main/linux-hardened: upgrade to 4.9.68 and enable EFI for virthardened

3 files changed, 44 insertions, 12 deletions

diff --git a/main/linux-hardened/APKBUILD b/main/linux-hardened/APKBUILD
index b828e63c7d..b74e3e57aa 100644
--- a/main/linux-hardened/APKBUILD
+++ b/main/linux-hardened/APKBUILD
@@ -2,12 +2,12 @@
 
 _mainflavor=hardened
 pkgname=linux-$_mainflavor
-pkgver=4.9.65
+pkgver=4.9.68
 case $pkgver in
 *.*.*)	_kernver=${pkgver%.*};;
 *.*)	_kernver=${pkgver};;
 esac
-pkgrel=1
+pkgrel=0
 pkgdesc="Linux kernel with hardening patches"
 url="http://alpinelinux.org"
 depends="mkinitfs"
@@ -204,12 +204,12 @@ _dev() {
 }
 
 sha512sums="bf67ff812cc3cb7e5059e82cc5db0d9a7c5637f7ed9a42e4730c715bf7047c81ed3a571225f92a33ef0b6d65f35595bc32d773356646df2627da55e9bc7f1f1a  linux-4.9.tar.xz
-f22ec263901248adb0b660e5ea6f9c550f28f53dcd27d4a5148a932bce3b92f91cd921ff1d62096ac78c235e7abbeafa7ae33fc4f042e7d876e1fd58945554ce  patch-4.9.65.xz
-1951336d07dbbbbd90c1ca0f2568045eb4f8bba24d37fa0b8a1f1f36332b43ba4dbd5a60b3d2cb9073098c8ce291e06a049a5156af20cf29d80df645e0ff15f9  hardened-3.1-4.9.65-201704252333-alpine2.patch
+2eb4479a89dd59a3b441c65f235777e69e06e24c91e8269ab77e4b628283cbc954376d685ce9a9b7fa408132e183a2581a3867e32d8c38666ec66b6d6b8bcd79  patch-4.9.68.xz
+2090187aea18f5e18367a8415bb2e9a40e76614bab368dfb5a18ba3b62d3b1f49d6c2aeab83636236a61efb37db69b254c470e8601dee36a0ff8acd389db71ef  hardened-3.1-4.9.68-201704252333-alpine2.patch
 5373728be2b507c3db5e042e1d768740df7965078868afdc46418b1adc4cae3d8f9f1aedb59975a0f2acf8754340499354fcf97c503397a5d9886ccc9689b782  0001-HID-apple-fix-Fn-key-Magic-Keyboard-on-bluetooth.patch
 5a0a78e6de11eb8180d96830b9faa9ac560586f7beb663c8196a16ac6232b5008b9181b3c9b94e2b13a444acba4b6e80a3408d34606432f92eb4d169c3953d5d  zfs-fix.patch
 72ebda2e8f54047ff1884bcde9f2a0b02bbe5d2b210eff484b165963c53f22413d3513c36e00bc6114e9ee34bb1e3f289cdf82215a3685f2301f0e4deef62829  config-hardened.x86
 8310cca535b7c80806ca30f2f43a46222ceb1f65a3570d06e8e3a64bd1917ec881faf6dc2c94910dcfd8ba0a61f82db36f5fe94f5b1b86e08bb36ff89e7986b9  config-hardened.x86_64
 5f7c5f7f0f040c1d6e4bf9bba0febe1c3a874b9d1fa5285ab487940aa02b3909b28bae4939329e151373a58ea5deb2575439632c05e47ce817c37668a5b9eb58  config-hardened.armhf
-04ace078cb37b2a352cdf42f560ce0d21e94658fecdc0a46cc506560d7149666698c1f16eea8bc2495b44042d4562b59c83dfd04f55f230283c07b45365df281  config-virthardened.x86
-7693c05afe4fea17d8b31ea20954f31a47b3062b9de7c7d9270dd430443cadf5e7a7b2bf7f69274a9db2312346374f72151dcf4f44aeb2fcd4d69bbd0db0bfc2  config-virthardened.x86_64"
+f455bb8a70b8e7b77779843f4007fd3de6a1649d85a1e62f04f94e11705c5204716641cf8f19aff6b3873af22fe355f9e1f3539fbc4b7ead81bd8cd0ab96bb30  config-virthardened.x86
+290a17d7956202ad4018102568f8aa5d79e34927cd8cce946d391a3ed6591bcd499c8978a5b2fc941a9cb4b68e7cd3e347c3a8b5f39ad1e964537d8aa6d17328  config-virthardened.x86_64"
diff --git a/main/linux-hardened/config-virthardened.x86 b/main/linux-hardened/config-virthardened.x86
index 2bac836db5..01fafe2139 100644
--- a/main/linux-hardened/config-virthardened.x86
+++ b/main/linux-hardened/config-virthardened.x86
@@ -1,6 +1,6 @@
 #
 # Automatically generated file; DO NOT EDIT.
-# Linux/x86 4.9.63 Kernel Configuration
+# Linux/x86 4.9.68 Kernel Configuration
 #
 # CONFIG_64BIT is not set
 CONFIG_X86_32=y
@@ -525,7 +525,7 @@ CONFIG_HZ=100
 CONFIG_SCHED_HRTICK=y
 # CONFIG_CRASH_DUMP is not set
 CONFIG_PHYSICAL_START=0x1000000
-# CONFIG_RELOCATABLE is not set
+CONFIG_RELOCATABLE=y
 CONFIG_PHYSICAL_ALIGN=0x1000000
 CONFIG_HOTPLUG_CPU=y
 # CONFIG_BOOTPARAM_HOTPLUG_CPU0 is not set
@@ -580,6 +580,7 @@ CONFIG_ACPI_CONTAINER=y
 CONFIG_ACPI_HOTPLUG_IOAPIC=y
 CONFIG_ACPI_SBS=m
 CONFIG_ACPI_HED=m
+CONFIG_ACPI_BGRT=y
 # CONFIG_ACPI_REDUCED_HARDWARE_ONLY is not set
 # CONFIG_ACPI_NFIT is not set
 CONFIG_HAVE_ACPI_APEI=y
@@ -3110,6 +3111,16 @@ CONFIG_DMI_SCAN_MACHINE_NON_EFI_FALLBACK=y
 CONFIG_FW_CFG_SYSFS=m
 # CONFIG_FW_CFG_SYSFS_CMDLINE is not set
 # CONFIG_GOOGLE_FIRMWARE is not set
+
+#
+# EFI (Extensible Firmware Interface) Support
+#
+# CONFIG_EFI_VARS is not set
+CONFIG_EFI_ESRT=y
+# CONFIG_EFI_FAKE_MEMMAP is not set
+CONFIG_EFI_RUNTIME_WRAPPERS=y
+# CONFIG_EFI_CAPSULE_LOADER is not set
+# CONFIG_EFI_TEST is not set
 CONFIG_UEFI_CPER=y
 
 #
@@ -3242,6 +3253,7 @@ CONFIG_TMPFS_XATTR=y
 # CONFIG_HUGETLBFS is not set
 # CONFIG_HUGETLB_PAGE is not set
 CONFIG_CONFIGFS_FS=m
+CONFIG_EFIVAR_FS=m
 CONFIG_MISC_FILESYSTEMS=y
 CONFIG_ORANGEFS_FS=m
 # CONFIG_ADFS_FS is not set
@@ -3555,6 +3567,7 @@ CONFIG_IO_STRICT_DEVMEM=y
 # CONFIG_X86_VERBOSE_BOOTUP is not set
 # CONFIG_EARLY_PRINTK is not set
 # CONFIG_X86_PTDUMP_CORE is not set
+# CONFIG_EFI_PGT_DUMP is not set
 CONFIG_DEBUG_RODATA_TEST=y
 CONFIG_DEBUG_NX_TEST=m
 CONFIG_DOUBLEFAULT=y
@@ -3751,6 +3764,7 @@ CONFIG_GRKERNSEC_SYSCTL_ON=y
 CONFIG_GRKERNSEC_FLOODTIME=10
 CONFIG_GRKERNSEC_FLOODBURST=4
 CONFIG_KEYS=y
+CONFIG_KEYS_COMPAT=y
 # CONFIG_PERSISTENT_KEYRINGS is not set
 # CONFIG_BIG_KEYS is not set
 CONFIG_ENCRYPTED_KEYS=m
@@ -4033,6 +4047,7 @@ CONFIG_DDR=y
 CONFIG_IRQ_POLL=y
 CONFIG_MPILIB=y
 CONFIG_OID_REGISTRY=m
+CONFIG_UCS2_STRING=y
 CONFIG_FONT_SUPPORT=m
 # CONFIG_FONTS is not set
 CONFIG_FONT_8x8=y
diff --git a/main/linux-hardened/config-virthardened.x86_64 b/main/linux-hardened/config-virthardened.x86_64
index a6446bcd71..f7b32d376e 100644
--- a/main/linux-hardened/config-virthardened.x86_64
+++ b/main/linux-hardened/config-virthardened.x86_64
@@ -1,6 +1,6 @@
 #
 # Automatically generated file; DO NOT EDIT.
-# Linux/x86 4.9.63 Kernel Configuration
+# Linux/x86 4.9.68 Kernel Configuration
 #
 CONFIG_64BIT=y
 CONFIG_X86_64=y
@@ -526,7 +526,9 @@ CONFIG_ARCH_RANDOM=y
 # CONFIG_X86_SMAP is not set
 # CONFIG_X86_INTEL_MPX is not set
 # CONFIG_X86_INTEL_MEMORY_PROTECTION_KEYS is not set
-# CONFIG_EFI is not set
+CONFIG_EFI=y
+CONFIG_EFI_STUB=y
+# CONFIG_EFI_MIXED is not set
 CONFIG_SECCOMP=y
 CONFIG_HZ_100=y
 # CONFIG_HZ_250 is not set
@@ -537,7 +539,7 @@ CONFIG_SCHED_HRTICK=y
 # CONFIG_KEXEC_FILE is not set
 # CONFIG_CRASH_DUMP is not set
 CONFIG_PHYSICAL_START=0x1000000
-# CONFIG_RELOCATABLE is not set
+CONFIG_RELOCATABLE=y
 CONFIG_PHYSICAL_ALIGN=0x1000000
 CONFIG_HOTPLUG_CPU=y
 # CONFIG_BOOTPARAM_HOTPLUG_CPU0 is not set
@@ -597,6 +599,7 @@ CONFIG_ACPI_HOTPLUG_MEMORY=y
 CONFIG_ACPI_HOTPLUG_IOAPIC=y
 CONFIG_ACPI_SBS=m
 CONFIG_ACPI_HED=m
+CONFIG_ACPI_BGRT=y
 # CONFIG_ACPI_REDUCED_HARDWARE_ONLY is not set
 # CONFIG_ACPI_NFIT is not set
 CONFIG_HAVE_ACPI_APEI=y
@@ -697,7 +700,6 @@ CONFIG_IA32_EMULATION=y
 CONFIG_COMPAT=y
 CONFIG_COMPAT_FOR_U64_ALIGNMENT=y
 CONFIG_SYSVIPC_COMPAT=y
-CONFIG_KEYS_COMPAT=y
 CONFIG_X86_DEV_DMA_OPS=y
 CONFIG_PMC_ATOM=y
 CONFIG_NET=y
@@ -3072,6 +3074,7 @@ CONFIG_XEN_PCIDEV_BACKEND=m
 CONFIG_XEN_SCSI_BACKEND=m
 CONFIG_XEN_PRIVCMD=y
 CONFIG_XEN_HAVE_PVMMU=y
+CONFIG_XEN_EFI=y
 CONFIG_XEN_AUTO_XLATE=y
 CONFIG_XEN_ACPI=y
 # CONFIG_XEN_SYMS is not set
@@ -3184,6 +3187,16 @@ CONFIG_DMI_SCAN_MACHINE_NON_EFI_FALLBACK=y
 CONFIG_FW_CFG_SYSFS=m
 # CONFIG_FW_CFG_SYSFS_CMDLINE is not set
 # CONFIG_GOOGLE_FIRMWARE is not set
+
+#
+# EFI (Extensible Firmware Interface) Support
+#
+# CONFIG_EFI_VARS is not set
+CONFIG_EFI_ESRT=y
+# CONFIG_EFI_FAKE_MEMMAP is not set
+CONFIG_EFI_RUNTIME_WRAPPERS=y
+# CONFIG_EFI_CAPSULE_LOADER is not set
+# CONFIG_EFI_TEST is not set
 CONFIG_UEFI_CPER=y
 
 #
@@ -3318,6 +3331,7 @@ CONFIG_HUGETLBFS=y
 CONFIG_HUGETLB_PAGE=y
 CONFIG_ARCH_HAS_GIGANTIC_PAGE=y
 CONFIG_CONFIGFS_FS=m
+CONFIG_EFIVAR_FS=m
 CONFIG_MISC_FILESYSTEMS=y
 # CONFIG_ORANGEFS_FS is not set
 # CONFIG_ADFS_FS is not set
@@ -3635,6 +3649,7 @@ CONFIG_IO_STRICT_DEVMEM=y
 # CONFIG_X86_VERBOSE_BOOTUP is not set
 # CONFIG_EARLY_PRINTK is not set
 # CONFIG_X86_PTDUMP_CORE is not set
+# CONFIG_EFI_PGT_DUMP is not set
 CONFIG_DEBUG_RODATA_TEST=y
 CONFIG_DEBUG_NX_TEST=m
 CONFIG_DOUBLEFAULT=y
@@ -3833,6 +3848,7 @@ CONFIG_GRKERNSEC_SYSCTL_ON=y
 CONFIG_GRKERNSEC_FLOODTIME=10
 CONFIG_GRKERNSEC_FLOODBURST=4
 CONFIG_KEYS=y
+CONFIG_KEYS_COMPAT=y
 # CONFIG_PERSISTENT_KEYRINGS is not set
 # CONFIG_BIG_KEYS is not set
 CONFIG_ENCRYPTED_KEYS=m
@@ -4136,6 +4152,7 @@ CONFIG_DDR=y
 CONFIG_IRQ_POLL=y
 CONFIG_MPILIB=y
 CONFIG_OID_REGISTRY=m
+CONFIG_UCS2_STRING=y
 CONFIG_FONT_SUPPORT=m
 # CONFIG_FONTS is not set
 CONFIG_FONT_8x8=y