mikael/linux-hardened
Archived
1
0
Fork 0
Code Issues Pull requests Actions Packages Projects Releases Wiki Activity

Add ARM64 VirtIO profile

Browse source
This commit is contained in:
Mikael Voss 2024-08-03 00:25:16 +02:00
parent d1e1a5af7b
commit 072ec3e54c
8 changed files with 92 additions and 48 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
arm64.nix Normal file
View file

@ -0,0 +1,12 @@
{ lib, ... }: with lib.kernel; {
ARM64_VA_BITS_48 = yes;
ARM64_PAN = yes;
ARM64_USE_LSE_ATOMICS = yes;
ARM64_CNP = yes;
ARM64_PTR_AUTH = yes;
ARM64_EPAN = yes;
ACPI_CPPC_CPUFREQ = yes;
ARM_SMMU_V3 = yes;
}

6
arm64/qemu-virtio.nix Normal file
View file

@ -0,0 +1,6 @@
{ lib, ... }@args: with lib.kernel;
import ../qemu-virtio.nix args // {
SERIAL_AMBA_PL011 = yes;
SERIAL_AMBA_PL011_CONSOLE = yes;
}

5
base.nix
View file

@ -186,6 +186,7 @@
PCI = yes;
PCI_MSI = yes;
PCI_HOST_GENERIC = yes;
PCIE_BUS_PERFORMANCE = option yes;
DEVTMPFS = yes;
@ -226,6 +227,9 @@
VT_CONSOLE = yes;
UNIX98_PTYS = yes;
SERIAL_DEV_BUS = yes;
SERIAL_DEV_CTRL_TTYPORT = yes;
TCG_TPM = yes;
TCG_TPM2_HMAC = yes;
TCG_TIS = yes;
@ -343,3 +347,4 @@
} // lib.optionalAttrs hostPlatform.is64bit {
"64BIT" = option yes;
} // lib.optionalAttrs hostPlatform.isx86 (import ./x86.nix args)
// lib.optionalAttrs hostPlatform.isAarch64 (import ./arm64.nix args)

4
dm-crypt.nix
View file

@ -21,7 +21,11 @@
CRYPTO_AES_RISCV64 = yes;
CRYPTO_SHA256_RISCV64 = yes;
} // lib.optionalAttrs hostPlatform.isAarch64 {
CRYPTO_AES_ARM64 = yes;
CRYPTO_AES_ARM64_CE = yes;
CRYPTO_AES_ARM64_CE_BLK = yes;
CRYPTO_AES_ARM64_NEON_BLK = yes;
CRYPTO_AES_ARM64_BS = yes;
CRYPTO_AEGIS128_SIMD = yes;
CRYPTO_SHA256_ARM64 = yes;
}

7
profiles.nix
View file

@ -33,4 +33,11 @@
firmware = [ ];
};
};
aarch64-linux = {
qemu-virtio = {
arch = "armv8-a";
config = ./arm64/qemu-virtio.nix;
firmware = [ ];
};
};
}

54
qemu-virtio.nix Normal file
View file

@ -0,0 +1,54 @@
{ lib, ... }:
with lib.kernel; {
NR_CPUS = freeform "8";
HYPERVISOR_GUEST = yes;
PARAVIRT = yes;
PARAVIRT_SPINLOCKS = yes;
KVM_GUEST = yes;
ARCH_CPUIDLE_HALTPOLL = yes;
PARAVIRT_CLOCK = yes;
HALTPOLL_CPUIDLE = yes;
FW_CFG_SYSFS = yes;
BLK_MQ_VIRTIO = yes;
VIRTIO_BLK = yes;
VIRTIO_NET = yes;
VIRTIO_CONSOLE = yes;
HW_RANDOM = yes;
HW_RANDOM_VIRTIO = yes;
I6300ESB_WDT = yes;
DRM = yes;
DRM_FBDEV_EMULATION = yes;
DRM_VIRTIO_GPU = yes;
DRM_VIRTIO_GPU_KMS = yes;
DRM_BOCHS = yes;
DRM_SIMPLEDRM = yes;
VIRT_DRIVERS = yes;
VMGENID = yes;
VIRTIO = yes;
VIRTIO_PCI = yes;
VIRTIO_PCI_LEGACY = no;
VIRTIO_BALLOON = yes;
VIRTIO_INPUT = yes;
VIRTIO_IOMMU = yes;
EXT4_FS = yes;
EXT4_USE_FOR_EXT2 = yes;
EXT4_FS_POSIX_ACL = yes;
BTRFS_FS = yes;
BTRFS_FS_POSIX_ACL = yes;
VIRTIO_FS = yes;
CRYPTO_HW = yes;
CRYPTO_DEV_VIRTIO = yes;
}

2
wireless.nix
View file

@ -57,6 +57,8 @@
CRYPTO_AES_ARM64_CE = option yes;
CRYPTO_AES_ARM64_CE_BLK = option yes;
CRYPTO_SHA1_ARM64_CE = option yes;
CRYPTO_SHA256_ARM64 = option yes;
CRYPTO_SHA2_ARM64_CE = option yes;
CRYPTO_SHA512_ARM64 = option yes;
CRYPTO_SHA512_ARM64_CE = option yes;
}

50
x86-64/qemu-virtio.nix
View file

@ -1,49 +1,3 @@
{ lib, ... }:
{ lib, ... }@args:
with lib.kernel; {
NR_CPUS = freeform "8";
HYPERVISOR_GUEST = yes;
PARAVIRT = yes;
PARAVIRT_SPINLOCKS = yes;
KVM_GUEST = yes;
ARCH_CPUIDLE_HALTPOLL = yes;
PARAVIRT_CLOCK = yes;
HALTPOLL_CPUIDLE = yes;
FW_CFG_SYSFS = yes;
BLK_MQ_VIRTIO = yes;
VIRTIO_BLK = yes;
VIRTIO_NET = yes;
VIRTIO_CONSOLE = yes;
HW_RANDOM = yes;
HW_RANDOM_VIRTIO = yes;
I6300ESB_WDT = yes;
DRM = yes;
DRM_FBDEV_EMULATION = yes;
DRM_BOCHS = yes;
DRM_SIMPLEDRM = yes;
VIRT_DRIVERS = yes;
VMGENID = yes;
VIRTIO = yes;
VIRTIO_PCI = yes;
VIRTIO_BALLOON = yes;
VIRTIO_IOMMU = yes;
EXT4_FS = yes;
EXT4_USE_FOR_EXT2 = yes;
EXT4_FS_POSIX_ACL = yes;
BTRFS_FS = yes;
BTRFS_FS_POSIX_ACL = yes;
VIRTIO_FS = yes;
CRYPTO_HW = yes;
CRYPTO_DEV_VIRTIO = yes;
}
import ../qemu-virtio.nix args