proj/linux-patches:7.2 commit in: /

commit:     b17989b2c6d448bb50947cc3a9d6599bcc2aa5dc
Author:     Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Mon Aug 17 10:01:33 2026 +0000
Commit:     Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Mon Aug 17 10:03:33 2026 +0000
URL:        https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=b17989b2

Remove KSPP patch

Bug: https://bugs.gentoo.org/980806

Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>

 4567_distro-Gentoo-Kconfig.patch | 157 ++-------------------------------------
 1 file changed, 5 insertions(+), 152 deletions(-)

diff --git a/4567_distro-Gentoo-Kconfig.patch b/4567_distro-Gentoo-Kconfig.patch
index 043209a0..1de4b368 100644
--- a/4567_distro-Gentoo-Kconfig.patch
+++ b/4567_distro-Gentoo-Kconfig.patch
@@ -1,14 +1,14 @@
---- a/Kconfig	2026-08-04 07:16:59.780069213 -0400
-+++ b/Kconfig	2026-08-04 07:19:56.603468453 -0400
+--- a/Kconfig	2026-08-17 05:58:47.375215628 -0400
++++ b/Kconfig	2026-08-17 05:59:03.445560373 -0400
 @@ -32,3 +32,5 @@ source "lib/Kconfig.debug"
  source "Documentation/Kconfig"
  
  source "io_uring/Kconfig"
 +
 +source "distro/Kconfig"
---- /dev/null	2026-08-04 06:37:40.761684417 -0400
-+++ b/distro/Kconfig	2026-08-04 08:02:22.140002199 -0400
-@@ -0,0 +1,306 @@
+--- /dev/null	2026-08-17 05:46:22.875476449 -0400
++++ b/distro/Kconfig	2026-08-17 05:55:32.779066767 -0400
+@@ -0,0 +1,170 @@
 +menu "Gentoo Linux"
 +
 +config GENTOO_LINUX
@@ -165,142 +165,6 @@
 +
 +endmenu
 +
-+menuconfig GENTOO_KERNEL_SELF_PROTECTION
-+	bool "Kernel Self Protection Project"
-+	depends on GENTOO_LINUX
-+	help
-+		Recommended Kernel settings based on the suggestions from the Kernel Self Protection Project
-+		See: https://kernsec.org/wiki/index.php/Kernel_Self_Protection_Project/Recommended_Settings
-+		Note, there may be additional settings for which the CONFIG_ setting is invisible in menuconfig due 
-+		to unmet dependencies. Search for GENTOO_KERNEL_SELF_PROTECTION_COMMON and search for 
-+		GENTOO_KERNEL_SELF_PROTECTION_{X86_64, ARM64, X86_32, ARM} for dependency information on your 
-+		specific architecture.
-+		Note 2: Please see the URL above for numeric settings, e.g. CONFIG_DEFAULT_MMAP_MIN_ADDR=65536
-+		for X86_64
-+
-+if GENTOO_KERNEL_SELF_PROTECTION
-+config GENTOO_KERNEL_SELF_PROTECTION_COMMON
-+	bool "Enable Kernel Self Protection Project Recommendations"
-+
-+	depends on GENTOO_LINUX && !SLAB_MERGE_DEFAULT && !SLUB_TINY && !COMPAT_BRK && !PROC_KCORE && !COMPAT_VDSO && !KEXEC && !HIBERNATION && !LEGACY_PTYS && !X86_X32_ABI && !MODIFY_LDT_SYSCALL && GCC_PLUGINS && SECURITY
-+
-+	select BUG
-+	select STRICT_KERNEL_RWX
-+	select DEBUG_VIRTUAL
-+	select DEBUG_WX
-+	select STACKPROTECTOR
-+	select STACKPROTECTOR_STRONG
-+	select STRICT_DEVMEM if DEVMEM=y
-+	select IO_STRICT_DEVMEM if DEVMEM=y
-+	select SYN_COOKIES
-+	select DEBUG_CREDENTIALS
-+	select DEBUG_NOTIFIERS
-+	select DEBUG_LIST
-+	select DEBUG_SG
-+	select HARDENED_USERCOPY
-+	select KFENCE if HAVE_ARCH_KFENCE && (!SLAB || SLUB)
-+	select PAGE_TABLE_CHECK if ARCH_SUPPORTS_PAGE_TABLE_CHECK=y && EXCLUSIVE_SYSTEM_RAM=y  
-+	select PAGE_TABLE_CHECK_ENFORCED if PAGE_TABLE_CHECK=y
-+	select RANDOMIZE_KSTACK_OFFSET_DEFAULT if HAVE_ARCH_RANDOMIZE_KSTACK_OFFSET && (INIT_STACK_NONE || !CC_IS_CLANG || CLANG_VERSION>=140000)
-+	select SECURITY_LANDLOCK
-+	select SCHED_CORE if SCHED_SMT
-+	select BUG_ON_DATA_CORRUPTION
-+	select RANDOM_KMALLOC_CACHES if SLUB_TINY=n
-+	select SCHED_STACK_END_CHECK
-+	select SECCOMP if HAVE_ARCH_SECCOMP
-+	select SECCOMP_FILTER if HAVE_ARCH_SECCOMP_FILTER
-+	select SECURITY_YAMA
-+	select SLAB_FREELIST_RANDOM
-+	select SLAB_FREELIST_HARDENED
-+	select SLAB_BUCKETS
-+	select SHUFFLE_PAGE_ALLOCATOR
-+	select SLUB_DEBUG
-+	select UBSAN
-+	select CC_HAS_UBSAN_BOUNDS_STRICT if !CC_HAS_UBSAN_ARRAY_BOUNDS
-+	select UBSAN_BOUNDS
-+	select UBSAN_SHIFT
-+	select PAGE_POISONING
-+	select PAGE_POISONING_NO_SANITY
-+	select PAGE_POISONING_ZERO
-+	select INIT_ON_ALLOC_DEFAULT_ON
-+	select INIT_ON_FREE_DEFAULT_ON
-+	select REFCOUNT_FULL
-+	select FORTIFY_SOURCE
-+	select SECURITY_DMESG_RESTRICT
-+	select PANIC_ON_OOPS
-+	select GCC_PLUGIN_LATENT_ENTROPY
-+	select GCC_PLUGIN_RANDSTRUCT
-+	select RANDSTRUCT_FULL
-+	select ZERO_CALL_USED_REGS if CC_HAS_ZERO_CALL_USED_REGS
-+
-+	help
-+		Search for GENTOO_KERNEL_SELF_PROTECTION_{X86_64, ARM64, X86_32, ARM} for dependency 
-+		information on your specific architecture.  Note 2: Please see the URL above for 
-+		numeric settings, e.g. CONFIG_DEFAULT_MMAP_MIN_ADDR=65536 for X86_64
-+
-+config GENTOO_KERNEL_SELF_PROTECTION_X86_64
-+	bool "X86_64 KSPP Settings" if GENTOO_KERNEL_SELF_PROTECTION_COMMON
-+
-+	depends on !X86_MSR && IOMMU_DEFAULT_DMA_STRICT && X86_64 && GENTOO_KERNEL_SELF_PROTECTION
-+	default n
-+	
-+	select KSTACK_ERASE if HAVE_ARCH_KSTACK_ERASE
-+	select X86_KERNEL_IBT if CC_HAS_IBT=y && HAVE_OBJTOOL=y && (!LD_IS_LLD=n || LLD_VERSION>=140000) 
-+	select LEGACY_VSYSCALL_NONE
-+ 	select PAGE_TABLE_ISOLATION
-+	select RANDOMIZE_BASE
-+	select RANDOMIZE_MEMORY
-+	select RELOCATABLE
-+	select X86_USER_SHADOW_STACK if AS_WRUSS=y
-+	select VMAP_STACK
-+
-+
-+config GENTOO_KERNEL_SELF_PROTECTION_ARM64
-+	bool "ARM64 KSPP Settings"
-+
-+	depends on IOMMU_DEFAULT_DMA_STRICT && ARM64
-+	default n
-+
-+	select ARM64_BTI
-+	select ARM64_E0PD
-+	select ARM64_EPAN if ARM64_PAN=y
-+	select ARM64_MTE if (ARM64_AS_HAS_MTE=y && ARM64_TAGGED_ADDR_ABI=y ) && ( AS_HAS_ARMV8_5=y ) && ( AS_HAS_LSE_ATOMICS=y )
-+	select ARM64_PTR_AUTH
-+	select ARM64_PTR_AUTH_KERNEL if ( ARM64_PTR_AUTH=y ) && (( CC_HAS_SIGN_RETURN_ADDRESS=y || CC_HAS_BRANCH_PROT_PAC_RET=y ) && AS_HAS_ARMV8_3=y ) && ( LD_IS_LLD=y || LD_VERSION >= 23301 || ( CC_IS_GCC=y && GCC_VERSION < 90100 )) && (CC_IS_CLANG=n || AS_HAS_CFI_NEGATE_RA_STATE=y ) && ((FUNCTION_GRAPH_TRACER=n || DYNAMIC_FTRACE_WITH_ARGS=y ))
-+	select ARM64_BTI_KERNEL if ( ARM64_BTI=y ) && ( ARM64_PTR_AUTH_KERNEL=y ) && ( CC_HAS_BRANCH_PROT_PAC_RET_BTI=y ) && (CC_IS_GCC=n || GCC_VERSION >= 100100 ) && (CC_IS_GCC=n ) && ((FUNCTION_GRAPH_TRACE=n || DYNAMIC_FTRACE_WITH_ARG=y ))
-+	select ARM64_SW_TTBR0_PAN
-+	select CONFIG_UNMAP_KERNEL_AT_EL0
-+	select KSTACK_ERASE if HAVE_ARCH_KSTACK_ERASE
-+	select KASAN_HW_TAGS if HAVE_ARCH_KASAN_HW_TAGS=y
-+	select RANDOMIZE_BASE
-+	select RELOCATABLE
-+	select SHADOW_CALL_STACK if ARCH_SUPPORTS_SHADOW_CALL_STACK=y && (DYNAMIC_FTRACE_WITH_ARGS=y || DYNAMIC_FTRACE_WITH_REGS=y || FUNCTION_GRAPH_TRACER=n) && MMU=y 
-+	select UNWIND_PATCH_PAC_INTO_SCS if (CC_IS_CLANG=y && CLANG_VERSION >= CONFIG_150000 ) && ( ARM64_PTR_AUTH_KERNEL=y && CC_HAS_BRANCH_PROT_PAC_RET=y ) && ( SHADOW_CALL_STACK=y )
-+	select VMAP_STACK
-+
-+config GENTOO_KERNEL_SELF_PROTECTION_X86_32
-+	bool "X86_32 KSPP Settings"
-+
-+	depends on X86_32 && !X86_MSR && !MODIFY_LDT_SYSCALL && !M486 && IOMMU_DEFAULT_DMA_STRICT && X86_PAE
-+	default n
-+
-+	select HIGHMEM64G
-+	select RANDOMIZE_BASE
-+	select RELOCATABLE
-+	select PAGE_TABLE_ISOLATION
-+
-+config GENTOO_KERNEL_SELF_PROTECTION_ARM
-+	bool "ARM KSPP Settings"
-+
-+	depends on !OABI_COMPAT && IOMMU_DEFAULT_DMA_STRICT && ARM
-+	default n
-+
-+	select VMSPLIT_3G
-+	select STRICT_MEMORY_RWX
-+	select CPU_SW_DOMAIN_PAN
-+
-+endif
-+
 +config GENTOO_PRINT_FIRMWARE_INFO
 +	bool "Print firmware information that the kernel attempts to load"
 +
@@ -315,14 +179,3 @@
 +		See the settings that become available for more details and fine-tuning.
 +
 +endmenu
---- a/mm/Kconfig	2026-08-04 07:18:31.058970855 -0400
-+++ b/mm/Kconfig	2026-08-04 07:53:08.052753718 -0400
-@@ -702,6 +702,8 @@ config KSM
- config DEFAULT_MMAP_MIN_ADDR
- 	int "Low address space to protect from user allocation"
- 	depends on MMU
-+	default 65536 if ( X86_64 || X86_32 || PPC64 || IA64 ) && GENTOO_KERNEL_SELF_PROTECTION
-+	default 32768 if ( ARM64 || ARM ) && GENTOO_KERNEL_SELF_PROTECTION
- 	default 4096
- 	help
- 	  This is the portion of low virtual memory which should be protected