivers # # CONFIG_RTC_DRV_M41T93 is not set # CONFIG_RTC_DRV_M41T94 is not set # CONFIG_RTC_DRV_DS1305 is not set # CONFIG_RTC_DRV_DS1343 is not set # CONFIG_RTC_DRV_DS1347 is not set # CONFIG_RTC_DRV_DS1390 is not set # CONFIG_RTC_DRV_MAX6902 is not set # CONFIG_RTC_DRV_R9701 is not set # CONFIG_RTC_DRV_RS5C348 is not set # CONFIG_RTC_DRV_DS3234 is not set # CONFIG_RTC_DRV_PCF2123 is not set # CONFIG_RTC_DRV_RX4581 is not set # CONFIG_RTC_DRV_MCP795 is not set # # Platform RTC drivers # CONFIG_RTC_DRV_CMOS=y # CONFIG_RTC_DRV_DS1286 is not set # CONFIG_RTC_DRV_DS1511 is not set # CONFIG_RTC_DRV_DS1553 is not set # CONFIG_RTC_DRV_DS1685_FAMILY is not set # CONFIG_RTC_DRV_DS1742 is not set # CONFIG_RTC_DRV_DS2404 is not set # CONFIG_RTC_DRV_DA9052 is not set # CONFIG_RTC_DRV_DA9055 is not set # CONFIG_RTC_DRV_STK17TA8 is not set # CONFIG_RTC_DRV_M48T86 is not set # CONFIG_RTC_DRV_M48T35 is not set # CONFIG_RTC_DRV_M48T59 is not set # CONFIG_RTC_DRV_MSM6242 is not set # CONFIG_RTC_DRV_BQ4802 is not set # CONFIG_RTC_DRV_RP5C01 is not set # CONFIG_RTC_DRV_V3020 is not set # CONFIG_RTC_DRV_WM831X is not set # CONFIG_RTC_DRV_WM8350 is not set # CONFIG_RTC_DRV_AB3100 is not set # # on-CPU RTC drivers # # CONFIG_RTC_DRV_PCAP is not set # CONFIG_RTC_DRV_XGENE is not set # # HID Sensor RTC drivers # # CONFIG_RTC_DRV_HID_SENSOR_TIME is not set CONFIG_DMADEVICES=y # CONFIG_DMADEVICES_DEBUG is not set # # DMA Devices # # CONFIG_INTEL_MID_DMAC is not set # CONFIG_INTEL_IOATDMA is not set # CONFIG_DW_DMAC_CORE is not set # CONFIG_DW_DMAC is not set # CONFIG_DW_DMAC_PCI is not set CONFIG_DMA_ENGINE=y CONFIG_DMA_ACPI=y # # DMA Clients # # CONFIG_ASYNC_TX_DMA is not set # CONFIG_DMATEST is not set CONFIG_AUXDISPLAY=y # CONFIG_KS0108 is not set # CONFIG_UIO is not set # CONFIG_VFIO is not set CONFIG_VIRT_DRIVERS=y CONFIG_VIRTIO=y # # Virtio drivers # CONFIG_VIRTIO_PCI=y CONFIG_VIRTIO_PCI_LEGACY=y # CONFIG_VIRTIO_BALLOON is not set # CONFIG_VIRTIO_MMIO is not set # # Microsoft Hyper-V guest support # # CONFIG_HYPERV is not set # # Xen driver support # CONFIG_XEN_BALLOON=y CONFIG_XEN_SELFBALLOONING=y CONFIG_XEN_BALLOON_MEMORY_HOTPLUG=y CONFIG_XEN_BALLOON_MEMORY_HOTPLUG_LIMIT=512 CONFIG_XEN_SCRUB_PAGES=y # CONFIG_XEN_DEV_EVTCHN is not set CONFIG_XEN_BACKEND=y # CONFIG_XENFS is not set CONFIG_XEN_SYS_HYPERVISOR=y CONFIG_XEN_XENBUS_FRONTEND=y # CONFIG_XEN_GNTDEV is not set # CONFIG_XEN_GRANT_DEV_ALLOC is not set CONFIG_SWIOTLB_XEN=y CONFIG_XEN_TMEM=m # CONFIG_XEN_PCIDEV_BACKEND is not set CONFIG_XEN_PRIVCMD=m CONFIG_XEN_ACPI_PROCESSOR=y CONFIG_XEN_MCE_LOG=y CONFIG_XEN_HAVE_PVMMU=y CONFIG_XEN_EFI=y CONFIG_STAGING=y # CONFIG_SLICOSS is not set # CONFIG_PRISM2_USB is not set # CONFIG_COMEDI is not set # CONFIG_PANEL is not set # CONFIG_RTL8192U is not set # CONFIG_RTLLIB is not set # CONFIG_R8712U is not set # CONFIG_R8188EU is not set # CONFIG_R8723AU is not set # CONFIG_RTS5208 is not set # CONFIG_VT6655 is not set # CONFIG_VT6656 is not set # CONFIG_FB_SM7XX is not set # CONFIG_FB_XGI is not set # CONFIG_FT1000 is not set # # Speakup console speech # # CONFIG_SPEAKUP is not set # CONFIG_TOUCHSCREEN_SYNAPTICS_I2C_RMI4 is not set CONFIG_STAGING_MEDIA=y # CONFIG_I2C_BCM2048 is not set # CONFIG_DVB_CXD2099 is not set # CONFIG_VIDEO_DT3155 is not set # CONFIG_DVB_MN88472 is not set # CONFIG_DVB_MN88473 is not set # # Android # # CONFIG_USB_WPAN_HCD is not set # CONFIG_WIMAX_GDM72XX is not set # CONFIG_LTE_GDM724X is not set # CONFIG_LUSTRE_FS is not set # CONFIG_DGNC is not set # CONFIG_DGAP is not set # CONFIG_GS_FPGABOOT is not set # CONFIG_CRYPTO_SKEIN is not set # CONFIG_UNISYSSPAR is not set # CONFIG_FB_TFT is not set # CONFIG_I2O is not set CONFIG_X86_PLATFORM_DEVICES=y # CONFIG_ACER_WMI is not set # CONFIG_ACERHDF is not set # CONFIG_ALIENWARE_WMI is not set # CONFIG_ASUS_LAPTOP is not set # CONFIG_DELL_WMI is not set # CONFIG_DELL_WMI_AIO is not set # CONFIG_DELL_SMO8800 is not set # CONFIG_FUJITSU_LAPTOP is not set # CONFIG_FUJITSU_TABLET is not set # CONFIG_AMILO_RFKILL is not set # CONFIG_HP_ACCEL is not set # CONFIG_HP_WIRELESS is not set # CONFIG_HP_WMI is not set # CONFIG_MSI_LAPTOP is not set # CONFIG_PANASONIC_LAPTOP is not set # CONFIG_COMPAL_LAPTOP is not set # CONFIG_SONY_LAPTOP is not set # CONFIG_IDEAPAD_LAPTOP is not set # CONFIG_THINKPAD_ACPI is not set # CONFIG_SENSORS_HDAPS is not set # CONFIG_INTEL_MENLOW is not set # CONFIG_EEEPC_LAPTOP is not set # CONFIG_ASUS_WMI is not set CONFIG_ACPI_WMI=m # CONFIG_MSI_WMI is not set # CONFIG_TOPSTAR_LAPTOP is not set # CONFIG_ACPI_TOSHIBA is not set # CONFIG_TOSHIBA_BT_RFKILL is not set # CONFIG_TOSHIBA_HAPS is not set # CONFIG_ACPI_CMPC is not set # CONFIG_INTEL_IPS is not set # CONFIG_IBM_RTL is not set CONFIG_SAMSUNG_LAPTOP=m # CONFIG_MXM_WMI is not set # CONFIG_INTEL_OAKTRAIL is not set # CONFIG_SAMSUNG_Q10 is not set # CONFIG_APPLE_GMUX is not set CONFIG_INTEL_RST=m # CONFIG_INTEL_SMARTCONNECT is not set # CONFIG_PVPANIC is not set # CONFIG_CHROME_PLATFORMS is not set # # Hardware Spinlock drivers # # # Clock Source drivers # CONFIG_CLKEVT_I8253=y CONFIG_I8253_LOCK=y CONFIG_CLKBLD_I8253=y # CONFIG_ATMEL_PIT is not set # CONFIG_SH_TIMER_CMT is not set # CONFIG_SH_TIMER_MTU2 is not set # CONFIG_SH_TIMER_TMU is not set # CONFIG_EM_TIMER_STI is not set # CONFIG_MAILBOX is not set CONFIG_IOMMU_API=y CONFIG_IOMMU_SUPPORT=y # # Generic IOMMU Pagetable Support # CONFIG_IOMMU_IOVA=y CONFIG_AMD_IOMMU=y CONFIG_AMD_IOMMU_STATS=y # CONFIG_AMD_IOMMU_V2 is not set CONFIG_DMAR_TABLE=y CONFIG_INTEL_IOMMU=y # CONFIG_INTEL_IOMMU_DEFAULT_ON is not set CONFIG_INTEL_IOMMU_FLOPPY_WA=y CONFIG_IRQ_REMAP=y # # Remoteproc drivers # # CONFIG_STE_MODEM_RPROC is not set # # Rpmsg drivers # # # SOC (System On Chip) specific Drivers # # CONFIG_SOC_TI is not set CONFIG_PM_DEVFREQ=y # # DEVFREQ Governors # CONFIG_DEVFREQ_GOV_SIMPLE_ONDEMAND=y CONFIG_DEVFREQ_GOV_PERFORMANCE=y CONFIG_DEVFREQ_GOV_POWERSAVE=y CONFIG_DEVFREQ_GOV_USERSPACE=y # # DEVFREQ Drivers # # CONFIG_PM_DEVFREQ_EVENT is not set CONFIG_EXTCON=y # # Extcon Device Drivers # # CONFIG_EXTCON_GPIO is not set # CONFIG_EXTCON_MAX77693 is not set # CONFIG_EXTCON_MAX8997 is not set # CONFIG_EXTCON_PALMAS is not set # CONFIG_EXTCON_RT8973A is not set # CONFIG_EXTCON_SM5502 is not set CONFIG_MEMORY=y # CONFIG_IIO is not set # CONFIG_NTB is not set # CONFIG_VME_BUS is not set CONFIG_PWM=y CONFIG_PWM_SYSFS=y # CONFIG_PWM_LPSS is not set # CONFIG_IPACK_BUS is not set # CONFIG_RESET_CONTROLLER is not set # CONFIG_FMC is not set # # PHY Subsystem # # CONFIG_GENERIC_PHY is not set # CONFIG_BCM_KONA_USB2_PHY is not set # CONFIG_POWERCAP is not set # CONFIG_MCB is not set CONFIG_RAS=y # CONFIG_THUNDERBOLT is not set # # Android # # CONFIG_ANDROID is not set # # Firmware Drivers # CONFIG_EDD=y CONFIG_EDD_OFF=y CONFIG_FIRMWARE_MEMMAP=y # CONFIG_DELL_RBU is not set # CONFIG_DCDBAS is not set CONFIG_DMIID=y # CONFIG_DMI_SYSFS is not set CONFIG_DMI_SCAN_MACHINE_NON_EFI_FALLBACK=y CONFIG_ISCSI_IBFT_FIND=y # CONFIG_ISCSI_IBFT is not set # CONFIG_GOOGLE_FIRMWARE is not set # # EFI (Extensible Firmware Interface) Support # CONFIG_EFI_VARS=y CONFIG_EFI_VARS_PSTORE=y # CONFIG_EFI_VARS_PSTORE_DEFAULT_DISABLE is not set CONFIG_EFI_RUNTIME_MAP=y CONFIG_EFI_RUNTIME_WRAPPERS=y CONFIG_UEFI_CPER=y # # File systems # CONFIG_DCACHE_WORD_ACCESS=y # CONFIG_EXT2_FS is not set # CONFIG_EXT3_FS is not set CONFIG_EXT4_FS=y CONFIG_EXT4_USE_FOR_EXT23=y CONFIG_EXT4_FS_POSIX_ACL=y CONFIG_EXT4_FS_SECURITY=y # CONFIG_EXT4_DEBUG is not set CONFIG_JBD2=y # CONFIG_JBD2_DEBUG is not set CONFIG_FS_MBCACHE=y # CONFIG_REISERFS_FS is not set # CONFIG_JFS_FS is not set CONFIG_XFS_FS=m CONFIG_XFS_QUOTA=y CONFIG_XFS_POSIX_ACL=y CONFIG_XFS_RT=y # CONFIG_XFS_WARN is not set # CONFIG_XFS_DEBUG is not set # CONFIG_GFS2_FS is not set CONFIG_BTRFS_FS=m CONFIG_BTRFS_FS_POSIX_ACL=y # CONFIG_BTRFS_FS_CHECK_INTEGRITY is not set # CONFIG_BTRFS_FS_RUN_SANITY_TESTS is not set # CONFIG_BTRFS_DEBUG is not set # CONFIG_BTRFS_ASSERT is not set # CONFIG_NILFS2_FS is not set # CONFIG_FS_DAX is not set CONFIG_FS_POSIX_ACL=y CONFIG_EXPORTFS=y CONFIG_FILE_LOCKING=y CONFIG_FSNOTIFY=y CONFIG_DNOTIFY=y CONFIG_INOTIFY_USER=y CONFIG_FANOTIFY=y CONFIG_FANOTIFY_ACCESS_PERMISSIONS=y CONFIG_QUOTA=y CONFIG_QUOTA_NETLINK_INTERFACE=y # CONFIG_PRINT_QUOTA_WARNING is not set # CONFIG_QUOTA_DEBUG is not set # CONFIG_QFMT_V1 is not set # CONFIG_QFMT_V2 is not set CONFIG_QUOTACTL=y CONFIG_QUOTACTL_COMPAT=y # CONFIG_AUTOFS4_FS is not set CONFIG_FUSE_FS=y # CONFIG_CUSE is not set CONFIG_OVERLAY_FS=m # # Caches # # CONFIG_FSCACHE is not set # # CD-ROM/DVD Filesystems # CONFIG_ISO9660_FS=m CONFIG_JOLIET=y # CONFIG_ZISOFS is not set CONFIG_UDF_FS=m CONFIG_UDF_NLS=y # # DOS/FAT/NT Filesystems # CONFIG_FAT_FS=y # CONFIG_MSDOS_FS is not set CONFIG_VFAT_FS=y CONFIG_FAT_DEFAULT_CODEPAGE=437 CONFIG_FAT_DEFAULT_IOCHARSET="iso8859-1" CONFIG_NTFS_FS=m # CONFIG_NTFS_DEBUG is not set # CONFIG_NTFS_RW is not set # # Pseudo filesystems # CONFIG_PROC_FS=y CONFIG_PROC_KCORE=y CONFIG_PROC_VMCORE=y CONFIG_PROC_SYSCTL=y CONFIG_PROC_PAGE_MONITOR=y CONFIG_KERNFS=y CONFIG_SYSFS=y CONFIG_TMPFS=y CONFIG_TMPFS_POSIX_ACL=y CONFIG_TMPFS_XATTR=y CONFIG_HUGETLBFS=y CONFIG_HUGETLB_PAGE=y # CONFIG_CONFIGFS_FS is not set # CONFIG_EFIVAR_FS is not set CONFIG_MISC_FILESYSTEMS=y # CONFIG_ADFS_FS is not set # CONFIG_AFFS_FS is not set CONFIG_ECRYPT_FS=y # CONFIG_ECRYPT_FS_MESSAGING is not set # CONFIG_HFS_FS is not set # CONFIG_HFSPLUS_FS is not set # CONFIG_BEFS_FS is not set # CONFIG_BFS_FS is not set # CONFIG_EFS_FS is not set # CONFIG_LOGFS is not set # CONFIG_CRAMFS is not set CONFIG_SQUASHFS=m # CONFIG_SQUASHFS_FILE_CACHE is not set CONFIG_SQUASHFS_FILE_DIRECT=y # CONFIG_SQUASHFS_DECOMP_SINGLE is not set # CONFIG_SQUASHFS_DECOMP_MULTI is not set CONFIG_SQUASHFS_DECOMP_MULTI_PERCPU=y CONFIG_SQUASHFS_XATTR=y CONFIG_SQUASHFS_ZLIB=y CONFIG_SQUASHFS_LZ4=y CONFIG_SQUASHFS_LZO=y CONFIG_SQUASHFS_XZ=y # CONFIG_SQUASHFS_4K_DEVBLK_SIZE is not set # CONFIG_SQUASHFS_EMBEDDED is not set CONFIG_SQUASHFS_FRAGMENT_CACHE_SIZE=3 # CONFIG_VXFS_FS is not set # CONFIG_MINIX_FS is not set # CONFIG_OMFS_FS is not set # CONFIG_HPFS_FS is not set # CONFIG_QNX4FS_FS is not set # CONFIG_QNX6FS_FS is not set # CONFIG_ROMFS_FS is not set CONFIG_PSTORE=y # CONFIG_PSTORE_CONSOLE is not set # CONFIG_PSTORE_PMSG is not set # CONFIG_PSTORE_FTRACE is not set # CONFIG_PSTORE_RAM is not set # CONFIG_SYSV_FS is not set # CONFIG_UFS_FS is not set # CONFIG_F2FS_FS is not set CONFIG_NETWORK_FILESYSTEMS=y # CONFIG_NFS_FS is not set # CONFIG_NFSD is not set # CONFIG_CEPH_FS is not set # CONFIG_CIFS is not set # CONFIG_NCP_FS is not set # CONFIG_CODA_FS is not set # CONFIG_AFS_FS is not set CONFIG_NLS=y CONFIG_NLS_DEFAULT="utf8" CONFIG_NLS_CODEPAGE_437=y # CONFIG_NLS_CODEPAGE_737 is not set # CONFIG_NLS_CODEPAGE_775 is not set # CONFIG_NLS_CODEPAGE_850 is not set # CONFIG_NLS_CODEPAGE_852 is not set # CONFIG_NLS_CODEPAGE_855 is not set # CONFIG_NLS_CODEPAGE_857 is not set # CONFIG_NLS_CODEPAGE_860 is not set # CONFIG_NLS_CODEPAGE_861 is not set # CONFIG_NLS_CODEPAGE_862 is not set # CONFIG_NLS_CODEPAGE_863 is not set # CONFIG_NLS_CODEPAGE_864 is not set # CONFIG_NLS_CODEPAGE_865 is not set # CONFIG_NLS_CODEPAGE_866 is not set # CONFIG_NLS_CODEPAGE_869 is not set # CONFIG_NLS_CODEPAGE_936 is not set # CONFIG_NLS_CODEPAGE_950 is not set # CONFIG_NLS_CODEPAGE_932 is not set # CONFIG_NLS_CODEPAGE_949 is not set # CONFIG_NLS_CODEPAGE_874 is not set # CONFIG_NLS_ISO8859_8 is not set # CONFIG_NLS_CODEPAGE_1250 is not set # CONFIG_NLS_CODEPAGE_1251 is not set # CONFIG_NLS_ASCII is not set CONFIG_NLS_ISO8859_1=m # CONFIG_NLS_ISO8859_2 is not set # CONFIG_NLS_ISO8859_3 is not set # CONFIG_NLS_ISO8859_4 is not set # CONFIG_NLS_ISO8859_5 is not set # CONFIG_NLS_ISO8859_6 is not set # CONFIG_NLS_ISO8859_7 is not set # CONFIG_NLS_ISO8859_9 is not set # CONFIG_NLS_ISO8859_13 is not set # CONFIG_NLS_ISO8859_14 is not set # CONFIG_NLS_ISO8859_15 is not set # CONFIG_NLS_KOI8_R is not set # CONFIG_NLS_KOI8_U is not set # CONFIG_NLS_MAC_ROMAN is not set # CONFIG_NLS_MAC_CELTIC is not set # CONFIG_NLS_MAC_CENTEURO is not set # CONFIG_NLS_MAC_CROATIAN is not set # CONFIG_NLS_MAC_CYRILLIC is not set # CONFIG_NLS_MAC_GAELIC is not set # CONFIG_NLS_MAC_GREEK is not set # CONFIG_NLS_MAC_ICELAND is not set # CONFIG_NLS_MAC_INUIT is not set # CONFIG_NLS_MAC_ROMANIAN is not set # CONFIG_NLS_MAC_TURKISH is not set # CONFIG_NLS_UTF8 is not set # # Kernel hacking # CONFIG_TRACE_IRQFLAGS_SUPPORT=y # # printk and dmesg options # CONFIG_PRINTK_TIME=y CONFIG_MESSAGE_LOGLEVEL_DEFAULT=4 CONFIG_BOOT_PRINTK_DELAY=y # CONFIG_DYNAMIC_DEBUG is not set # # Compile-time checks and compiler options # # CONFIG_DEBUG_INFO is not set # CONFIG_ENABLE_WARN_DEPRECATED is not set # CONFIG_ENABLE_MUST_CHECK is not set CONFIG_FRAME_WARN=1024 # CONFIG_STRIP_ASM_SYMS is not set # CONFIG_READABLE_ASM is not set CONFIG_UNUSED_SYMBOLS=y # CONFIG_PAGE_OWNER is not set CONFIG_DEBUG_FS=y # CONFIG_HEADERS_CHECK is not set # CONFIG_DEBUG_SECTION_MISMATCH is not set CONFIG_ARCH_WANT_FRAME_POINTERS=y CONFIG_FRAME_POINTER=y # CONFIG_DEBUG_FORCE_WEAK_PER_CPU is not set CONFIG_MAGIC_SYSRQ=y CONFIG_MAGIC_SYSRQ_DEFAULT_ENABLE=0x1 CONFIG_DEBUG_KERNEL=y # # Memory Debugging # # CONFIG_PAGE_EXTENSION is not set # CONFIG_DEBUG_PAGEALLOC is not set # CONFIG_DEBUG_OBJECTS is not set # CONFIG_DEBUG_SLAB is not set CONFIG_HAVE_DEBUG_KMEMLEAK=y # CONFIG_DEBUG_KMEMLEAK is not set # CONFIG_DEBUG_STACK_USAGE is not set # CONFIG_DEBUG_VM is not set # CONFIG_DEBUG_VIRTUAL is not set # CONFIG_DEBUG_MEMORY_INIT is not set # CONFIG_DEBUG_PER_CPU_MAPS is not set CONFIG_HAVE_DEBUG_STACKOVERFLOW=y # CONFIG_DEBUG_STACKOVERFLOW is not set CONFIG_HAVE_ARCH_KMEMCHECK=y CONFIG_HAVE_ARCH_KASAN=y CONFIG_KASAN_SHADOW_OFFSET=0xdffffc0000000000 # CONFIG_DEBUG_SHIRQ is not set # # Debug Lockups and Hangs # CONFIG_LOCKUP_DETECTOR=y CONFIG_HARDLOCKUP_DETECTOR=y # CONFIG_BOOTPARAM_HARDLOCKUP_PANIC is not set CONFIG_BOOTPARAM_HARDLOCKUP_PANIC_VALUE=0 # CONFIG_BOOTPARAM_SOFTLOCKUP_PANIC is not set CONFIG_BOOTPARAM_SOFTLOCKUP_PANIC_VALUE=0 CONFIG_DETECT_HUNG_TASK=y CONFIG_DEFAULT_HUNG_TASK_TIMEOUT=120 # CONFIG_BOOTPARAM_HUNG_TASK_PANIC is not set CONFIG_BOOTPARAM_HUNG_TASK_PANIC_VALUE=0 # CONFIG_PANIC_ON_OOPS is not set CONFIG_PANIC_ON_OOPS_VALUE=0 CONFIG_PANIC_TIMEOUT=0 CONFIG_SCHED_DEBUG=y CONFIG_SCHEDSTATS=y # CONFIG_SCHED_STACK_END_CHECK is not set CONFIG_TIMER_STATS=y # # Lock Debugging (spinlocks, mutexes, etc...) # CONFIG_DEBUG_RT_MUTEXES=y CONFIG_DEBUG_SPINLOCK=y CONFIG_DEBUG_MUTEXES=y # CONFIG_DEBUG_WW_MUTEX_SLOWPATH is not set CONFIG_DEBUG_LOCK_ALLOC=y CONFIG_PROVE_LOCKING=y CONFIG_LOCKDEP=y # CONFIG_LOCK_STAT is not set # CONFIG_DEBUG_LOCKDEP is not set CONFIG_DEBUG_ATOMIC_SLEEP=y # CONFIG_DEBUG_LOCKING_API_SELFTESTS is not set # CONFIG_LOCK_TORTURE_TEST is not set CONFIG_TRACE_IRQFLAGS=y CONFIG_STACKTRACE=y # CONFIG_DEBUG_KOBJECT is not set CONFIG_DEBUG_BUGVERBOSE=y # CONFIG_DEBUG_LIST is not set CONFIG_DEBUG_PI_LIST=y # CONFIG_DEBUG_SG is not set # CONFIG_DEBUG_NOTIFIERS is not set # CONFIG_DEBUG_CREDENTIALS is not set # # RCU Debugging # # CONFIG_PROVE_RCU is not set # CONFIG_SPARSE_RCU_POINTER is not set # CONFIG_TORTURE_TEST is not set # CONFIG_RCU_TORTURE_TEST is not set CONFIG_RCU_CPU_STALL_TIMEOUT=60 # CONFIG_RCU_CPU_STALL_INFO is not set # CONFIG_RCU_TRACE is not set # CONFIG_DEBUG_BLOCK_EXT_DEVT is not set # CONFIG_NOTIFIER_ERROR_INJECTION is not set # CONFIG_FAULT_INJECTION is not set CONFIG_LATENCYTOP=y CONFIG_ARCH_HAS_DEBUG_STRICT_USER_COPY_CHECKS=y # CONFIG_DEBUG_STRICT_USER_COPY_CHECKS is not set CONFIG_USER_STACKTRACE_SUPPORT=y CONFIG_NOP_TRACER=y CONFIG_HAVE_FUNCTION_TRACER=y CONFIG_HAVE_FUNCTION_GRAPH_TRACER=y CONFIG_HAVE_FUNCTION_GRAPH_FP_TEST=y CONFIG_HAVE_DYNAMIC_FTRACE=y CONFIG_HAVE_DYNAMIC_FTRACE_WITH_REGS=y CONFIG_HAVE_FTRACE_MCOUNT_RECORD=y CONFIG_HAVE_SYSCALL_TRACEPOINTS=y CONFIG_HAVE_FENTRY=y CONFIG_HAVE_C_RECORDMCOUNT=y CONFIG_TRACER_MAX_TRACE=y CONFIG_TRACE_CLOCK=y CONFIG_RING_BUFFER=y CONFIG_EVENT_TRACING=y CONFIG_CONTEXT_SWITCH_TRACER=y CONFIG_TRACING=y CONFIG_GENERIC_TRACER=y CONFIG_TRACING_SUPPORT=y CONFIG_FTRACE=y CONFIG_FUNCTION_TRACER=y CONFIG_FUNCTION_GRAPH_TRACER=y # CONFIG_IRQSOFF_TRACER is not set CONFIG_SCHED_TRACER=y CONFIG_FTRACE_SYSCALLS=y CONFIG_TRACER_SNAPSHOT=y # CONFIG_TRACER_SNAPSHOT_PER_CPU_SWAP is not set CONFIG_BRANCH_PROFILE_NONE=y # CONFIG_PROFILE_ANNOTATED_BRANCHES is not set # CONFIG_PROFILE_ALL_BRANCHES is not set CONFIG_STACK_TRACER=y CONFIG_BLK_DEV_IO_TRACE=y CONFIG_KPROBE_EVENT=y CONFIG_UPROBE_EVENT=y CONFIG_PROBE_EVENTS=y CONFIG_DYNAMIC_FTRACE=y CONFIG_DYNAMIC_FTRACE_WITH_REGS=y CONFIG_FUNCTION_PROFILER=y CONFIG_FTRACE_MCOUNT_RECORD=y # CONFIG_FTRACE_STARTUP_TEST is not set CONFIG_MMIOTRACE=y # CONFIG_MMIOTRACE_TEST is not set # CONFIG_TRACEPOINT_BENCHMARK is not set # CONFIG_RING_BUFFER_BENCHMARK is not set # CONFIG_RING_BUFFER_STARTUP_TEST is not set # # Runtime Testing # # CONFIG_LKDTM is not set # CONFIG_TEST_LIST_SORT is not set # CONFIG_KPROBES_SANITY_TEST is not set # CONFIG_BACKTRACE_SELF_TEST is not set # CONFIG_RBTREE_TEST is not set # CONFIG_INTERVAL_TREE_TEST is not set # CONFIG_PERCPU_TEST is not set # CONFIG_ATOMIC64_SELFTEST is not set # CONFIG_TEST_HEXDUMP is not set # CONFIG_TEST_STRING_HELPERS is not set # CONFIG_TEST_KSTRTOX is not set # CONFIG_TEST_RHASHTABLE is not set # CONFIG_PROVIDE_OHCI1394_DMA_INIT is not set # CONFIG_DMA_API_DEBUG is not set # CONFIG_TEST_LKM is not set # CONFIG_TEST_USER_COPY is not set # CONFIG_TEST_BPF is not set # CONFIG_TEST_FIRMWARE is not set # CONFIG_TEST_UDELAY is not set # CONFIG_SAMPLES is not set CONFIG_HAVE_ARCH_KGDB=y CONFIG_KGDB=y CONFIG_KGDB_SERIAL_CONSOLE=y # CONFIG_KGDB_TESTS is not set CONFIG_KGDB_LOW_LEVEL_TRAP=y CONFIG_KGDB_KDB=y CONFIG_KDB_DEFAULT_ENABLE=0x1 CONFIG_KDB_KEYBOARD=y CONFIG_KDB_CONTINUE_CATASTROPHIC=0 CONFIG_STRICT_DEVMEM=y # CONFIG_X86_VERBOSE_BOOTUP is not set CONFIG_EARLY_PRINTK=y CONFIG_EARLY_PRINTK_DBGP=y # CONFIG_EARLY_PRINTK_EFI is not set # CONFIG_X86_PTDUMP is not set CONFIG_DEBUG_RODATA=y # CONFIG_DEBUG_RODATA_TEST is not set CONFIG_DEBUG_SET_MODULE_RONX=y # CONFIG_DEBUG_NX_TEST is not set CONFIG_DOUBLEFAULT=y # CONFIG_DEBUG_TLBFLUSH is not set # CONFIG_IOMMU_DEBUG is not set # CONFIG_IOMMU_STRESS is not set CONFIG_HAVE_MMIOTRACE_SUPPORT=y # CONFIG_X86_DECODER_SELFTEST is not set CONFIG_IO_DELAY_TYPE_0X80=0 CONFIG_IO_DELAY_TYPE_0XED=1 CONFIG_IO_DELAY_TYPE_UDELAY=2 CONFIG_IO_DELAY_TYPE_NONE=3 # CONFIG_IO_DELAY_0X80 is not set CONFIG_IO_DELAY_0XED=y # CONFIG_IO_DELAY_UDELAY is not set # CONFIG_IO_DELAY_NONE is not set CONFIG_DEFAULT_IO_DELAY_TYPE=1 # CONFIG_DEBUG_BOOT_PARAMS is not set # CONFIG_CPA_DEBUG is not set CONFIG_OPTIMIZE_INLINING=y # CONFIG_DEBUG_NMI_SELFTEST is not set # CONFIG_X86_DEBUG_STATIC_CPU_HAS is not set # # Security options # CONFIG_KEYS=y # CONFIG_PERSISTENT_KEYRINGS is not set # CONFIG_BIG_KEYS is not set CONFIG_TRUSTED_KEYS=y CONFIG_ENCRYPTED_KEYS=y # CONFIG_SECURITY_DMESG_RESTRICT is not set CONFIG_SECURITY=y CONFIG_SECURITYFS=y CONFIG_SECURITY_NETWORK=y CONFIG_SECURITY_PATH=y CONFIG_INTEL_TXT=y CONFIG_LSM_MMAP_MIN_ADDR=0 CONFIG_SECURITY_SELINUX=y CONFIG_SECURITY_SELINUX_BOOTPARAM=y CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE=0 CONFIG_SECURITY_SELINUX_DISABLE=y CONFIG_SECURITY_SELINUX_DEVELOP=y CONFIG_SECURITY_SELINUX_AVC_STATS=y CONFIG_SECURITY_SELINUX_CHECKREQPROT_VALUE=1 # CONFIG_SECURITY_SELINUX_POLICYDB_VERSION_MAX is not set CONFIG_SECURITY_SMACK=y # CONFIG_SECURITY_SMACK_BRINGUP is not set # CONFIG_SECURITY_SMACK_NETFILTER is not set CONFIG_SECURITY_TOMOYO=y CONFIG_SECURITY_TOMOYO_MAX_ACCEPT_ENTRY=2048 CONFIG_SECURITY_TOMOYO_MAX_AUDIT_LOG=1024 # CONFIG_SECURITY_TOMOYO_OMIT_USERSPACE_LOADER is not set CONFIG_SECURITY_TOMOYO_POLICY_LOADER="/sbin/tomoyo-init" CONFIG_SECURITY_TOMOYO_ACTIVATION_TRIGGER="/sbin/init" CONFIG_SECURITY_APPARMOR=y CONFIG_SECURITY_APPARMOR_BOOTPARAM_VALUE=1 CONFIG_SECURITY_APPARMOR_HASH=y CONFIG_SECURITY_YAMA=y CONFIG_SECURITY_YAMA_STACKED=y CONFIG_INTEGRITY=y CONFIG_INTEGRITY_SIGNATURE=y # CONFIG_INTEGRITY_ASYMMETRIC_KEYS is not set CONFIG_INTEGRITY_AUDIT=y # CONFIG_IMA is not set CONFIG_EVM=y CONFIG_EVM_ATTR_FSUUID=y # CONFIG_EVM_EXTRA_SMACK_XATTRS is not set # CONFIG_DEFAULT_SECURITY_SELINUX is not set # CONFIG_DEFAULT_SECURITY_SMACK is not set # CONFIG_DEFAULT_SECURITY_TOMOYO is not set CONFIG_DEFAULT_SECURITY_APPARMOR=y # CONFIG_DEFAULT_SECURITY_YAMA is not set # CONFIG_DEFAULT_SECURITY_DAC is not set CONFIG_DEFAULT_SECURITY="apparmor" CONFIG_XOR_BLOCKS=m CONFIG_CRYPTO=y # # Crypto core or helper # CONFIG_CRYPTO_ALGAPI=y CONFIG_CRYPTO_ALGAPI2=y CONFIG_CRYPTO_AEAD=m CONFIG_CRYPTO_AEAD2=y CONFIG_CRYPTO_BLKCIPHER=y CONFIG_CRYPTO_BLKCIPHER2=y CONFIG_CRYPTO_HASH=y CONFIG_CRYPTO_HASH2=y CONFIG_CRYPTO_RNG=y CONFIG_CRYPTO_RNG2=y CONFIG_CRYPTO_PCOMP2=y CONFIG_CRYPTO_MANAGER=y CONFIG_CRYPTO_MANAGER2=y # CONFIG_CRYPTO_USER is not set CONFIG_CRYPTO_MANAGER_DISABLE_TESTS=y CONFIG_CRYPTO_GF128MUL=m CONFIG_CRYPTO_NULL=m # CONFIG_CRYPTO_PCRYPT is not set CONFIG_CRYPTO_WORKQUEUE=y # CONFIG_CRYPTO_CRYPTD is not set # CONFIG_CRYPTO_MCRYPTD is not set # CONFIG_CRYPTO_AUTHENC is not set # CONFIG_CRYPTO_TEST is not set # # Authenticated Encryption with Associated Data # CONFIG_CRYPTO_CCM=m CONFIG_CRYPTO_GCM=m CONFIG_CRYPTO_SEQIV=m # # Block modes # CONFIG_CRYPTO_CBC=y CONFIG_CRYPTO_CTR=m # CONFIG_CRYPTO_CTS is not set CONFIG_CRYPTO_ECB=y # CONFIG_CRYPTO_LRW is not set # CONFIG_CRYPTO_PCBC is not set # CONFIG_CRYPTO_XTS is not set # # Hash modes # CONFIG_CRYPTO_CMAC=m CONFIG_CRYPTO_HMAC=y # CONFIG_CRYPTO_XCBC is not set # CONFIG_CRYPTO_VMAC is not set # # Digest # CONFIG_CRYPTO_CRC32C=y CONFIG_CRYPTO_CRC32C_INTEL=y # CONFIG_CRYPTO_CRC32 is not set # CONFIG_CRYPTO_CRC32_PCLMUL is not set CONFIG_CRYPTO_CRCT10DIF=y # CONFIG_CRYPTO_CRCT10DIF_PCLMUL is not set CONFIG_CRYPTO_GHASH=m # CONFIG_CRYPTO_MD4 is not set CONFIG_CRYPTO_MD5=y # CONFIG_CRYPTO_MICHAEL_MIC is not set # CONFIG_CRYPTO_RMD128 is not set # CONFIG_CRYPTO_RMD160 is not set # CONFIG_CRYPTO_RMD256 is not set # CONFIG_CRYPTO_RMD320 is not set CONFIG_CRYPTO_SHA1=y # CONFIG_CRYPTO_SHA1_SSSE3 is not set # CONFIG_CRYPTO_SHA256_SSSE3 is not set # CONFIG_CRYPTO_SHA512_SSSE3 is not set # CONFIG_CRYPTO_SHA1_MB is not set CONFIG_CRYPTO_SHA256=y CONFIG_CRYPTO_SHA512=y # CONFIG_CRYPTO_TGR192 is not set # CONFIG_CRYPTO_WP512 is not set # CONFIG_CRYPTO_GHASH_CLMUL_NI_INTEL is not set # # Ciphers # CONFIG_CRYPTO_AES=y # CONFIG_CRYPTO_AES_X86_64 is not set # CONFIG_CRYPTO_AES_NI_INTEL is not set # CONFIG_CRYPTO_ANUBIS is not set CONFIG_CRYPTO_ARC4=m # CONFIG_CRYPTO_BLOWFISH is not set # CONFIG_CRYPTO_BLOWFISH_X86_64 is not set # CONFIG_CRYPTO_CAMELLIA is not set # CONFIG_CRYPTO_CAMELLIA_X86_64 is not set # CONFIG_CRYPTO_CAMELLIA_AESNI_AVX_X86_64 is not set # CONFIG_CRYPTO_CAMELLIA_AESNI_AVX2_X86_64 is not set # CONFIG_CRYPTO_CAST5 is not set # CONFIG_CRYPTO_CAST5_AVX_X86_64 is not set # CONFIG_CRYPTO_CAST6 is not set # CONFIG_CRYPTO_CAST6_AVX_X86_64 is not set # CONFIG_CRYPTO_DES is not set # CONFIG_CRYPTO_DES3_EDE_X86_64 is not set # CONFIG_CRYPTO_FCRYPT is not set # CONFIG_CRYPTO_KHAZAD is not set # CONFIG_CRYPTO_SALSA20 is not set # CONFIG_CRYPTO_SALSA20_X86_64 is not set # CONFIG_CRYPTO_SEED is not set # CONFIG_CRYPTO_SERPENT is not set # CONFIG_CRYPTO_SERPENT_SSE2_X86_64 is not set # CONFIG_CRYPTO_SERPENT_AVX_X86_64 is not set # CONFIG_CRYPTO_SERPENT_AVX2_X86_64 is not set # CONFIG_CRYPTO_TEA is not set # CONFIG_CRYPTO_TWOFISH is not set # CONFIG_CRYPTO_TWOFISH_X86_64 is not set # CONFIG_CRYPTO_TWOFISH_X86_64_3WAY is not set # CONFIG_CRYPTO_TWOFISH_AVX_X86_64 is not set # # Compression # # CONFIG_CRYPTO_DEFLATE is not set # CONFIG_CRYPTO_ZLIB is not set CONFIG_CRYPTO_LZO=y CONFIG_CRYPTO_LZ4=m CONFIG_CRYPTO_LZ4HC=m # # Random Number Generation # # CONFIG_CRYPTO_ANSI_CPRNG is not set # CONFIG_CRYPTO_DRBG_MENU is not set # CONFIG_CRYPTO_USER_API_HASH is not set # CONFIG_CRYPTO_USER_API_SKCIPHER is not set # CONFIG_CRYPTO_USER_API_RNG is not set CONFIG_CRYPTO_HASH_INFO=y CONFIG_CRYPTO_HW=y CONFIG_CRYPTO_DEV_PADLOCK=y # CONFIG_CRYPTO_DEV_PADLOCK_AES is not set # CONFIG_CRYPTO_DEV_PADLOCK_SHA is not set # CONFIG_CRYPTO_DEV_CCP is not set # CONFIG_CRYPTO_DEV_QAT_DH895xCC is not set CONFIG_ASYMMETRIC_KEY_TYPE=y CONFIG_ASYMMETRIC_PUBLIC_KEY_SUBTYPE=y CONFIG_PUBLIC_KEY_ALGO_RSA=y CONFIG_X509_CERTIFICATE_PARSER=y # CONFIG_PKCS7_MESSAGE_PARSER is not set CONFIG_HAVE_KVM=y CONFIG_KVM_COMPAT=y CONFIG_VIRTUALIZATION=y # CONFIG_KVM is not set CONFIG_BINARY_PRINTF=y # # Library routines # CONFIG_RAID6_PQ=m CONFIG_BITREVERSE=y # CONFIG_HAVE_ARCH_BITREVERSE is not set CONFIG_GENERIC_STRNCPY_FROM_USER=y CONFIG_GENERIC_STRNLEN_USER=y CONFIG_GENERIC_NET_UTILS=y CONFIG_GENERIC_FIND_FIRST_BIT=y CONFIG_GENERIC_PCI_IOMAP=y CONFIG_GENERIC_IOMAP=y CONFIG_GENERIC_IO=y CONFIG_PERCPU_RWSEM=y CONFIG_ARCH_USE_CMPXCHG_LOCKREF=y CONFIG_ARCH_HAS_FAST_MULTIPLIER=y CONFIG_CRC_CCITT=m CONFIG_CRC16=y CONFIG_CRC_T10DIF=y CONFIG_CRC_ITU_T=m CONFIG_CRC32=y # CONFIG_CRC32_SELFTEST is not set CONFIG_CRC32_SLICEBY8=y # CONFIG_CRC32_SLICEBY4 is not set # CONFIG_CRC32_SARWATE is not set # CONFIG_CRC32_BIT is not set # CONFIG_CRC7 is not set CONFIG_LIBCRC32C=m # CONFIG_CRC8 is not set # CONFIG_AUDIT_ARCH_COMPAT_GENERIC is not set # CONFIG_RANDOM32_SELFTEST is not set CONFIG_ZLIB_INFLATE=y CONFIG_ZLIB_DEFLATE=y CONFIG_LZO_COMPRESS=y CONFIG_LZO_DECOMPRESS=y CONFIG_LZ4_COMPRESS=m CONFIG_LZ4HC_COMPRESS=m CONFIG_LZ4_DECOMPRESS=y CONFIG_XZ_DEC=y CONFIG_XZ_DEC_X86=y # CONFIG_XZ_DEC_POWERPC is not set # CONFIG_XZ_DEC_IA64 is not set # CONFIG_XZ_DEC_ARM is not set # CONFIG_XZ_DEC_ARMTHUMB is not set # CONFIG_XZ_DEC_SPARC is not set CONFIG_XZ_DEC_BCJ=y # CONFIG_XZ_DEC_TEST is not set CONFIG_DECOMPRESS_GZIP=y CONFIG_DECOMPRESS_BZIP2=y CONFIG_DECOMPRESS_LZMA=y CONFIG_DECOMPRESS_XZ=y CONFIG_DECOMPRESS_LZO=y CONFIG_DECOMPRESS_LZ4=y CONFIG_GENERIC_ALLOCATOR=y CONFIG_INTERVAL_TREE=y CONFIG_ASSOCIATIVE_ARRAY=y CONFIG_HAS_IOMEM=y CONFIG_HAS_IOPORT_MAP=y CONFIG_HAS_DMA=y CONFIG_CPU_RMAP=y CONFIG_DQL=y CONFIG_GLOB=y # CONFIG_GLOB_SELFTEST is not set CONFIG_NLATTR=y CONFIG_ARCH_HAS_ATOMIC64_DEC_IF_POSITIVE=y CONFIG_AVERAGE=y CONFIG_CLZ_TAB=y # CONFIG_CORDIC is not set CONFIG_DDR=y CONFIG_MPILIB=y CONFIG_SIGNATURE=y CONFIG_OID_REGISTRY=y CONFIG_UCS2_STRING=y CONFIG_FONT_SUPPORT=y # CONFIG_FONTS is not set CONFIG_FONT_8x8=y CONFIG_FONT_8x16=y CONFIG_ARCH_HAS_SG_CHAIN=y [-- Attachment #3: build_linux-upstream.sh --] [-- Type: application/x-sh, Size: 4504 bytes --] ^ permalink raw reply [flat|nested] 44+ messages in thread
* Re: [PATCH] MODSIGN: Change default key details [ver #2] 2015-04-30 14:39 ` Sedat Dilek @ 2015-04-30 14:50 ` David Howells 2015-04-30 17:49 ` Sedat Dilek 0 siblings, 1 reply; 44+ messages in thread From: David Howells @ 2015-04-30 14:50 UTC (permalink / raw) To: sedat.dilek Cc: dhowells, Linus Torvalds, keyrings, Rusty Russell, LKML, linux-security-module, James Morris, Greg Kroah-Hartman Sedat Dilek <sedat.dilek@gmail.com> wrote: > This happened a 2nd time with a different kernel-series! > Not sure why this was the case. > It did not happen when rebuilding with the same kernel-config again. > Not sure if parallel-make-jobs might be a cause for this (see attached > build-script). Yeah. I've had other reports, but I can't see anything obvious. I have a suspicion there may be something not declared quite right in the makefile - or even a race in make -jN, but I don't know how to reproduce it. > For my quick builds of rcN Linux-kernels I normally do not need > signing my modules. Me neither. Having module signing done on installation, not during the build, is really inconvenient since I don't install the modules on my test machine but rather copy them over with scp after booting the kernel with tftp. > Attached is my simple build-script for generating Debian/Ubuntu kernel > packages via builddeb script. Do you have an rpmbuild version? David ^ permalink raw reply [flat|nested] 44+ messages in thread
* Re: [PATCH] MODSIGN: Change default key details [ver #2] 2015-04-30 14:50 ` David Howells @ 2015-04-30 17:49 ` Sedat Dilek 2015-04-30 18:00 ` Linus Torvalds 0 siblings, 1 reply; 44+ messages in thread From: Sedat Dilek @ 2015-04-30 17:49 UTC (permalink / raw) To: David Howells Cc: Linus Torvalds, keyrings, Rusty Russell, LKML, linux-security-module, James Morris, Greg Kroah-Hartman On Thu, Apr 30, 2015 at 4:50 PM, David Howells <dhowells@redhat.com> wrote: > Sedat Dilek <sedat.dilek@gmail.com> wrote: > >> This happened a 2nd time with a different kernel-series! >> Not sure why this was the case. >> It did not happen when rebuilding with the same kernel-config again. >> Not sure if parallel-make-jobs might be a cause for this (see attached >> build-script). > > Yeah. I've had other reports, but I can't see anything obvious. I have a > suspicion there may be something not declared quite right in the makefile - or > even a race in make -jN, but I don't know how to reproduce it. > Ah OK, (un)nice to read. >> For my quick builds of rcN Linux-kernels I normally do not need >> signing my modules. > > Me neither. Having module signing done on installation, not during the build, > is really inconvenient since I don't install the modules on my test machine > but rather copy them over with scp after booting the kernel with tftp. > >> Attached is my simple build-script for generating Debian/Ubuntu kernel >> packages via builddeb script. > > Do you have an rpmbuild version? > RPM? AFAICS Redhat Pro v7.2 was my last rpm-based distro :-). I have plans to install some of the Linux "LTS" on a machine within an honorary|unpaid project where people can switch from WinXP to Linux if they like it - among others one or two rpm-based distro will be taken into account. 1st there is a plan.................................................... Then plan "b" :-). - Sedat - ^ permalink raw reply [flat|nested] 44+ messages in thread
* Re: [PATCH] MODSIGN: Change default key details [ver #2] 2015-04-30 17:49 ` Sedat Dilek @ 2015-04-30 18:00 ` Linus Torvalds 2015-05-01 21:41 ` Abelardo Ricart III 0 siblings, 1 reply; 44+ messages in thread From: Linus Torvalds @ 2015-04-30 18:00 UTC (permalink / raw) To: Sedat Dilek Cc: David Howells, keyrings, Rusty Russell, LKML, LSM List, James Morris, Greg Kroah-Hartman On Thu, Apr 30, 2015 at 10:49 AM, Sedat Dilek <sedat.dilek@gmail.com> wrote: >> >> Yeah. I've had other reports, but I can't see anything obvious. I have a >> suspicion there may be something not declared quite right in the makefile - or >> even a race in make -jN, but I don't know how to reproduce it. > > Ah OK, (un)nice to read. Yeah. I've gotten "X.509 certificate list changed" messages occasionally, which makes no sense considering that I never have any keys except for the default signing key. So there is something odd foinf on with "kernel/.x509.list". The rules to generate it aren't really _rules_. It's black magic. Actually, it's *generated* with a rule, but then it has that magical "if the contents don't match" thing that is _not_ a real make rule. It would be lovely to replace that with a real "if_changed" rule, because I do think the magic hackery is what the confuses make. Maybe some concurrent build reads the file - to check if it's the same - in one make instance while it's being generated in another. Something. [ Wild handwaving going on ]. Linus ^ permalink raw reply [flat|nested] 44+ messages in thread
* Re: [PATCH] MODSIGN: Change default key details [ver #2] 2015-04-30 18:00 ` Linus Torvalds @ 2015-05-01 21:41 ` Abelardo Ricart III 2015-05-02 4:12 ` Linus Torvalds 2015-05-20 10:17 ` David Woodhouse 0 siblings, 2 replies; 44+ messages in thread From: Abelardo Ricart III @ 2015-05-01 21:41 UTC (permalink / raw) To: torvalds Cc: linux-kernel, sedat.dilek, dhowells, keyrings, rusty, linux-security-module, james.l.morris, gregkh, Abelardo Ricart III Forgive me if this git send-email blows up in my face somehow, as I hadn't been subscribed to this list before this reply. I had some similar and probably related behavior I submitted a patch to the kbuild guys for that fell on deaf ears. Basically, I think an order-only prerequisite would make the most sense in this case because right now the key generation target is going to trigger any time the x509.genkey file has its timestamp touched to where it becomes "newer" than our keys, even if its content remains the same. What if I provided my own keys already, as module-signing.txt said was okay? What if the autogenerated keys from my last build still exist? >From module-signing.txt: > Under normal conditions, the kernel build will automatically generate a new > keypair using openssl if one does not exist in the files: > > signing_key.priv > signing_key.x509 Nope, sorry, not true. Even if your keys exist, due to unfortunate parallel make/disk write order/racy kbuild/goblins your x509.genkey file has a newer timestamp than your keys, and now your keys are going to get tossed (regenerated and overwritten, yay!). Worse still, I think they could even get tossed AFTER the build decides "hey nice keys, I'll just use those". Either way, this patch is ultimately correct because this is exactly the kind of racy scenario order-only prerequisites was made for. We should not care anything about x509.genkey if our signing keys already exist. Period. Here's my two-line patch strictly defining the build order, for your perusal. Signed-off-by: Abelardo Ricart III <aricart@memnix.com> --- diff --git a/kernel/Makefile b/kernel/Makefile index 1408b33..10c8df0 100644 --- a/kernel/Makefile +++ b/kernel/Makefile @@ -168,7 +168,8 @@ ifndef CONFIG_MODULE_SIG_HASH $(error Could not determine digest type to use from kernel config) endif -signing_key.priv signing_key.x509: x509.genkey +signing_key.priv signing_key.x509: | x509.genkey + $(warning *** X.509 module signing key pair not found in root of source tree ***) @echo "###" @echo "### Now generating an X.509 key pair to be used for signing modules." @echo "###" ^ permalink raw reply related [flat|nested] 44+ messages in thread
* Re: [PATCH] MODSIGN: Change default key details [ver #2] 2015-05-01 21:41 ` Abelardo Ricart III @ 2015-05-02 4:12 ` Linus Torvalds 2015-05-02 6:57 ` Sedat Dilek 2015-05-02 9:46 ` Abelardo Ricart III 2015-05-20 10:17 ` David Woodhouse 1 sibling, 2 replies; 44+ messages in thread From: Linus Torvalds @ 2015-05-02 4:12 UTC (permalink / raw) To: Abelardo Ricart III, Michal Marek Cc: Linux Kernel Mailing List, Sedat Dilek, David Howells, keyrings, Rusty Russell, LSM List, James Morris, Greg Kroah-Hartman On Fri, May 1, 2015 at 2:41 PM, Abelardo Ricart III <aricart@memnix.com> wrote: > > Here's my two-line patch strictly defining the build order, for your perusal. Ok, so this looks possible and sounds like it could explain the issues. But I'd like somebody who is much more familiar with these kinds of subtleties in 'make' to take anothe rlook and ack it. Because I had personally never even heard (much less used) about these magical GNU make "order-only prerequisites". Live and learn. > -signing_key.priv signing_key.x509: x509.genkey > +signing_key.priv signing_key.x509: | x509.genkey > + $(warning *** X.509 module signing key pair not found in root of source tree ***) So we shouldn't warn about this. The "generate random key" should be the normal action for just about everybody but actual preduction vendor builds. It's definitely not an error condition. But that ": |" syntax is interesting. I quick grep does show that we do have a few previous uses, so I guess we really *do* use just about every possible feature of GNU make even if I wasn't aware of this one.. The "generate random key" does seem to be a similar "prep" phase as the __dtbs_install_prep thing we do in the dtb install. Adding Michal Marek to the cc, since I want an Ack from somebody who knows the details of GNU make more than I do. Anybody else who is a makefile God? Linus ^ permalink raw reply [flat|nested] 44+ messages in thread
* Re: [PATCH] MODSIGN: Change default key details [ver #2] 2015-05-02 4:12 ` Linus Torvalds @ 2015-05-02 6:57 ` Sedat Dilek 2015-05-02 9:46 ` Abelardo Ricart III 1 sibling, 0 replies; 44+ messages in thread From: Sedat Dilek @ 2015-05-02 6:57 UTC (permalink / raw) To: Linus Torvalds Cc: Abelardo Ricart III, Michal Marek, Linux Kernel Mailing List, David Howells, keyrings, Rusty Russell, LSM List, James Morris, Greg Kroah-Hartman On Sat, May 2, 2015 at 6:12 AM, Linus Torvalds <torvalds@linux-foundation.org> wrote: > On Fri, May 1, 2015 at 2:41 PM, Abelardo Ricart III <aricart@memnix.com> wrote: >> >> Here's my two-line patch strictly defining the build order, for your perusal. > > Ok, so this looks possible and sounds like it could explain the issues. > > But I'd like somebody who is much more familiar with these kinds of > subtleties in 'make' to take anothe rlook and ack it. Because I had > personally never even heard (much less used) about these magical GNU > make "order-only prerequisites". Live and learn. > >> -signing_key.priv signing_key.x509: x509.genkey >> +signing_key.priv signing_key.x509: | x509.genkey >> + $(warning *** X.509 module signing key pair not found in root of source tree ***) > > So we shouldn't warn about this. The "generate random key" should be > the normal action for just about everybody but actual preduction > vendor builds. It's definitely not an error condition. > > But that ": |" syntax is interesting. I quick grep does show that we > do have a few previous uses, so I guess we really *do* use just about > every possible feature of GNU make even if I wasn't aware of this > one.. > > The "generate random key" does seem to be a similar "prep" phase as > the __dtbs_install_prep thing we do in the dtb install. > > Adding Michal Marek to the cc, since I want an Ack from somebody who > knows the details of GNU make more than I do. Anybody else who is a > makefile God? > /me no GNU/make or Makefile guru. When dealing with .PHONY targets [2] within the Freetz router project I bookmarked the below links. So there exists ".NOTPARALLEL" [1]. Maybe its use can be a "hacky" possibility to workaround the issue (cannot tell you about version-prereqs of GNU/make). My 0,02cents. - Sedat - [1] https://www.gnu.org/software/make/manual/html_node/Special-Targets.html [2] https://www.gnu.org/software/make/manual/html_node/Phony-Targets.html ^ permalink raw reply [flat|nested] 44+ messages in thread
* Re: [PATCH] MODSIGN: Change default key details [ver #2] 2015-05-02 4:12 ` Linus Torvalds 2015-05-02 6:57 ` Sedat Dilek @ 2015-05-02 9:46 ` Abelardo Ricart III 2015-05-04 1:45 ` Linus Torvalds 1 sibling, 1 reply; 44+ messages in thread From: Abelardo Ricart III @ 2015-05-02 9:46 UTC (permalink / raw) To: Linus Torvalds Cc: Michal Marek, Linux Kernel Mailing List, Sedat Dilek, David Howells, keyrings, Rusty Russell, LSM List, James Morris, Greg Kroah-Hartman On Fri, 2015-05-01 at 21:12 -0700, Linus Torvalds wrote: > So we shouldn't warn about this. The "generate random key" should be > the normal action for just about everybody but actual preduction > vendor builds. It's definitely not an error condition. Since this patch fixes the unexpected build behavior, I agree such a warning would be unnecessary. Removed. Signed-off-by: Abelardo Ricart III <aricart@memnix.com> --- diff --git a/kernel/Makefile b/kernel/Makefile index 1408b33..81d3df9 100644 --- a/kernel/Makefile +++ b/kernel/Makefile @@ -168,7 +168,7 @@ ifndef CONFIG_MODULE_SIG_HASH $(error Could not determine digest type to use from kernel config) endif -signing_key.priv signing_key.x509: x509.genkey +signing_key.priv signing_key.x509: | x509.genkey @echo "###" @echo "### Now generating an X.509 key pair to be used for signing modules." @echo "###" ^ permalink raw reply related [flat|nested] 44+ messages in thread
* Re: [PATCH] MODSIGN: Change default key details [ver #2] 2015-05-02 9:46 ` Abelardo Ricart III @ 2015-05-04 1:45 ` Linus Torvalds 2015-05-04 4:42 ` Abelardo Ricart III 2015-05-04 18:45 ` Linus Torvalds 0 siblings, 2 replies; 44+ messages in thread From: Linus Torvalds @ 2015-05-04 1:45 UTC (permalink / raw) To: Abelardo Ricart III Cc: Michal Marek, Linux Kernel Mailing List, Sedat Dilek, David Howells, keyrings, Rusty Russell, LSM List, James Morris, Greg Kroah-Hartman On Sat, May 2, 2015 at 2:46 AM, Abelardo Ricart III <aricart@memnix.com> wrote: > endif > > -signing_key.priv signing_key.x509: x509.genkey > +signing_key.priv signing_key.x509: | x509.genkey Hmm. Thinking some more about this, I'm not entirely convinced. With this change, if we change kernel/Makefile to have a different keysigning authority etc, it won't re-generate the keys, because the old keys still exist. No? That would be wrong. I'd much rather see "x509.genkey" be generated with a move-if-changed pattern, so that it only changes if (a) it didn't exist before or (b) it actually has new content. On a tangentially related issue: I figured out why I get those (very annoying) "X.509 certificate list changed" messages. I made it print out *what* changed: X.509 certificate list changed from ./signing_key.x509 to signing_key.x509 Note the "./" difference. Linus ^ permalink raw reply [flat|nested] 44+ messages in thread
* Re: [PATCH] MODSIGN: Change default key details [ver #2] 2015-05-04 1:45 ` Linus Torvalds @ 2015-05-04 4:42 ` Abelardo Ricart III [not found] ` <CA+55aFzYUsXHC=_RiQFBhMmDxrFT4bqNP5F0LGWUu7Hc9sXBFQ@mail.gmail.com> 2015-05-04 18:45 ` Linus Torvalds 1 sibling, 1 reply; 44+ messages in thread From: Abelardo Ricart III @ 2015-05-04 4:42 UTC (permalink / raw) To: Linus Torvalds Cc: Michal Marek, Linux Kernel Mailing List, Sedat Dilek, David Howells, keyrings, Rusty Russell, LSM List, James Morris, Greg Kroah-Hartman On Sun, 2015-05-03 at 18:45 -0700, Linus Torvalds wrote: > On Sat, May 2, 2015 at 2:46 AM, Abelardo Ricart III <aricart@memnix.com> > wrote: > > endif > > > > -signing_key.priv signing_key.x509: x509.genkey > > +signing_key.priv signing_key.x509: | x509.genkey > > Hmm. Thinking some more about this, I'm not entirely convinced. > > With this change, if we change kernel/Makefile to have a different > keysigning authority etc, it won't re-generate the keys, because the > old keys still exist. No? That would be wrong. > That's correct. I was under the impression that having the Makefile generate the signing keys was something that was done just to prevent a build failure with CONFIG_MODULE_SIG but no keys. The comment above the key generation target seems to say that. David Howells' patch to make the key details "more obviously unspecified" seems to be along those lines as well; that those generated keys are simply a generic way to have signed modules without managing your own keys. In that case, the actual contents of x509.genkey would be of little significance because those keys are entirely generic and transient. > I'd much rather see "x509.genkey" be generated with a move-if-changed > pattern, so that it only changes if (a) it didn't exist before or (b) > it actually has new content. > And this would indeed trigger key regeneration by make. But what if I do manage my own keys? As I said, I wouldn't want the Makefile to touch them at all, even if the x509.genkey config is missing or was changed. So we have two use cases here: people who use auto-generated keys and people who use their own keys. Sounds like this could be a good case for having a config option that tells make which group you fall under? Something like "CONFIG_MODULE_SIG_GEN_KEY"? If CONFIG_MODULE_SIG_GEN_KEY=y, keys are (re)generated based on the internal x509.genkey. If CONFIG_MODULE_SIG_GEN_KEY is not set, keys are only (re)generated if they don't already exist, which is what my patch would do (and what the documentation implies should be happening now). > On a tangentially related issue: I figured out why I get those (very > annoying) "X.509 certificate list changed" messages. I made it print > out *what* changed: > > X.509 certificate list changed from ./signing_key.x509 to signing_key.x509 > > Note the "./" difference. > > Linus That Makefile could use a makeover. Pun intended. ^ permalink raw reply [flat|nested] 44+ messages in thread
[parent not found: <CA+55aFzYUsXHC=_RiQFBhMmDxrFT4bqNP5F0LGWUu7Hc9sXBFQ@mail.gmail.com>]
* Re: [PATCH] MODSIGN: Change default key details [ver #2] [not found] ` <CA+55aFzYUsXHC=_RiQFBhMmDxrFT4bqNP5F0LGWUu7Hc9sXBFQ@mail.gmail.com> @ 2015-05-04 7:18 ` Abelardo Ricart III 2015-05-04 21:40 ` Abelardo Ricart III 1 sibling, 0 replies; 44+ messages in thread From: Abelardo Ricart III @ 2015-05-04 7:18 UTC (permalink / raw) To: Linus Torvalds Cc: Michal Marek, Greg Kroah-Hartman, LSM List, Rusty Russell, keyrings, David Howells, James Morris, Sedat Dilek, Linux Kernel Mailing List On Sun, 2015-05-03 at 22:16 -0700, Linus Torvalds wrote: > On May 3, 2015 21:42, "Abelardo Ricart III" <aricart@memnix.com> wrote: > > > > That's correct. I was under the impression that having the Makefile generate > > the signing keys was something that was done just to prevent a build failure > > with CONFIG_MODULE_SIG but no keys. > No, that's absolutely not the case. > In fact, the whole "external keys" model is entirely bogus for any same use > case. > The sane use case is to have the build process generate a random key at build > time, that gets thrown away after installing the kernel and modules. That, > together with "require signed modules" makes module as safe as building > everything into the kernel - you won't be open to things like rootkits that > try to load modules, because nobody has access to the key any more. > For varying degrees of accessibility. If the key gets overwritten with data during removal that would be ideal. > The only time you will have an external non-generated key is when you either > want to do the insane secure boot thing, or when a distro builds an official > kernel. Or maybe signing and deploying a custom module for a very large amount of machines that enforce module signing? Quite cumbersome when not utilizing your own keys... > But those are *not* the common development situations. > So the "generated random throwaway key" is absolutely not some of special > case to not break the build. It should be seen as the *default* case. > Linus So one-time keys is the default case. What of the idea of a config option for the other case as I'd proposed? One-time key generation being both the default (always regenerate, sign, then throwaway. Overwrite existing keys and config.) as well as the fallback (config option for one-time keys is unset, but external keys are absent or invalid. Generate and use a new key pair as per usual). Thanks. ^ permalink raw reply [flat|nested] 44+ messages in thread
* Re: [PATCH] MODSIGN: Change default key details [ver #2] [not found] ` <CA+55aFzYUsXHC=_RiQFBhMmDxrFT4bqNP5F0LGWUu7Hc9sXBFQ@mail.gmail.com> 2015-05-04 7:18 ` Abelardo Ricart III @ 2015-05-04 21:40 ` Abelardo Ricart III 2015-05-05 14:34 ` David Howells 1 sibling, 1 reply; 44+ messages in thread From: Abelardo Ricart III @ 2015-05-04 21:40 UTC (permalink / raw) To: Linus Torvalds Cc: Michal Marek, Greg Kroah-Hartman, LSM List, Rusty Russell, keyrings, David Howells, James Morris, Sedat Dilek, Linux Kernel Mailing List On Sun, 2015-05-03 at 22:16 -0700, Linus Torvalds wrote: > On May 3, 2015 21:42, "Abelardo Ricart III" <aricart@memnix.com> wrote: > > > > That's correct. I was under the impression that having the Makefile generate > > the signing keys was something that was done just to prevent a build failure > > with CONFIG_MODULE_SIG but no keys. > No, that's absolutely not the case. > In fact, the whole "external keys" model is entirely bogus for any same use > case. > The sane use case is to have the build process generate a random key at build > time, that gets thrown away after installing the kernel and modules. That, > together with "require signed modules" makes module as safe as building > everything into the kernel - you won't be open to things like rootkits that > try to load modules, because nobody has access to the key any more. > The only time you will have an external non-generated key is when you either > want to do the insane secure boot thing, or when a distro builds an official > kernel. But those are *not* the common development situations. > So the "generated random throwaway key" is absolutely not some of special > case to not break the build. It should be seen as the *default* case. > Linus Here's a (barely tested) patch to show what I mean with the config option. The default case is to always generate a new key at build (MODULE_SIG_BUILDGEN=y) and fallback on generating keys during build only if one doesn't exist (MODULE_SIG_BUILDGEN=n). This fixes the issues with keys being unexpectedly overwritten when you don't want them to be. Also fixes keys _not_ always being regenerated when they really should be (the default use case). --- diff --git a/init/Kconfig b/init/Kconfig index dc24dec..5ab8b97 100644 --- a/init/Kconfig +++ b/init/Kconfig @@ -1903,6 +1903,16 @@ config MODULE_SIG_ALL comment "Do not forget to sign required modules with scripts/sign-file" depends on MODULE_SIG_FORCE && !MODULE_SIG_ALL +config MODULE_SIG_BUILDGEN + bool "Always generate keys during build" + default y + depends on MODULE_SIG + help + Always generate new signing keys at build time. Only say N here if + you intend on supplying your own signing keys. + + Say Y here unless you know what you are doing. + choice prompt "Which hash algorithm should modules be signed with?" depends on MODULE_SIG diff --git a/kernel/Makefile b/kernel/Makefile index 60c302c..86d836d 100644 --- a/kernel/Makefile +++ b/kernel/Makefile @@ -170,6 +170,15 @@ ifndef CONFIG_MODULE_SIG_HASH $(error Could not determine digest type to use from kernel config) endif +.PHONY: generate_keys +ifeq ($(CONFIG_MODULE_SIG_BUILDGEN),y) + # Always generate new signing keys + generate_keys: signing_key.priv signing_key.x509 FORCE +else + # Only generate signing keys if they don't exist + generate_keys: | signing_key.priv signing_key.x509 +endif + signing_key.priv signing_key.x509: x509.genkey @echo "###" @echo "### Now generating an X.509 key pair to be used for signing modules." ^ permalink raw reply related [flat|nested] 44+ messages in thread
* Re: [PATCH] MODSIGN: Change default key details [ver #2] 2015-05-04 21:40 ` Abelardo Ricart III @ 2015-05-05 14:34 ` David Howells 2015-05-05 22:44 ` Abelardo Ricart III 0 siblings, 1 reply; 44+ messages in thread From: David Howells @ 2015-05-05 14:34 UTC (permalink / raw) To: Abelardo Ricart III Cc: dhowells, Linus Torvalds, Michal Marek, Greg Kroah-Hartman, LSM List, Rusty Russell, keyrings, James Morris, Sedat Dilek, Linux Kernel Mailing List Abelardo Ricart III <aricart@memnix.com> wrote: > Here's a (barely tested) patch to show what I mean with the config option. The > default case is to always generate a new key at build (MODULE_SIG_BUILDGEN=y) > and fallback on generating keys during build only if one doesn't exist > (MODULE_SIG_BUILDGEN=n). Does it cope with randconfig? David ^ permalink raw reply [flat|nested] 44+ messages in thread
* Re: [PATCH] MODSIGN: Change default key details [ver #2] 2015-05-05 14:34 ` David Howells @ 2015-05-05 22:44 ` Abelardo Ricart III 0 siblings, 0 replies; 44+ messages in thread From: Abelardo Ricart III @ 2015-05-05 22:44 UTC (permalink / raw) To: David Howells Cc: Linus Torvalds, Michal Marek, Greg Kroah-Hartman, LSM List, Rusty Russell, keyrings, James Morris, Sedat Dilek, Linux Kernel Mailing List On Tue, 2015-05-05 at 15:34 +0100, David Howells wrote: > Abelardo Ricart III <aricart@memnix.com> wrote: > > > Here's a (barely tested) patch to show what I mean with the config option. > > The > > default case is to always generate a new key at build > > (MODULE_SIG_BUILDGEN=y) > > and fallback on generating keys during build only if one doesn't exist > > (MODULE_SIG_BUILDGEN=n). > > Does it cope with randconfig? > > David Well it would only depend on MODULE_SIG, and switching it on and off again would do exactly what it says it's going to do: either regenerate the signing keys every time, or don't if they already exist. I would have to actually change the logic slightly so it works strictly as intended though. So no, this isn't merge-able at all. I was more wondering if implementing something to this effect would be okay, so we can strictly define the behavior at build time (no surprises). ^ permalink raw reply [flat|nested] 44+ messages in thread
* Re: [PATCH] MODSIGN: Change default key details [ver #2] 2015-05-04 1:45 ` Linus Torvalds 2015-05-04 4:42 ` Abelardo Ricart III @ 2015-05-04 18:45 ` Linus Torvalds 2015-05-05 14:33 ` David Howells ` (2 more replies) 1 sibling, 3 replies; 44+ messages in thread From: Linus Torvalds @ 2015-05-04 18:45 UTC (permalink / raw) To: Abelardo Ricart III Cc: Michal Marek, Linux Kernel Mailing List, Sedat Dilek, David Howells, keyrings, Rusty Russell, LSM List, James Morris, Greg Kroah-Hartman [-- Attachment #1: Type: text/plain, Size: 870 bytes --] On Sun, May 3, 2015 at 6:45 PM, Linus Torvalds <torvalds@linux-foundation.org> wrote: > > I'd much rather see "x509.genkey" be generated with a move-if-changed > pattern, so that it only changes if (a) it didn't exist before or (b) > it actually has new content. Hmm. Something like the attached, to make the .x509.list file be properly generated? That still leaves the problem that the X509_CERTIFICATES variable itself seems to be badly defined, in that it ends up randomly having the "./" in front of the filename due to confusion between "signing_key.x509" being both in X509_CERTIFICATES-y := $(wildcard *.x509) $(wildcard $(srctree)/*.x509) (when that .x509 file was pre-existing), and X509_CERTIFICATES-$(CONFIG_MODULE_SIG) += $(objtree)/signing_key.x509 where I think that "$(objtree)/" comes in. DavidH, comments? Linus [-- Attachment #2: patch.diff --] [-- Type: text/plain, Size: 1039 bytes --] kernel/Makefile | 14 +++++--------- 1 file changed, 5 insertions(+), 9 deletions(-) diff --git a/kernel/Makefile b/kernel/Makefile index 60c302cfb4d3..205bdc2b11e7 100644 --- a/kernel/Makefile +++ b/kernel/Makefile @@ -135,13 +135,6 @@ ifeq ($(X509_CERTIFICATES),) $(warning *** No X.509 certificates found ***) endif -ifneq ($(wildcard $(obj)/.x509.list),) -ifneq ($(shell cat $(obj)/.x509.list),$(X509_CERTIFICATES)) -$(info X.509 certificate list changed) -$(shell rm $(obj)/.x509.list) -endif -endif - kernel/system_certificates.o: $(obj)/x509_certificate_list quiet_cmd_x509certs = CERTS $@ @@ -151,9 +144,12 @@ targets += $(obj)/x509_certificate_list $(obj)/x509_certificate_list: $(X509_CERTIFICATES) $(obj)/.x509.list $(call if_changed,x509certs) +define filechk_x509_list + echo $(X509_CERTIFICATES) +endef targets += $(obj)/.x509.list -$(obj)/.x509.list: - @echo $(X509_CERTIFICATES) >$@ +$(obj)/.x509.list: Makefile FORCE + $(call filechk,x509_list) endif clean-files := x509_certificate_list .x509.list ^ permalink raw reply related [flat|nested] 44+ messages in thread
* Re: [PATCH] MODSIGN: Change default key details [ver #2] 2015-05-04 18:45 ` Linus Torvalds @ 2015-05-05 14:33 ` David Howells 2015-05-05 14:37 ` David Howells 2015-05-05 14:43 ` Linus Torvalds 2015-05-05 15:22 ` Michal Marek 2015-05-16 15:39 ` David Woodhouse 2 siblings, 2 replies; 44+ messages in thread From: David Howells @ 2015-05-05 14:33 UTC (permalink / raw) To: Linus Torvalds Cc: dhowells, Abelardo Ricart III, Michal Marek, Linux Kernel Mailing List, Sedat Dilek, keyrings, Rusty Russell, LSM List, James Morris, Greg Kroah-Hartman Linus Torvalds <torvalds@linux-foundation.org> wrote: > +define filechk_x509_list > + echo $(X509_CERTIFICATES) > +endef > targets += $(obj)/.x509.list > -$(obj)/.x509.list: > - @echo $(X509_CERTIFICATES) >$@ > +$(obj)/.x509.list: Makefile FORCE > + $(call filechk,x509_list) How does that actually work? David ^ permalink raw reply [flat|nested] 44+ messages in thread
* Re: [PATCH] MODSIGN: Change default key details [ver #2] 2015-05-05 14:33 ` David Howells @ 2015-05-05 14:37 ` David Howells 2015-05-05 14:43 ` Linus Torvalds 1 sibling, 0 replies; 44+ messages in thread From: David Howells @ 2015-05-05 14:37 UTC (permalink / raw) Cc: dhowells, Linus Torvalds, Abelardo Ricart III, Michal Marek, Linux Kernel Mailing List, Sedat Dilek, keyrings, Rusty Russell, LSM List, James Morris, Greg Kroah-Hartman David Howells <dhowells@redhat.com> wrote: > > + $(call filechk,x509_list) Ah... I'd missed that there was a comma, not an underscore there. David ^ permalink raw reply [flat|nested] 44+ messages in thread
* Re: [PATCH] MODSIGN: Change default key details [ver #2] 2015-05-05 14:33 ` David Howells 2015-05-05 14:37 ` David Howells @ 2015-05-05 14:43 ` Linus Torvalds 2015-05-05 15:30 ` David Howells 1 sibling, 1 reply; 44+ messages in thread From: Linus Torvalds @ 2015-05-05 14:43 UTC (permalink / raw) To: David Howells Cc: Abelardo Ricart III, Michal Marek, Linux Kernel Mailing List, Sedat Dilek, keyrings, Rusty Russell, LSM List, James Morris, Greg Kroah-Hartman On Tue, May 5, 2015 at 7:33 AM, David Howells <dhowells@redhat.com> wrote: > Linus Torvalds <torvalds@linux-foundation.org> wrote: > >> +define filechk_x509_list >> + echo $(X509_CERTIFICATES) >> +endef >> targets += $(obj)/.x509.list >> -$(obj)/.x509.list: >> - @echo $(X509_CERTIFICATES) >$@ >> +$(obj)/.x509.list: Makefile FORCE >> + $(call filechk,x509_list) > > How does that actually work? So the Makefile dependency is entirely fake, it's just that the "filechk" macro wants to have an input. The FORCE means that it ends up being done every time, regardless of whether the Makefile has changed or not. See scripts/Kbuild.include for details on the "filechk" macro, bit it basically takes another make macro (called "filechk_xyz"), runs that macro as a shell script and outputs it to a temporary file: $(filechk_$(1)) < $< > $@.tmp; (that "$<" is also why the rule wants a some input, in our case "Makefile"). It then does a move-if-changed of the temporary file to the target. So the end result is that we run that "filechk_x509_list" script, compare the output to the old target, and update the target iff it is different. That would seem to be exactly what we want. That said, as mentioned, the whole "X509_CERTIFICATES" thing is unstable, and ends up being "./signing_key.x509" or "signing_key.x509" depending on whether that file existed or not. That needs fixing, so that we get stable output. So some filtering required. Linus ^ permalink raw reply [flat|nested] 44+ messages in thread
* Re: [PATCH] MODSIGN: Change default key details [ver #2] 2015-05-05 14:43 ` Linus Torvalds @ 2015-05-05 15:30 ` David Howells 0 siblings, 0 replies; 44+ messages in thread From: David Howells @ 2015-05-05 15:30 UTC (permalink / raw) To: Linus Torvalds Cc: dhowells, Abelardo Ricart III, Michal Marek, Linux Kernel Mailing List, Sedat Dilek, keyrings, Rusty Russell, LSM List, James Morris, Greg Kroah-Hartman Linus Torvalds <torvalds@linux-foundation.org> wrote: > ... > So the end result is that we run that "filechk_x509_list" script, > compare the output to the old target, and update the target iff it is > different. That would seem to be exactly what we want. Yep. > That said, as mentioned, the whole "X509_CERTIFICATES" thing is > unstable, and ends up being "./signing_key.x509" or "signing_key.x509" > depending on whether that file existed or not. That needs fixing, so > that we get stable output. So some filtering required. Yeah, the stability thing is a bit of an irritation. X509_CERTIFICATES might also include "$(srcdir)/signing_key.x509". This is one of the things that has given me difficulties because the source and build trees are sometimes the same and sometimes not (and then throw in a symlink somewhere in the path...). I was trying to use $(realpath ...) to deal with this - but that doesn't work if the path doesn't point to an extant file:-/ Does it make sense to produce an error if the source and build trees are not coincident and we see an x509 cert of the same filename cropping up in both? Also X509_CERTIFICATES might hold other certs - though these shouldn't really be seen in the build dir. I wonder if we should enforce that to make life easier. David ^ permalink raw reply [flat|nested] 44+ messages in thread
* Re: [PATCH] MODSIGN: Change default key details [ver #2] 2015-05-04 18:45 ` Linus Torvalds 2015-05-05 14:33 ` David Howells @ 2015-05-05 15:22 ` Michal Marek 2015-05-05 15:41 ` Linus Torvalds 2015-05-16 15:39 ` David Woodhouse 2 siblings, 1 reply; 44+ messages in thread From: Michal Marek @ 2015-05-05 15:22 UTC (permalink / raw) To: Linus Torvalds, David Howells Cc: Abelardo Ricart III, Linux Kernel Mailing List, Sedat Dilek, keyrings, Rusty Russell, LSM List, James Morris, Greg Kroah-Hartman On 2015-05-04 20:45, Linus Torvalds wrote: > On Sun, May 3, 2015 at 6:45 PM, Linus Torvalds > <torvalds@linux-foundation.org> wrote: >> >> I'd much rather see "x509.genkey" be generated with a move-if-changed >> pattern, so that it only changes if (a) it didn't exist before or (b) >> it actually has new content. > > Hmm. Something like the attached, to make the .x509.list file be > properly generated? > > That still leaves the problem that the X509_CERTIFICATES variable > itself seems to be badly defined, in that it ends up randomly having > the "./" in front of the filename due to confusion between > "signing_key.x509" being both in > > X509_CERTIFICATES-y := $(wildcard *.x509) $(wildcard $(srctree)/*.x509) > > (when that .x509 file was pre-existing), and > > X509_CERTIFICATES-$(CONFIG_MODULE_SIG) += $(objtree)/signing_key.x509 > > where I think that "$(objtree)/" comes in. This will be fixed once https://lkml.org/lkml/2015/2/20/546 is merged (the two patches are independent of each other). Michal ^ permalink raw reply [flat|nested] 44+ messages in thread
* Re: [PATCH] MODSIGN: Change default key details [ver #2] 2015-05-05 15:22 ` Michal Marek @ 2015-05-05 15:41 ` Linus Torvalds 2015-05-06 12:20 ` Michal Marek 0 siblings, 1 reply; 44+ messages in thread From: Linus Torvalds @ 2015-05-05 15:41 UTC (permalink / raw) To: Michal Marek Cc: David Howells, Abelardo Ricart III, Linux Kernel Mailing List, Sedat Dilek, keyrings, Rusty Russell, LSM List, James Morris, Greg Kroah-Hartman On Tue, May 5, 2015 at 8:22 AM, Michal Marek <mmarek@suse.cz> wrote: > On 2015-05-04 20:45, Linus Torvalds wrote: >> >> That still leaves the problem that the X509_CERTIFICATES variable >> itself seems to be badly defined [..] > > This will be fixed once https://lkml.org/lkml/2015/2/20/546 is merged > (the two patches are independent of each other). Ok, good. Willing to take my patch through your Kconfig tree? Add my sign-off and some sane description.. Linus ^ permalink raw reply [flat|nested] 44+ messages in thread
* Re: [PATCH] MODSIGN: Change default key details [ver #2] 2015-05-05 15:41 ` Linus Torvalds @ 2015-05-06 12:20 ` Michal Marek 2015-05-07 11:00 ` David Howells 0 siblings, 1 reply; 44+ messages in thread From: Michal Marek @ 2015-05-06 12:20 UTC (permalink / raw) To: David Howells Cc: Linus Torvalds, Abelardo Ricart III, Linux Kernel Mailing List, Sedat Dilek, keyrings, Rusty Russell, LSM List, James Morris, Greg Kroah-Hartman On 2015-05-05 17:41, Linus Torvalds wrote: > On Tue, May 5, 2015 at 8:22 AM, Michal Marek <mmarek@suse.cz> wrote: >> On 2015-05-04 20:45, Linus Torvalds wrote: >>> >>> That still leaves the problem that the X509_CERTIFICATES variable >>> itself seems to be badly defined [..] >> >> This will be fixed once https://lkml.org/lkml/2015/2/20/546 is merged >> (the two patches are independent of each other). > > Ok, good. > > Willing to take my patch through your Kconfig tree? Add my sign-off > and some sane description.. David, are you fine with these two patches? https://lkml.org/lkml/2015/2/20/546 https://lkml.org/lkml/2015/5/4/614 Michal ^ permalink raw reply [flat|nested] 44+ messages in thread
* Re: [PATCH] MODSIGN: Change default key details [ver #2] 2015-05-06 12:20 ` Michal Marek @ 2015-05-07 11:00 ` David Howells 2015-05-07 12:15 ` Michal Marek 0 siblings, 1 reply; 44+ messages in thread From: David Howells @ 2015-05-07 11:00 UTC (permalink / raw) To: Michal Marek Cc: dhowells, Linus Torvalds, Abelardo Ricart III, Linux Kernel Mailing List, Sedat Dilek, keyrings, Rusty Russell, LSM List, James Morris, Greg Kroah-Hartman Michal Marek <mmarek@suse.cz> wrote: > are you fine with these two patches? > > https://lkml.org/lkml/2015/2/20/546 > https://lkml.org/lkml/2015/5/4/614 Yeah, I think so. Your reasoning on the first one is sound - but is it possible for $(objtree) to != $(srctree) even when they're coincident. I like Linus's use of the filechk macro on the second - but we shouldn't overwrite keys someone has manually placed in the tree if the key generation template changes due to git pull altering kernel/Makefile. Sometimes I think makescript is like trying to program in Prolog - but worse. David ^ permalink raw reply [flat|nested] 44+ messages in thread
* Re: [PATCH] MODSIGN: Change default key details [ver #2] 2015-05-07 11:00 ` David Howells @ 2015-05-07 12:15 ` Michal Marek 2015-05-07 12:24 ` Michal Marek 2015-05-18 16:07 ` David Woodhouse 0 siblings, 2 replies; 44+ messages in thread From: Michal Marek @ 2015-05-07 12:15 UTC (permalink / raw) To: David Howells Cc: Linus Torvalds, Abelardo Ricart III, Linux Kernel Mailing List, Sedat Dilek, keyrings, Rusty Russell, LSM List, James Morris, Greg Kroah-Hartman On 2015-05-07 13:00, David Howells wrote: > Michal Marek <mmarek@suse.cz> wrote: > >> are you fine with these two patches? >> >> https://lkml.org/lkml/2015/2/20/546 >> https://lkml.org/lkml/2015/5/4/614 > > Yeah, I think so. Your reasoning on the first one is sound - but is it > possible for $(objtree) to != $(srctree) even when they're coincident. This part is fine. $(objtee) is always '.', the variable is only used as an annotation. You can of course do 'make O=/symlink/to/current/dir', but this will fail with /your/current/dir is not clean, please run 'make mrproper' > I like > Linus's use of the filechk macro on the second - but we shouldn't overwrite > keys someone has manually placed in the tree if the key generation template > changes due to git pull altering kernel/Makefile. That's the problem with allowing a file to be either user-supplied or generated. We can use separate files for the user-supplied/generated cases like below and solve this for good. Not signed off yet, because it is only lightly tested and the clean rules and .gitignore need to be updated. Michal >From aa68988b9b669f2c7d17466ba39e84d7e6617c34 Mon Sep 17 00:00:00 2001 From: Michal Marek <mmarek@suse.cz> Date: Thu, 7 May 2015 13:38:23 +0200 Subject: [PATCH] MODSIGN: Split user-supplied and autogenerated signing key Allow the users to place signing_key.{x509,priv} and x509.genkey in the source tree. If any of these files is missing, generate the file in the build tree with an .auto suffix. This avoids problems with overwriting user-supplied files. --- Makefile | 4 ++-- kernel/Makefile | 46 +++++++++++++++++++++++----------------------- 2 files changed, 25 insertions(+), 25 deletions(-) diff --git a/Makefile b/Makefile index 19e256a..b4b8ef5 100644 --- a/Makefile +++ b/Makefile @@ -873,8 +873,8 @@ INITRD_COMPRESS-$(CONFIG_RD_LZ4) := lz4 # export INITRD_COMPRESS := $(INITRD_COMPRESS-y) ifdef CONFIG_MODULE_SIG_ALL -MODSECKEY = ./signing_key.priv -MODPUBKEY = ./signing_key.x509 +MODSECKEY = $(firstword $(wildcard $(srctree)/signing_key.priv),./signing_key.priv.auto) +MODPUBKEY = $(firstword $(wildcard $(srctree)/signing_key.x509),./signing_key.x509.auto) export MODPUBKEY mod_sign_cmd = perl $(srctree)/scripts/sign-file $(CONFIG_MODULE_SIG_HASH) $(MODSECKEY) $(MODPUBKEY) else diff --git a/kernel/Makefile b/kernel/Makefile index e072239..4bcf20e 100644 --- a/kernel/Makefile +++ b/kernel/Makefile @@ -124,7 +124,7 @@ $(obj)/config_data.h: $(obj)/config_data.gz FORCE ############################################################################### ifeq ($(CONFIG_SYSTEM_TRUSTED_KEYRING),y) X509_CERTIFICATES-y := $(wildcard *.x509) -X509_CERTIFICATES-$(CONFIG_MODULE_SIG) += signing_key.x509 +X509_CERTIFICATES-$(CONFIG_MODULE_SIG) += $(if $(wildcard $(srctree)/signing_key.x509),,signing_key.x509.auto) X509_CERTIFICATES := $(sort $(X509_CERTIFICATES-y)) ifneq ($(objtree),$(srctree)) X509_CERTIFICATES += $(sort $(wildcard $(srctree)/*.x509)) @@ -165,7 +165,7 @@ ifndef CONFIG_MODULE_SIG_HASH $(error Could not determine digest type to use from kernel config) endif -signing_key.priv signing_key.x509: x509.genkey +signing_key.priv.auto signing_key.x509.auto: $(firstword $(wildcard $(srctree)/x509.genkey) x509.genkey.auto) @echo "###" @echo "### Now generating an X.509 key pair to be used for signing modules." @echo "###" @@ -175,30 +175,30 @@ signing_key.priv signing_key.x509: x509.genkey @echo "### number generator if one is available." @echo "###" openssl req -new -nodes -utf8 -$(CONFIG_MODULE_SIG_HASH) -days 36500 \ - -batch -x509 -config x509.genkey \ - -outform DER -out signing_key.x509 \ - -keyout signing_key.priv 2>&1 + -batch -x509 -config $< \ + -outform DER -out signing_key.x509.auto \ + -keyout signing_key.priv.auto 2>&1 @echo "###" @echo "### Key pair generated." @echo "###" -x509.genkey: +x509.genkey.auto: @echo Generating X.509 key generation config - @echo >x509.genkey "[ req ]" - @echo >>x509.genkey "default_bits = 4096" - @echo >>x509.genkey "distinguished_name = req_distinguished_name" - @echo >>x509.genkey "prompt = no" - @echo >>x509.genkey "string_mask = utf8only" - @echo >>x509.genkey "x509_extensions = myexts" - @echo >>x509.genkey - @echo >>x509.genkey "[ req_distinguished_name ]" - @echo >>x509.genkey "O = Magrathea" - @echo >>x509.genkey "CN = Glacier signing key" - @echo >>x509.genkey "emailAddress = slartibartfast@magrathea.h2g2" - @echo >>x509.genkey - @echo >>x509.genkey "[ myexts ]" - @echo >>x509.genkey "basicConstraints=critical,CA:FALSE" - @echo >>x509.genkey "keyUsage=digitalSignature" - @echo >>x509.genkey "subjectKeyIdentifier=hash" - @echo >>x509.genkey "authorityKeyIdentifier=keyid" + @echo >$@ "[ req ]" + @echo >>$@ "default_bits = 4096" + @echo >>$@ "distinguished_name = req_distinguished_name" + @echo >>$@ "prompt = no" + @echo >>$@ "string_mask = utf8only" + @echo >>$@ "x509_extensions = myexts" + @echo >>$@ + @echo >>$@ "[ req_distinguished_name ]" + @echo >>$@ "O = Magrathea" + @echo >>$@ "CN = Glacier signing key" + @echo >>$@ "emailAddress = slartibartfast@magrathea.h2g2" + @echo >>$@ + @echo >>$@ "[ myexts ]" + @echo >>$@ "basicConstraints=critical,CA:FALSE" + @echo >>$@ "keyUsage=digitalSignature" + @echo >>$@ "subjectKeyIdentifier=hash" + @echo >>$@ "authorityKeyIdentifier=keyid" endif -- 2.1.4 ^ permalink raw reply related [flat|nested] 44+ messages in thread
* Re: [PATCH] MODSIGN: Change default key details [ver #2] 2015-05-07 12:15 ` Michal Marek @ 2015-05-07 12:24 ` Michal Marek 2015-05-08 13:05 ` David Howells 2015-05-18 16:07 ` David Woodhouse 1 sibling, 1 reply; 44+ messages in thread From: Michal Marek @ 2015-05-07 12:24 UTC (permalink / raw) To: David Howells Cc: Linus Torvalds, Abelardo Ricart III, Linux Kernel Mailing List, Sedat Dilek, keyrings, Rusty Russell, LSM List, James Morris, Greg Kroah-Hartman On Thu, May 07, 2015 at 02:15:46PM +0200, Michal Marek wrote: > That's the problem with allowing a file to be either user-supplied or > generated. We can use separate files for the user-supplied/generated > cases like below and solve this for good. Not signed off yet, because it > is only lightly tested and the clean rules and .gitignore need to be > updated. Forgot to 'git add' one typo fix. >From 132a4494b255d2320bcafc729791b8bf26c9d244 Mon Sep 17 00:00:00 2001 From: Michal Marek <mmarek@suse.cz> Date: Thu, 7 May 2015 13:38:23 +0200 Subject: [PATCH] MODSIGN: Split user-supplied and autogenerated signing key Allow the users to place signing_key.{x509,priv} and x509.genkey in the source tree. If any of these files is missing, generate the file in the build tree with an .auto suffix. This avoids problems with overwriting user-supplied files. --- Makefile | 4 ++-- kernel/Makefile | 46 +++++++++++++++++++++++----------------------- 2 files changed, 25 insertions(+), 25 deletions(-) diff --git a/Makefile b/Makefile index 19e256a..69026fc 100644 --- a/Makefile +++ b/Makefile @@ -873,8 +873,8 @@ INITRD_COMPRESS-$(CONFIG_RD_LZ4) := lz4 # export INITRD_COMPRESS := $(INITRD_COMPRESS-y) ifdef CONFIG_MODULE_SIG_ALL -MODSECKEY = ./signing_key.priv -MODPUBKEY = ./signing_key.x509 +MODSECKEY = $(firstword $(wildcard $(srctree)/signing_key.priv) ./signing_key.priv.auto) +MODPUBKEY = $(firstword $(wildcard $(srctree)/signing_key.x509) ./signing_key.x509.auto) export MODPUBKEY mod_sign_cmd = perl $(srctree)/scripts/sign-file $(CONFIG_MODULE_SIG_HASH) $(MODSECKEY) $(MODPUBKEY) else diff --git a/kernel/Makefile b/kernel/Makefile index e072239..4bcf20e 100644 --- a/kernel/Makefile +++ b/kernel/Makefile @@ -124,7 +124,7 @@ $(obj)/config_data.h: $(obj)/config_data.gz FORCE ############################################################################### ifeq ($(CONFIG_SYSTEM_TRUSTED_KEYRING),y) X509_CERTIFICATES-y := $(wildcard *.x509) -X509_CERTIFICATES-$(CONFIG_MODULE_SIG) += signing_key.x509 +X509_CERTIFICATES-$(CONFIG_MODULE_SIG) += $(if $(wildcard $(srctree)/signing_key.x509),,signing_key.x509.auto) X509_CERTIFICATES := $(sort $(X509_CERTIFICATES-y)) ifneq ($(objtree),$(srctree)) X509_CERTIFICATES += $(sort $(wildcard $(srctree)/*.x509)) @@ -165,7 +165,7 @@ ifndef CONFIG_MODULE_SIG_HASH $(error Could not determine digest type to use from kernel config) endif -signing_key.priv signing_key.x509: x509.genkey +signing_key.priv.auto signing_key.x509.auto: $(firstword $(wildcard $(srctree)/x509.genkey) x509.genkey.auto) @echo "###" @echo "### Now generating an X.509 key pair to be used for signing modules." @echo "###" @@ -175,30 +175,30 @@ signing_key.priv signing_key.x509: x509.genkey @echo "### number generator if one is available." @echo "###" openssl req -new -nodes -utf8 -$(CONFIG_MODULE_SIG_HASH) -days 36500 \ - -batch -x509 -config x509.genkey \ - -outform DER -out signing_key.x509 \ - -keyout signing_key.priv 2>&1 + -batch -x509 -config $< \ + -outform DER -out signing_key.x509.auto \ + -keyout signing_key.priv.auto 2>&1 @echo "###" @echo "### Key pair generated." @echo "###" -x509.genkey: +x509.genkey.auto: @echo Generating X.509 key generation config - @echo >x509.genkey "[ req ]" - @echo >>x509.genkey "default_bits = 4096" - @echo >>x509.genkey "distinguished_name = req_distinguished_name" - @echo >>x509.genkey "prompt = no" - @echo >>x509.genkey "string_mask = utf8only" - @echo >>x509.genkey "x509_extensions = myexts" - @echo >>x509.genkey - @echo >>x509.genkey "[ req_distinguished_name ]" - @echo >>x509.genkey "O = Magrathea" - @echo >>x509.genkey "CN = Glacier signing key" - @echo >>x509.genkey "emailAddress = slartibartfast@magrathea.h2g2" - @echo >>x509.genkey - @echo >>x509.genkey "[ myexts ]" - @echo >>x509.genkey "basicConstraints=critical,CA:FALSE" - @echo >>x509.genkey "keyUsage=digitalSignature" - @echo >>x509.genkey "subjectKeyIdentifier=hash" - @echo >>x509.genkey "authorityKeyIdentifier=keyid" + @echo >$@ "[ req ]" + @echo >>$@ "default_bits = 4096" + @echo >>$@ "distinguished_name = req_distinguished_name" + @echo >>$@ "prompt = no" + @echo >>$@ "string_mask = utf8only" + @echo >>$@ "x509_extensions = myexts" + @echo >>$@ + @echo >>$@ "[ req_distinguished_name ]" + @echo >>$@ "O = Magrathea" + @echo >>$@ "CN = Glacier signing key" + @echo >>$@ "emailAddress = slartibartfast@magrathea.h2g2" + @echo >>$@ + @echo >>$@ "[ myexts ]" + @echo >>$@ "basicConstraints=critical,CA:FALSE" + @echo >>$@ "keyUsage=digitalSignature" + @echo >>$@ "subjectKeyIdentifier=hash" + @echo >>$@ "authorityKeyIdentifier=keyid" endif -- 2.1.4 ^ permalink raw reply related [flat|nested] 44+ messages in thread
* Re: [PATCH] MODSIGN: Change default key details [ver #2] 2015-05-07 12:24 ` Michal Marek @ 2015-05-08 13:05 ` David Howells 2015-05-12 8:51 ` Michal Marek 0 siblings, 1 reply; 44+ messages in thread From: David Howells @ 2015-05-08 13:05 UTC (permalink / raw) To: Michal Marek Cc: dhowells, Linus Torvalds, Abelardo Ricart III, Linux Kernel Mailing List, Sedat Dilek, keyrings, Rusty Russell, LSM List, James Morris, Greg Kroah-Hartman Michal Marek <mmarek@suse.cz> wrote: > + @echo >>$@ "[ req_distinguished_name ]" > + @echo >>$@ "O = Magrathea" > + @echo >>$@ "CN = Glacier signing key" > + @echo >>$@ "emailAddress = slartibartfast@magrathea.h2g2" This bit has changed upstream. David ^ permalink raw reply [flat|nested] 44+ messages in thread
* Re: [PATCH] MODSIGN: Change default key details [ver #2] 2015-05-08 13:05 ` David Howells @ 2015-05-12 8:51 ` Michal Marek 2015-05-15 15:21 ` David Howells 2015-05-19 14:14 ` David Howells 0 siblings, 2 replies; 44+ messages in thread From: Michal Marek @ 2015-05-12 8:51 UTC (permalink / raw) To: David Howells Cc: Linus Torvalds, Abelardo Ricart III, Linux Kernel Mailing List, Sedat Dilek, keyrings, Rusty Russell, LSM List, James Morris, Greg Kroah-Hartman On 2015-05-08 15:05, David Howells wrote: > Michal Marek <mmarek@suse.cz> wrote: > >> + @echo >>$@ "[ req_distinguished_name ]" >> + @echo >>$@ "O = Magrathea" >> + @echo >>$@ "CN = Glacier signing key" >> + @echo >>$@ "emailAddress = slartibartfast@magrathea.h2g2" > > This bit has changed upstream. Right. In this very thread :-). But are you fine with using *.auto for the generated files? I'll send a rebased series. Michal ^ permalink raw reply [flat|nested] 44+ messages in thread
* Re: [PATCH] MODSIGN: Change default key details [ver #2] 2015-05-12 8:51 ` Michal Marek @ 2015-05-15 15:21 ` David Howells 2015-05-19 14:14 ` David Howells 1 sibling, 0 replies; 44+ messages in thread From: David Howells @ 2015-05-15 15:21 UTC (permalink / raw) To: Michal Marek Cc: dhowells, Linus Torvalds, Abelardo Ricart III, Linux Kernel Mailing List, Sedat Dilek, keyrings, Rusty Russell, LSM List, James Morris, Greg Kroah-Hartman Michal Marek <mmarek@suse.cz> wrote: > Right. In this very thread :-). But are you fine with using *.auto for > the generated files? I'll send a rebased series. Sure, yes. David ^ permalink raw reply [flat|nested] 44+ messages in thread
* Re: [PATCH] MODSIGN: Change default key details [ver #2] 2015-05-12 8:51 ` Michal Marek 2015-05-15 15:21 ` David Howells @ 2015-05-19 14:14 ` David Howells 2015-05-19 15:19 ` David Woodhouse 1 sibling, 1 reply; 44+ messages in thread From: David Howells @ 2015-05-19 14:14 UTC (permalink / raw) To: Michal Marek, dwmw2 Cc: dhowells, Linus Torvalds, Abelardo Ricart III, Linux Kernel Mailing List, Sedat Dilek, keyrings, Rusty Russell, LSM List, James Morris, Greg Kroah-Hartman Hi Michal, > Right. In this very thread :-). But are you fine with using *.auto for > the generated files? I'll send a rebased series. Can you send me your patches and I'll add them to this: http://git.kernel.org/cgit/linux/kernel/git/dhowells/linux-fs.git/log/?h=modsign-pkcs7 Then I can integrate them with David Woodhouse's patches in the same area and pass the branch on to James Morris. David ^ permalink raw reply [flat|nested] 44+ messages in thread
* Re: [PATCH] MODSIGN: Change default key details [ver #2] 2015-05-19 14:14 ` David Howells @ 2015-05-19 15:19 ` David Woodhouse 0 siblings, 0 replies; 44+ messages in thread From: David Woodhouse @ 2015-05-19 15:19 UTC (permalink / raw) To: David Howells Cc: Michal Marek, Linus Torvalds, Abelardo Ricart III, Linux Kernel Mailing List, Sedat Dilek, keyrings, Rusty Russell, LSM List, James Morris, Greg Kroah-Hartman On Tue, 2015-05-19 at 15:14 +0100, David Howells wrote: > > > Right. In this very thread :-). But are you fine with using *.auto for > > the generated files? I'll send a rebased series. > > Can you send me your patches and I'll add them to this: > > http://git.kernel.org/cgit/linux/kernel/git/dhowells/linux-fs.git/log/?h=modsign-pkcs7 > > Then I can integrate them with David Woodhouse's patches in the same > area and pass the branch on to James Morris. We're talking about these three patches, yes? https://lkml.org/lkml/2015/2/20/546 https://lkml.org/lkml/2015/5/4/614 https://lkml.org/lkml/2015/5/7/488 I think the third is obsolete now that we allow the user to provide their own certificate + key by setting CONFIG_MODULE_SIG_KEY, because the in-tree signing_key.{priv,x509} are *always* autogenerated. The first two I don't think go far enough. I dislike automatically picking up files that were lying around in the tree, and it's still going to break if there's a file with a space in its name. Let's just introduce a new Kconfig option for 'extra certificates' which takes the filename of a PEM-format file. We can process that into DER form with some fairly trivial modifications to scripts/extract-cert.c. -- David Woodhouse Open Source Technology Centre David.Woodhouse@intel.com Intel Corporation ^ permalink raw reply [flat|nested] 44+ messages in thread
* Re: [PATCH] MODSIGN: Change default key details [ver #2] 2015-05-07 12:15 ` Michal Marek 2015-05-07 12:24 ` Michal Marek @ 2015-05-18 16:07 ` David Woodhouse 1 sibling, 0 replies; 44+ messages in thread From: David Woodhouse @ 2015-05-18 16:07 UTC (permalink / raw) To: Michal Marek Cc: David Howells, Linus Torvalds, Abelardo Ricart III, Linux Kernel Mailing List, Sedat Dilek, keyrings, Rusty Russell, LSM List, James Morris, Greg Kroah-Hartman [-- Attachment #1: Type: text/plain, Size: 929 bytes --] On Thu, 2015-05-07 at 14:15 +0200, Michal Marek wrote: > > I like > > Linus's use of the filechk macro on the second - but we shouldn't overwrite > > keys someone has manually placed in the tree if the key generation template > > changes due to git pull altering kernel/Makefile. > > That's the problem with allowing a file to be either user-supplied or > generated. We can use separate files for the user-supplied/generated > cases like below and solve this for good. Alternatively, we could declare that signing_key.priv/signing_key.x509 are *always* auto-generated. If the user wants to use a pregenerated key of their own then they can use CONFIG_MODULE_SIG_KEY¹ for that. -- David Woodhouse Open Source Technology Centre David.Woodhouse@intel.com Intel Corporation¹ http://git.infradead.org/users/dwmw2/modsign-pkcs11-c.git/commitdiff/3d69ae738 [-- Attachment #2: smime.p7s --] [-- Type: application/x-pkcs7-signature, Size: 5691 bytes --] ^ permalink raw reply [flat|nested] 44+ messages in thread
* Re: [PATCH] MODSIGN: Change default key details [ver #2] 2015-05-04 18:45 ` Linus Torvalds 2015-05-05 14:33 ` David Howells 2015-05-05 15:22 ` Michal Marek @ 2015-05-16 15:39 ` David Woodhouse 2015-05-18 10:47 ` David Howells 2 siblings, 1 reply; 44+ messages in thread From: David Woodhouse @ 2015-05-16 15:39 UTC (permalink / raw) To: Linus Torvalds Cc: Abelardo Ricart III, Michal Marek, Linux Kernel Mailing List, Sedat Dilek, David Howells, keyrings, Rusty Russell, LSM List, James Morris, Greg Kroah-Hartman [-- Attachment #1: Type: text/plain, Size: 1369 bytes --] On Mon, 2015-05-04 at 11:45 -0700, Linus Torvalds wrote: > On Sun, May 3, 2015 at 6:45 PM, Linus Torvalds > <torvalds@linux-foundation.org> wrote: > > > > I'd much rather see "x509.genkey" be generated with a move-if-changed > > pattern, so that it only changes if (a) it didn't exist before or (b) > > it actually has new content. > > Hmm. Something like the attached, to make the .x509.list file be > properly generated? > > That still leaves the problem that the X509_CERTIFICATES variable > itself seems to be badly defined, in that it ends up randomly having > the "./" in front of the filename due to confusion between > "signing_key.x509" being both in > > X509_CERTIFICATES-y := $(wildcard *.x509) $(wildcard $(srctree)/*.x509) > > (when that .x509 file was pre-existing), and > > X509_CERTIFICATES-$(CONFIG_MODULE_SIG) += $(objtree)/signing_key.x509 > > where I think that "$(objtree)/" comes in. > > DavidH, comments? Why not just take multiple certs in PEM form in a single file, rather than automatically including *.x509 in DER form? Wouldn't that be a whole lot easier? We can still have a special case for signing_key.x509 if we want it. -- dwmw2 -- David Woodhouse Open Source Technology Centre David.Woodhouse@intel.com Intel Corporation [-- Attachment #2: smime.p7s --] [-- Type: application/x-pkcs7-signature, Size: 5691 bytes --] ^ permalink raw reply [flat|nested] 44+ messages in thread
* Re: [PATCH] MODSIGN: Change default key details [ver #2] 2015-05-16 15:39 ` David Woodhouse @ 2015-05-18 10:47 ` David Howells 2015-05-18 10:56 ` David Howells 2015-05-18 11:13 ` David Woodhouse 0 siblings, 2 replies; 44+ messages in thread From: David Howells @ 2015-05-18 10:47 UTC (permalink / raw) To: David Woodhouse Cc: dhowells, Linus Torvalds, Abelardo Ricart III, Michal Marek, Linux Kernel Mailing List, Sedat Dilek, keyrings, Rusty Russell, LSM List, James Morris, Greg Kroah-Hartman David Woodhouse <dwmw2@infradead.org> wrote: > Why not just take multiple certs in PEM form in a single file, rather > than automatically including *.x509 in DER form? Wouldn't that be a > whole lot easier? No, for the following reasons: (1) Unless we want the kernel to be able to handle PEM form, they have to be converted to DER form for inclusion in system_certificates.S. (2) We would have to combine the automatically generated signing cert with the added certs, though, admittedly, this could be done in system_certificates.S. (3) We've already told people they must drop DER certs into the source tree and distribution kernel packages are already doing this, so we have to make sure they get this right. You could make it so that the make process picks up .pem files and converts them to DER-encoded .x509 files. You can cat a bunch of DER certs together and the kernel will break them apart when it parses the single buffer that contains all the certs. We could even make the kernel handle PEM. It shouldn't be very much overhead since it's just a wrapping/encoding of the DER, right? So it's by no means impossible, but it's not easier. David ^ permalink raw reply [flat|nested] 44+ messages in thread
* Re: [PATCH] MODSIGN: Change default key details [ver #2] 2015-05-18 10:47 ` David Howells @ 2015-05-18 10:56 ` David Howells 2015-05-18 11:13 ` David Woodhouse 1 sibling, 0 replies; 44+ messages in thread From: David Howells @ 2015-05-18 10:56 UTC (permalink / raw) To: David Woodhouse Cc: dhowells, Linus Torvalds, Abelardo Ricart III, Michal Marek, Linux Kernel Mailing List, Sedat Dilek, keyrings, Rusty Russell, LSM List, James Morris, Greg Kroah-Hartman David Howells <dhowells@redhat.com> wrote: > We could even make the kernel handle PEM. It shouldn't be very much overhead > since it's just a wrapping/encoding of the DER, right? OTOH, PEM is ~33% larger than DER, so we probably want to stick with DER embedded in the kernel. David ^ permalink raw reply [flat|nested] 44+ messages in thread
* Re: [PATCH] MODSIGN: Change default key details [ver #2] 2015-05-18 10:47 ` David Howells 2015-05-18 10:56 ` David Howells @ 2015-05-18 11:13 ` David Woodhouse 2015-05-19 2:14 ` Mimi Zohar 1 sibling, 1 reply; 44+ messages in thread From: David Woodhouse @ 2015-05-18 11:13 UTC (permalink / raw) To: David Howells Cc: Linus Torvalds, Abelardo Ricart III, Michal Marek, Linux Kernel Mailing List, Sedat Dilek, keyrings, Rusty Russell, LSM List, James Morris, Greg Kroah-Hartman [-- Attachment #1: Type: text/plain, Size: 2148 bytes --] On Mon, 2015-05-18 at 11:47 +0100, David Howells wrote: > David Woodhouse <dwmw2@infradead.org> wrote: > > > Why not just take multiple certs in PEM form in a single file, rather > > than automatically including *.x509 in DER form? Wouldn't that be a > > whole lot easier? > > No, for the following reasons: > > (1) Unless we want the kernel to be able to handle PEM form, they have to be > converted to DER form for inclusion in system_certificates.S. It's just base64. It's fairly trivial to convert. > (2) We would have to combine the automatically generated signing cert with > the added certs, though, admittedly, this could be done in > system_certificates.S. Yes, merging the signing cert (be it automatically generated or otherwise) does need to be done. But that's easy enough. And I already have work to do on processing the signing cert, to allow it to come from the same PKCS#11 URI that specifies the key. > (3) We've already told people they must drop DER certs into the source tree > and distribution kernel packages are already doing this, so we have to > make sure they get this right. Yes, absolutely. But I think we can cope with that. > You could make it so that the make process picks up .pem files and converts > them to DER-encoded .x509 files. I don't actually care whether it's PEM or DER form per se. What I really care about is the horrid trick of automatically finding the files to be included with a wildcard, and pulling them into the build. That would be icky enough if we *weren't* going to *trust* the things! With a PEM file it's common to have multiple certs in a single file, and you could have a simple config option for the 'additional certs' file which explicitly pulls it in. Rather than the current hack. Doing that with multiple certs in the same file in DER form, if that works, would also be tolerable. Although it's less normal to have a file in that format. -- David Woodhouse Open Source Technology Centre David.Woodhouse@intel.com Intel Corporation [-- Attachment #2: smime.p7s --] [-- Type: application/x-pkcs7-signature, Size: 5691 bytes --] ^ permalink raw reply [flat|nested] 44+ messages in thread
* Re: [PATCH] MODSIGN: Change default key details [ver #2] 2015-05-18 11:13 ` David Woodhouse @ 2015-05-19 2:14 ` Mimi Zohar 0 siblings, 0 replies; 44+ messages in thread From: Mimi Zohar @ 2015-05-19 2:14 UTC (permalink / raw) To: David Woodhouse Cc: David Howells, Linus Torvalds, Abelardo Ricart III, Michal Marek, Linux Kernel Mailing List, Sedat Dilek, keyrings, Rusty Russell, LSM List, James Morris, Greg Kroah-Hartman On Mon, 2015-05-18 at 12:13 +0100, David Woodhouse wrote: > On Mon, 2015-05-18 at 11:47 +0100, David Howells wrote: > > David Woodhouse <dwmw2@infradead.org> wrote: > > You could make it so that the make process picks up .pem files and converts > > them to DER-encoded .x509 files. > > I don't actually care whether it's PEM or DER form per se. What I > really care about is the horrid trick of automatically finding the > files to be included with a wildcard, and pulling them into the build. > > That would be icky enough if we *weren't* going to *trust* the things! Agreed! There's no reason for having them in the root of the build tree. > With a PEM file it's common to have multiple certs in a single file, > and you could have a simple config option for the 'additional certs' > file which explicitly pulls it in. Rather than the current hack. > Doing that with multiple certs in the same file in DER form, if that > works, would also be tolerable. Although it's less normal to have a > file in that format. Either method would be preferable. Mimi ^ permalink raw reply [flat|nested] 44+ messages in thread
* Re: [PATCH] MODSIGN: Change default key details [ver #2] 2015-05-01 21:41 ` Abelardo Ricart III 2015-05-02 4:12 ` Linus Torvalds @ 2015-05-20 10:17 ` David Woodhouse 2015-05-20 10:51 ` David Howells 2015-05-20 11:26 ` [PATCH] modsign: Use single PEM file for autogenerated key David Woodhouse 1 sibling, 2 replies; 44+ messages in thread From: David Woodhouse @ 2015-05-20 10:17 UTC (permalink / raw) To: Abelardo Ricart III, Michal Marek Cc: torvalds, linux-kernel, sedat.dilek, dhowells, keyrings, rusty, linux-security-module, james.l.morris, gregkh [-- Attachment #1: Type: text/plain, Size: 3217 bytes --] On Fri, 2015-05-01 at 17:41 -0400, Abelardo Ricart III wrote: > > From module-signing.txt: > > > Under normal conditions, the kernel build will automatically generate a new > > keypair using openssl if one does not exist in the files: > > > > signing_key.priv > > signing_key.x509 > > Nope, sorry, not true. Even if your keys exist, due to unfortunate > parallel make/disk write order/racy kbuild/goblins your x509.genkey > file has a newer timestamp than your keys, and now your keys are > going to get tossed (regenerated and overwritten, yay!). Worse still, > I think they could even get tossed AFTER the build decides "hey nice > keys, I'll just use those". Either way, this patch is ultimately > correct because this is exactly the kind of racy scenario order-only > prerequisites was made for. We should not care anything about > x509.genkey if our signing keys already exist. Period. > > Here's my two-line patch strictly defining the build order, for your perusal. > > Signed-off-by: Abelardo Ricart III <aricart@memnix.com> > --- > > diff --git a/kernel/Makefile b/kernel/Makefile > index 1408b33..10c8df0 100644 > --- a/kernel/Makefile > +++ b/kernel/Makefile > @@ -168,7 +168,8 @@ ifndef CONFIG_MODULE_SIG_HASH > $(error Could not determine digest type to use from kernel config) > endif > > -signing_key.priv signing_key.x509: x509.genkey > +signing_key.priv signing_key.x509: | x509.genkey > + $(warning *** X.509 module signing key pair not found in root of source tree ***) > @echo "###" > @echo "### Now generating an X.509 key pair to be used for signing modules." > @echo "###" I think we still need this, or something equivalent. I'll take a closer look at the dependencies and see if there's a better option — that bit about keys being tossed AFTER the build is already using them does definitely seem like a bug. This approach might suffice as a last resort, but I don't like it much. For an ephemeral key, we *do* want to rebuild it if you touch x509.genkey. And signing_key.{priv,x509} *are* now purely intended to be ephemeral — see https://lkml.org/lkml/2015/5/18/527 and my patches which David Howells has now merged into his tree. I suspect the real bug here will turn out to be caused by the fact that signing_key.priv and signing_key.x509 are distinct Makefile targets and we are *also* generating each as a side-effect of generating the other. And make doesn't know about the side-effects. Maybe we'd do better with a single rule for 'signing_key.pem' which contains both key and cert. Which is the way it is for an external key anyway. I'll look at implementing that. I also wonder if the problem that Linus saw with "X.509 certificate list changed" was a different issue, in the $(wildcard *.x509) handling. I am increasingly convinced we should just ditch that entire can of worms and take a single file named in a Kconfig option. I'll throw that together too and see if it makes me happy. -- David Woodhouse Open Source Technology Centre David.Woodhouse@intel.com Intel Corporation [-- Attachment #2: smime.p7s --] [-- Type: application/x-pkcs7-signature, Size: 5691 bytes --] ^ permalink raw reply [flat|nested] 44+ messages in thread
* Re: [PATCH] MODSIGN: Change default key details [ver #2] 2015-05-20 10:17 ` David Woodhouse @ 2015-05-20 10:51 ` David Howells 2015-05-20 11:08 ` David Woodhouse 2015-05-20 11:26 ` [PATCH] modsign: Use single PEM file for autogenerated key David Woodhouse 1 sibling, 1 reply; 44+ messages in thread From: David Howells @ 2015-05-20 10:51 UTC (permalink / raw) To: David Woodhouse Cc: dhowells, Abelardo Ricart III, Michal Marek, torvalds, linux-kernel, sedat.dilek, keyrings, rusty, linux-security-module, james.l.morris, gregkh David Woodhouse <dwmw2@infradead.org> wrote: > I am increasingly convinced we should just ditch that entire > can of worms and take a single file named in a Kconfig option. If you're going to do this, make it two, please. One for the key actually used to sign modules and one for a block of auxiliary keys. David ^ permalink raw reply [flat|nested] 44+ messages in thread
* Re: [PATCH] MODSIGN: Change default key details [ver #2] 2015-05-20 10:51 ` David Howells @ 2015-05-20 11:08 ` David Woodhouse 0 siblings, 0 replies; 44+ messages in thread From: David Woodhouse @ 2015-05-20 11:08 UTC (permalink / raw) To: David Howells Cc: Abelardo Ricart III, Michal Marek, torvalds, linux-kernel, sedat.dilek, keyrings, rusty, linux-security-module, james.l.morris, gregkh On Wed, 2015-05-20 at 11:51 +0100, David Howells wrote: > If you're going to do this, make it two, please. One for the key > actually used to sign modules and one for a block of auxiliary keys. I've done the former already. The plan is to do the latter as a separate option, yes. -- David Woodhouse Open Source Technology Centre David.Woodhouse@intel.com Intel Corporation ^ permalink raw reply [flat|nested] 44+ messages in thread
* [PATCH] modsign: Use single PEM file for autogenerated key 2015-05-20 10:17 ` David Woodhouse 2015-05-20 10:51 ` David Howells @ 2015-05-20 11:26 ` David Woodhouse 2015-05-20 14:56 ` David Howells 1 sibling, 1 reply; 44+ messages in thread From: David Woodhouse @ 2015-05-20 11:26 UTC (permalink / raw) To: Abelardo Ricart III Cc: Michal Marek, torvalds, linux-kernel, sedat.dilek, dhowells, keyrings, rusty, linux-security-module, james.l.morris, gregkh On Wed, 2015-05-20 at 11:17 +0100, David Woodhouse wrote: > Maybe we'd do better with a single rule for 'signing_key.pem' which > contains both key and cert. Which is the way it is for an external key > anyway. I'll look at implementing that. What's this, [PATCH 14/8] or thereabouts? Added to the tree at http://git.infradead.org/users/dwmw2/modsign-pkcs11-c.git >From b6cf6627d068a8752f619594e6dbbf4101a86a7f Mon Sep 17 00:00:00 2001 From: David Woodhouse <David.Woodhouse@intel.com> Date: Wed, 20 May 2015 12:14:29 +0100 Subject: [PATCH] modsign: Use single PEM file for autogenerated key The current rule for generating signing_key.priv and signing_key.x509 is a classic example of a bad rule which has a tendency to break parallel make. When invoked to create *either* target, it generates the other target as a side-effect that make didn't predict. So let's switch to using a single file signing_key.pem which contains both key and certificate. That matches what we do in the case of an external key specified by CONFIG_MODULE_SIG_KEY anyway, so it's also slightly cleaner. Signed-off-by: David Woodhouse <David.Woodhouse@intel.com> --- Until now, people could still drop their own key into signing_key.{priv,x509}. Doing so was now *deprecated*, and it was documented that they ought to use CONFIG_MODULE_SIG_KEY for that, but it did still work. Now it doesn't. Do we care? I don't think so. I am disinclined to put in place any kind of backward-compatibility to find and use the old filenames. And I don't much care about changing the build system 'interface' for the user. I'm *very* keen to break that $(wildcard *.x509) crap anyway, so we might as well do this at the same time. .gitignore | 1 + Documentation/module-signing.txt | 9 ++++----- Makefile | 4 ++-- init/Kconfig | 4 ++-- kernel/Makefile | 15 +++++++-------- 5 files changed, 16 insertions(+), 17 deletions(-) diff --git a/.gitignore b/.gitignore index 4ad4a98..17fa24d 100644 --- a/.gitignore +++ b/.gitignore @@ -97,6 +97,7 @@ GTAGS # Leavings from module signing # extra_certificates +signing_key.pem signing_key.priv signing_key.x509 x509.genkey diff --git a/Documentation/module-signing.txt b/Documentation/module-signing.txt index 6930019..5d5e4e3 100644 --- a/Documentation/module-signing.txt +++ b/Documentation/module-signing.txt @@ -91,7 +91,7 @@ This has a number of options available: (4) "File name or PKCS#11 URI of module signing key" (CONFIG_MODULE_SIG_KEY) Setting this option to something other than its default of - "signing_key.priv" will disable the autogeneration of signing keys and + "signing_key.pem" will disable the autogeneration of signing keys and allow the kernel modules to be signed with a key of your choosing. The string provided should identify a file containing both a private key and its corresponding X.509 certificate in PEM form, or — on @@ -116,11 +116,10 @@ kernel so that it can be used to check the signatures as the modules are loaded. Under normal conditions, when CONFIG_MODULE_SIG_KEY is unchanged from its -default of "signing_key.priv", the kernel build will automatically generate -a new keypair using openssl if one does not exist in the files: +default, the kernel build will automatically generate a new keypair using +openssl if one does not exist in the file: - signing_key.priv - signing_key.x509 + signing_key.pem during the building of vmlinux (the public part of the key needs to be built into vmlinux) using parameters in the: diff --git a/Makefile b/Makefile index 9590e67..ce2f468 100644 --- a/Makefile +++ b/Makefile @@ -1175,8 +1175,8 @@ MRPROPER_DIRS += include/config usr/include include/generated \ arch/*/include/generated .tmp_objdiff MRPROPER_FILES += .config .config.old .version .old_version \ Module.symvers tags TAGS cscope* GPATH GTAGS GRTAGS GSYMS \ - signing_key.priv signing_key.x509 x509.genkey \ - extra_certificates signing_key.x509.keyid \ + signing_key.pem signing_key.priv signing_key.x509 \ + x509.genkey extra_certificates signing_key.x509.keyid \ signing_key.x509.signer vmlinux-gdb.py # clean - Delete most, but leave enough to build external modules diff --git a/init/Kconfig b/init/Kconfig index a4b4f39..a529353 100644 --- a/init/Kconfig +++ b/init/Kconfig @@ -1956,7 +1956,7 @@ config MODULE_SIG_HASH config MODULE_SIG_KEY string "File name or PKCS#11 URI of module signing key" - default "signing_key.priv" + default "signing_key.pem" depends on MODULE_SIG help Provide the file name of a private key/certificate in PEM format, @@ -1964,7 +1964,7 @@ config MODULE_SIG_KEY the URI should identify, both the certificate and its corresponding private key. - If this option is unchanged from its default "signing_key.priv", + If this option is unchanged from its default "signing_key.pem", then the kernel will automatically generate the private key and certificate as described in Documentation/module-signing.txt diff --git a/kernel/Makefile b/kernel/Makefile index 9fb259d..541e1e8 100644 --- a/kernel/Makefile +++ b/kernel/Makefile @@ -173,8 +173,8 @@ endif # We do it this way rather than having a boolean option for enabling an # external private key, because 'make randconfig' might enable such a # boolean option and we unfortunately can't make it depend on !RANDCONFIG. -ifeq ($(CONFIG_MODULE_SIG_KEY),"signing_key.priv") -signing_key.priv signing_key.x509: x509.genkey +ifeq ($(CONFIG_MODULE_SIG_KEY),"signing_key.pem") +signing_key.pem: x509.genkey @echo "###" @echo "### Now generating an X.509 key pair to be used for signing modules." @echo "###" @@ -185,8 +185,8 @@ signing_key.priv signing_key.x509: x509.genkey @echo "###" openssl req -new -nodes -utf8 -$(CONFIG_MODULE_SIG_HASH) -days 36500 \ -batch -x509 -config x509.genkey \ - -outform DER -out signing_key.x509 \ - -keyout signing_key.priv 2>&1 + -outform PEM -out signing_key.pem \ + -keyout signing_key.pem 2>&1 @echo "###" @echo "### Key pair generated." @echo "###" @@ -210,9 +210,9 @@ x509.genkey: @echo >>x509.genkey "keyUsage=digitalSignature" @echo >>x509.genkey "subjectKeyIdentifier=hash" @echo >>x509.genkey "authorityKeyIdentifier=keyid" -else -# For external (PKCS#11 or PEM) key, we need to obtain the certificate from -# CONFIG_MODULE_SIG_KEY automatically. +endif + +# We need to obtain the certificate from CONFIG_MODULE_SIG_KEY. quiet_cmd_extract_der = CERT_DER $(2) cmd_extract_der = scripts/extract-cert "$(2)" signing_key.x509 @@ -249,4 +249,3 @@ endif signing_key.x509: scripts/extract-cert include/config/module/sig/key.h $(X509_DEP) $(call cmd,extract_der,$(X509_SOURCE)) endif -endif -- 2.4.1 -- David Woodhouse Open Source Technology Centre David.Woodhouse@intel.com Intel Corporation ^ permalink raw reply related [flat|nested] 44+ messages in thread
* Re: [PATCH] modsign: Use single PEM file for autogenerated key 2015-05-20 11:26 ` [PATCH] modsign: Use single PEM file for autogenerated key David Woodhouse @ 2015-05-20 14:56 ` David Howells 2015-05-20 15:18 ` David Woodhouse 2015-05-21 11:31 ` David Woodhouse 0 siblings, 2 replies; 44+ messages in thread From: David Howells @ 2015-05-20 14:56 UTC (permalink / raw) To: David Woodhouse Cc: dhowells, Abelardo Ricart III, Michal Marek, torvalds, linux-kernel, sedat.dilek, keyrings, rusty, linux-security-module, james.l.morris, gregkh David Woodhouse <dwmw2@infradead.org> wrote: > I am disinclined to put in place any kind of backward-compatibility to > find and use the old filenames. And I don't much care about changing the > build system 'interface' for the user. I'm *very* keen to break that > $(wildcard *.x509) crap anyway, so we might as well do this at the same > time. Should some sort of warning then be emitted if $(wildcard *.x509) *does* turn up anything? Just so that people don't get unexpectedly surprised when their auxiliary keys are suddenly ignored. David ^ permalink raw reply [flat|nested] 44+ messages in thread
* Re: [PATCH] modsign: Use single PEM file for autogenerated key 2015-05-20 14:56 ` David Howells @ 2015-05-20 15:18 ` David Woodhouse 2015-05-21 11:31 ` David Woodhouse 1 sibling, 0 replies; 44+ messages in thread From: David Woodhouse @ 2015-05-20 15:18 UTC (permalink / raw) To: David Howells Cc: Abelardo Ricart III, Michal Marek, torvalds, linux-kernel, sedat.dilek, keyrings, rusty, linux-security-module, james.l.morris, gregkh On Wed, 2015-05-20 at 15:56 +0100, David Howells wrote: > David Woodhouse <dwmw2@infradead.org> wrote: > > > I am disinclined to put in place any kind of backward-compatibility to > > find and use the old filenames. And I don't much care about changing the > > build system 'interface' for the user. I'm *very* keen to break that > > $(wildcard *.x509) crap anyway, so we might as well do this at the same > > time. > > Should some sort of warning then be emitted if $(wildcard *.x509) *does* turn > up anything? Just so that people don't get unexpectedly surprised when their > auxiliary keys are suddenly ignored. Would people even notice such a warning? People who are using long-term keys and inserting them into the kernel build probably ought to be paying attention and know what they're doing. There are relatively few of them, and I think that as long as the change is clearly documented, we should probably be fine. Besides, *anyone* relying on that horrid wildcard crap should have *expected* it to go away because it was an abomination :) -- David Woodhouse Open Source Technology Centre David.Woodhouse@intel.com Intel Corporation ^ permalink raw reply [flat|nested] 44+ messages in thread
* Re: [PATCH] modsign: Use single PEM file for autogenerated key 2015-05-20 14:56 ` David Howells 2015-05-20 15:18 ` David Woodhouse @ 2015-05-21 11:31 ` David Woodhouse 1 sibling, 0 replies; 44+ messages in thread From: David Woodhouse @ 2015-05-21 11:31 UTC (permalink / raw) To: David Howells Cc: Abelardo Ricart III, Michal Marek, torvalds, linux-kernel, sedat.dilek, keyrings, rusty, linux-security-module, james.l.morris, gregkh On Wed, 2015-05-20 at 15:56 +0100, David Howells wrote: > Should some sort of warning then be emitted if $(wildcard *.x509) *does* turn > up anything? Just so that people don't get unexpectedly surprised when their > auxiliary keys are suddenly ignored. I've added a note to the help text for the CONFIG_SYSTEM_TRUSTED_KEYS option, to warn people that *.x509 will no longer be implicitly trusted. I suppose if you *really* insist, we could do something like ifneq ($(filter-out signing_key.x509,$(wildcard *.x509)),) $(warning ...) endif That detail aside, if we have consensus that the patch below is the way forward, I may reshuffle the previous patches in the tree a little to include this... >From eb12ad71ef7f239979ffc3525d41cd3acb354cf3 Mon Sep 17 00:00:00 2001 From: David Woodhouse <David.Woodhouse@intel.com> Date: Thu, 21 May 2015 12:23:55 +0100 Subject: [PATCH] modsign: Add explicit CONFIG_SYSTEM_TRUSTED_KEYS option Let the user explicitly provide a file containing trusted keys, instead of just automatically finding files matching *.x509 in the build tree and trusting whatever we find. This really ought to be an *explicit* configuration, and the build rules for dealing with the files were fairly painful too. Signed-off-by: David Woodhouse <David.Woodhouse@intel.com> --- Documentation/module-signing.txt | 15 +++-- init/Kconfig | 13 +++++ kernel/Makefile | 123 ++++++++++++++++++++------------------- 3 files changed, 87 insertions(+), 64 deletions(-) diff --git a/Documentation/module-signing.txt b/Documentation/module-signing.txt index 5d5e4e3..4e62bc2 100644 --- a/Documentation/module-signing.txt +++ b/Documentation/module-signing.txt @@ -88,6 +88,7 @@ This has a number of options available: than being a module) so that modules signed with that algorithm can have their signatures checked without causing a dependency loop. + (4) "File name or PKCS#11 URI of module signing key" (CONFIG_MODULE_SIG_KEY) Setting this option to something other than its default of @@ -104,6 +105,13 @@ This has a number of options available: means of the KBUILD_SIGN_PIN variable. + (5) "Additional X.509 keys for default system keyring" (CONFIG_SYSTEM_TRUSTED_KEYS) + + This option can be set to the filename of a PEM-encoded file containing + additional certificates which will be included in the system keyring by + default. + + ======================= GENERATING SIGNING KEYS ======================= @@ -171,10 +179,9 @@ in a keyring called ".system_keyring" that can be seen by: 302d2d52 I------ 1 perm 1f010000 0 0 asymmetri Fedora kernel signing key: d69a84e6bce3d216b979e9505b3e3ef9a7118079: X509.RSA a7118079 [] ... -Beyond the public key generated specifically for module signing, any file -placed in the kernel source root directory or the kernel build root directory -whose name is suffixed with ".x509" will be assumed to be an X.509 public key -and will be added to the keyring. +Beyond the public key generated specifically for module signing, additional +trusted certificates can be provided in a PEM-encoded file referenced by the +CONFIG_SYSTEM_TRUSTED_KEYS configuration option. Further, the architecture code may take public keys from a hardware store and add those in also (e.g. from the UEFI key database). diff --git a/init/Kconfig b/init/Kconfig index a529353..b46c195 100644 --- a/init/Kconfig +++ b/init/Kconfig @@ -1758,6 +1758,19 @@ config SYSTEM_TRUSTED_KEYRING Keys in this keyring are used by module signature checking. +config SYSTEM_TRUSTED_KEYS + string "Additional X.509 keys for default system keyring" + depends on SYSTEM_TRUSTED_KEYRING + help + If set, this option should be the filename of a PEM-formatted file + containing trusted X.509 certificates to be included in the default + system keyring. Any certificate used for module signing is implicitly + also trusted. + + NOTE: If you previously provided keys for the system keyring in the + form of DER-encoded *.x509 files in the top-level build directory, + those are no longer used. You will need to set this option instead. + config SYSTEM_DATA_VERIFICATION def_bool n select SYSTEM_TRUSTED_KEYRING diff --git a/kernel/Makefile b/kernel/Makefile index 541e1e8..4b2b1c7 100644 --- a/kernel/Makefile +++ b/kernel/Makefile @@ -114,46 +114,73 @@ $(obj)/config_data.h: $(obj)/config_data.gz FORCE ############################################################################### # -# Roll all the X.509 certificates that we can find together and pull them into -# the kernel so that they get loaded into the system trusted keyring during -# boot. +# When a Kconfig string contains a filename, it is suitable for +# passing to shell commands. It is surrounded by double-quotes, and +# any double-quotes or backslashes within it are escaped by +# backslashes. # -# We look in the source root and the build root for all files whose name ends -# in ".x509". Unfortunately, this will generate duplicate filenames, so we -# have make canonicalise the pathnames and then sort them to discard the -# duplicates. +# This is no use for dependencies or $(wildcard). We need to strip the +# surrounding quotes and the escaping from quotes and backslashes, and +# we *do* need to escape any spaces in the string. So, for example: +# +# Usage: $(eval $(call config_filename,FOO)) +# +# Defines FOO_FILENAME based on the contents of the CONFIG_FOO option, +# transformed as described above to be suitable for use within the +# makefile. +# +# Also, if the filename is a relative filename and exists in the source +# tree but not the build tree, define FOO_SRCPREFIX as $(srctree)/ to +# be prefixed to *both* command invocation and dependencies. +# +# Note: We also print the filenames in the quiet_cmd_foo text, and +# perhaps ought to have a version specially escaped for that purpose. +# But it's only cosmetic, and $(patsubst "%",%,$(CONFIG_FOO)) is good +# enough. It'll strip the quotes in the common case where there's no +# space and it's a simple filename, and it'll retain the quotes when +# there's a space. There are some esoteric cases in which it'll print +# the wrong thing, but we don't really care. The actual dependencies +# and commands *do* get it right, with various combinations of single +# and double quotes, backslashes and spaces in the filenames. # ############################################################################### -ifeq ($(CONFIG_SYSTEM_TRUSTED_KEYRING),y) -X509_CERTIFICATES-y := $(wildcard *.x509) $(wildcard $(srctree)/*.x509) -X509_CERTIFICATES-$(CONFIG_MODULE_SIG) += $(objtree)/signing_key.x509 -X509_CERTIFICATES-raw := $(sort $(foreach CERT,$(X509_CERTIFICATES-y), \ - $(or $(realpath $(CERT)),$(CERT)))) -X509_CERTIFICATES := $(subst $(realpath $(objtree))/,,$(X509_CERTIFICATES-raw)) - -ifeq ($(X509_CERTIFICATES),) -$(warning *** No X.509 certificates found ***) +# +quote := $(firstword " ") +space := +space += +space_escape := %%%SPACE%%% +# +define config_filename = +$(1)_FILENAME := $$(subst \\,\,$$(subst \$$(quote),$$(quote),$$(subst $$(space_escape),\$$(space),$$(patsubst "%",%,$$(subst $$(space),$$(space_escape),$$(CONFIG_$(1))))))) +ifneq ($$(patsubst /%,%,$$(firstword $$($(1)_FILENAME))),$$(firstword $$($(1)_FILENAME))) +else +ifeq ($$(wildcard $$($(1)_FILENAME)),) +ifneq ($$(wildcard $$(srctree)/$$($(1)_FILENAME)),) +$(1)_SRCPREFIX := $(srctree)/ endif - -ifneq ($(wildcard $(obj)/.x509.list),) -ifneq ($(shell cat $(obj)/.x509.list),$(X509_CERTIFICATES)) -$(info X.509 certificate list changed) -$(shell rm $(obj)/.x509.list) endif endif +endef +# +############################################################################### + + +ifeq ($(CONFIG_SYSTEM_TRUSTED_KEYRING),y) + +$(eval $(call config_filename,SYSTEM_TRUSTED_KEYS)) + +SIGNING_X509-$(CONFIG_MODULE_SIG) += signing_key.x509 kernel/system_certificates.o: $(obj)/x509_certificate_list -quiet_cmd_x509certs = CERTS $@ - cmd_x509certs = cat $(X509_CERTIFICATES) /dev/null >$@ $(foreach X509,$(X509_CERTIFICATES),; $(kecho) " - Including cert $(X509)") +quiet_cmd_x509certs = CERTS $(SIGNING_X509-y) $(patsubst "%",%,$(2)) + cmd_x509certs = ( cat $(SIGNING_X509-y) /dev/null; \ + awk '/-----BEGIN CERTIFICATE-----/{flag=1;next}/-----END CERTIFICATE-----/{flag=0}flag' $(2) /dev/null | base64 -d ) > $@ || ( rm $@; exit 1) targets += $(obj)/x509_certificate_list -$(obj)/x509_certificate_list: $(X509_CERTIFICATES) $(obj)/.x509.list - $(call if_changed,x509certs) +$(obj)/x509_certificate_list: $(SIGNING_X509-y) include/config/system/trusted/keys.h include/config/module/sig.h $(SYSTEM_TRUSTED_KEYS_SRCPREFIX)$(SYSTEM_TRUSTED_KEYS_FILENAME) + $(call if_changed,x509certs,$(SYSTEM_TRUSTED_KEYS_SRCPREFIX)$(CONFIG_SYSTEM_TRUSTED_KEYS)) -targets += $(obj)/.x509.list -$(obj)/.x509.list: - @echo $(X509_CERTIFICATES) >$@ endif clean-files := x509_certificate_list .x509.list @@ -212,40 +239,16 @@ x509.genkey: @echo >>x509.genkey "authorityKeyIdentifier=keyid" endif -# We need to obtain the certificate from CONFIG_MODULE_SIG_KEY. -quiet_cmd_extract_der = CERT_DER $(2) - cmd_extract_der = scripts/extract-cert "$(2)" signing_key.x509 +$(eval $(call config_filename,MODULE_SIG_KEY)) -# CONFIG_MODULE_SIG_KEY is either a PKCS#11 URI or a filename. It is -# surrounded by quotes, and may contain spaces. To strip the quotes -# with $(patsubst) we need to turn the spaces into something else. -# And if it's a filename, those spaces need to be escaped as '\ ' in -# order to use it in dependencies or $(wildcard). -space := -space += -space_escape := %%%SPACE%%% -X509_SOURCE_temp := $(subst $(space),$(space_escape),$(CONFIG_MODULE_SIG_KEY)) -# We need this to check for absolute paths or PKCS#11 URIs. -X509_SOURCE_ONEWORD := $(patsubst "%",%,$(X509_SOURCE_temp)) -# This is the actual source filename/URI without the quotes -X509_SOURCE := $(subst $(space_escape),$(space),$(X509_SOURCE_ONEWORD)) -# This\ version\ with\ spaces\ escaped\ for\ $(wildcard)\ and\ dependencies -X509_SOURCE_ESCAPED := $(subst $(space_escape),\$(space),$(X509_SOURCE_ONEWORD)) - -ifeq ($(patsubst pkcs11:%,%,$(X509_SOURCE_ONEWORD)),$(X509_SOURCE_ONEWORD)) -# If it's a filename, depend on it. -X509_DEP := $(X509_SOURCE_ESCAPED) -ifeq ($(patsubst /%,%,$(X509_SOURCE_ONEWORD)),$(X509_SOURCE_ONEWORD)) -ifeq ($(wildcard $(X509_SOURCE_ESCAPED)),) -ifneq ($(wildcard $(srctree)/$(X509_SOURCE_ESCAPED)),) -# Non-absolute filename, found in source tree and not build tree -X509_SOURCE := $(srctree)/$(X509_SOURCE) -X509_DEP := $(srctree)/$(X509_SOURCE_ESCAPED) -endif -endif -endif +# If CONFIG_MODULE_SIG_KEY isn't a PKCS#11 URI, depend on it +ifeq ($(patsubst pkcs11:%,%,$(firstword $(MODULE_SIG_KEY_FILENAME))),$(firstword $(MODULE_SIG_KEY_FILENAME))) +X509_DEP := $(MODULE_SIG_KEY_SRCPREFIX)$(MODULE_SIG_KEY_FILENAME) endif +quiet_cmd_extract_der = SIGNING_CERT $(patsubst "%",%,$(2)) + cmd_extract_der = scripts/extract-cert $(2) signing_key.x509 + signing_key.x509: scripts/extract-cert include/config/module/sig/key.h $(X509_DEP) - $(call cmd,extract_der,$(X509_SOURCE)) + $(call cmd,extract_der,$(MODULE_SIG_KEY_SRCPREFIX)$(CONFIG_MODULE_SIG_KEY)) endif -- 2.4.1 -- David Woodhouse Open Source Technology Centre David.Woodhouse@intel.com Intel Corporation ^ permalink raw reply related [flat|nested] 44+ messages in thread
end of thread, other threads:[~2015-05-21 11:31 UTC | newest]
Thread overview: 44+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2015-04-30 13:58 [PATCH] MODSIGN: Change default key details [ver #2] David Howells
2015-04-30 14:39 ` Sedat Dilek
2015-04-30 14:50 ` David Howells
2015-04-30 17:49 ` Sedat Dilek
2015-04-30 18:00 ` Linus Torvalds
2015-05-01 21:41 ` Abelardo Ricart III
2015-05-02 4:12 ` Linus Torvalds
2015-05-02 6:57 ` Sedat Dilek
2015-05-02 9:46 ` Abelardo Ricart III
2015-05-04 1:45 ` Linus Torvalds
2015-05-04 4:42 ` Abelardo Ricart III
[not found] ` <CA+55aFzYUsXHC=_RiQFBhMmDxrFT4bqNP5F0LGWUu7Hc9sXBFQ@mail.gmail.com>
2015-05-04 7:18 ` Abelardo Ricart III
2015-05-04 21:40 ` Abelardo Ricart III
2015-05-05 14:34 ` David Howells
2015-05-05 22:44 ` Abelardo Ricart III
2015-05-04 18:45 ` Linus Torvalds
2015-05-05 14:33 ` David Howells
2015-05-05 14:37 ` David Howells
2015-05-05 14:43 ` Linus Torvalds
2015-05-05 15:30 ` David Howells
2015-05-05 15:22 ` Michal Marek
2015-05-05 15:41 ` Linus Torvalds
2015-05-06 12:20 ` Michal Marek
2015-05-07 11:00 ` David Howells
2015-05-07 12:15 ` Michal Marek
2015-05-07 12:24 ` Michal Marek
2015-05-08 13:05 ` David Howells
2015-05-12 8:51 ` Michal Marek
2015-05-15 15:21 ` David Howells
2015-05-19 14:14 ` David Howells
2015-05-19 15:19 ` David Woodhouse
2015-05-18 16:07 ` David Woodhouse
2015-05-16 15:39 ` David Woodhouse
2015-05-18 10:47 ` David Howells
2015-05-18 10:56 ` David Howells
2015-05-18 11:13 ` David Woodhouse
2015-05-19 2:14 ` Mimi Zohar
2015-05-20 10:17 ` David Woodhouse
2015-05-20 10:51 ` David Howells
2015-05-20 11:08 ` David Woodhouse
2015-05-20 11:26 ` [PATCH] modsign: Use single PEM file for autogenerated key David Woodhouse
2015-05-20 14:56 ` David Howells
2015-05-20 15:18 ` David Woodhouse
2015-05-21 11:31 ` David Woodhouse
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox