16 qpr2 muzel#11

Open

maade93791 wants to merge 83 commits intoGrapheneOS:16-qpr2from

snowstamp:16-qpr2-muzel

Commits on Dec 15, 2025

update from kernel-muzel-14356307
maade93791
committed
add toggle for disabling newly added USB devices

thestinger
authored and
maade93791
committed
add back Android paranoid check for socket creation

thestinger
authored and
maade93791
committed
bug on kmem_cache_free with the wrong cache

randomhydrosol
authored and
maade93791
committed
mm: add support for verifying page sanitization

thestinger
authored and
maade93791
committed
arm64: determine stack entropy based on mmap entropy

thestinger
authored and
maade93791
committed
randomize lower bits of the argument block

thestinger
authored and
maade93791
committed
support randomizing the lower bits of brk

thestinger
authored and
maade93791
committed
mm: randomize lower bits of brk

thestinger
authored and
maade93791
committed
mm: guarantee brk gap is at least one page

thestinger
authored and
maade93791
committed
use max mmap entropy by default to cover init

flawedworld
authored and
maade93791
committed
add __read_only for non-init related usage

thestinger
authored and
maade93791
committed
make sysctl constants read-only

thestinger
authored and
maade93791
committed
mark slub runtime configuration as __ro_after_init

thestinger
authored and
maade93791
committed
add __ro_after_init to slab_nomerge and slab_state

thestinger
authored and
maade93791
committed
mark kmem_cache as __ro_after_init

thestinger
authored and
maade93791
committed
mark softirq_vec as __ro_after_init

thestinger
authored and
maade93791
committed
enable CONFIG_INIT_ON_FREE_DEFAULT_ON

flawedworld
authored and
maade93791
committed
Makefile: set -fvisibility=hidden for full LTO

randomhydrosol
authored and
maade93791
committed
arm64: enable 48-bit address space

flawedworld
authored and
maade93791
committed
arm64: raise default mmap bits for 48-bit address space

flawedworld
authored and
maade93791
committed
add FLAG_COMPAT_VA_39_BIT to execveat()

muhomorr
authored and
maade93791
committed
enable CONFIG_SYN_COOKIES

flawedworld
authored and
maade93791
committed
switch to sha256 for module signing

thestinger
authored and
maade93791
committed
improve sign-file support for BoringSSL

thestinger
authored and
maade93791
committed
switch to forced module signing

thestinger
authored and
maade93791
committed
enable lockdown LSM in confidentiality mode

thestinger
authored and
maade93791
committed
disable LDISC_AUTOLOAD

thestinger
authored and
maade93791
committed
enable DEBUG_SG

thestinger
authored and
maade93791
committed
disable BINFMT_MISC

thestinger
authored and
maade93791
committed
slub: add multi-purpose random canaries

thestinger
authored and
maade93791
committed
enable BPF JIT hardening by default

thestinger
authored and
maade93791
committed
x86_64: raise DEFAULT_MMAP_MIN_ADDR

thestinger
authored and
maade93791
committed
mm: kfence: respect BUG_ON_DATA_CORRUPTION

thestinger
authored and
maade93791
committed
enable RANDOMIZE_KSTACK_OFFSET_DEFAULT

thestinger
authored and
maade93791
committed
bugfix: clear 39-bit VA flag after exec

muhomorr
authored and
maade93791
committed
disable unnecessary sysrq functionality

thestinger
authored and
maade93791
committed
temporarily ignore sysrq_always_enabled

thestinger
authored and
maade93791
committed
enable reset attack mitigation for UEFI

thestinger
authored and
maade93791
committed
arm64: temporarily disable forced module signing

thestinger
authored and
maade93791
committed
disable UNWIND_PATCH_PAC_INTO_SCS

thestinger
authored and
maade93791
committed
enable ARM64_BTI_KERNEL

thestinger
authored and
maade93791
committed
ANDROID: usb: typec: tcpm: Bring back tcpm_update_sink_capabilities

Badhri Jagan Sridharan
authored and
maade93791
committed
usb: typec: tcpm: add option to ignore alt modes

muhomorr
authored and
maade93791
committed
ANDROID: tools/resolve_btfids: Pass CFLAGS to libsubcmd build via EXTRA_CFLAGS

nathanchance
authored and
maade93791
committed
selinux: add security_sid_to_context_type() function

muhomorr
authored and
maade93791
committed
selinux: cache zygote context types when loading policy

muhomorr
authored and
maade93791
committed
selinux: allow zygote to set flags in task_security_struct

muhomorr
authored and
maade93791
committed
selinux: add function for auditing tsec_flags-related denials

muhomorr
authored and
maade93791
committed
selinux: support restricting dynamic code execution via tsec_flags

muhomorr
authored and
maade93791
committed
selinux: support blocking ptrace access via tsec_flags

muhomorr
authored and
maade93791
committed
x86_64: enable forced module signing
maade93791
committed
add build script for virtual-device with support for module signing
maade93791
committed
extend deny_new_usb to USB gadgets

muhomorr
authored and
maade93791
committed
add update_virt_prebuilts.sh
maade93791
committed
disable CONFIG_HIBERNATION

thestinger
authored and
maade93791
committed
enable CONFIG_RANDSTRUCT_FULL

thestinger
authored and
maade93791
committed
use deterministic RANDSTRUCT seed based on timestamp

thestinger
authored and
maade93791
committed
enable CONFIG_RANDOM_KMALLOC_CACHES

thestinger
authored and
maade93791
committed
add random_kmalloc_seed to GKI symbol list

thestinger
authored and
maade93791
committed
enable CONFIG_EFI_DISABLE_PCI_DMA

thestinger
authored and
maade93791
committed
add CONFIG_MICRODROID entry and enable it for microdroid_defconfig
maade93791
committed
selinux: don't cancel loading sepolicy because of missing context_types in microdroid sepolicy
maade93791
committed
microdroid: enable CONFIG_FORTIFY_SOURCE

thestinger
authored and
maade93791
committed
microdroid: disable IO_URING for x86 too

thestinger
authored and
maade93791
committed
microdroid: disable CONFIG_RSEQ

thestinger
authored and
maade93791
committed
microdroid: match gki KFENCE configuration

thestinger
authored and
maade93791
committed
android: disable unused CONFIG_LEGACY_TIOCSTI

thestinger
authored and
maade93791
committed
android: disable unused cachestat syscall

thestinger
authored and
maade93791
committed
disable unused TIPC

thestinger
authored and
maade93791
committed
zero memory in early boot

thestinger
authored and
maade93791
committed
fixup! add update_virt_prebuilts.sh

quh4gko8
authored and
maade93791
committed
tmp: Skip system_dlkm_staging copying on update_virt_prebuilts.sh

quh4gko8
authored and
maade93791
committed
update_virt_prebuilts: don't copy unnecessary kernel modules
maade93791
committed
disable memory hotplug support

thestinger
authored and
maade93791
committed
Revert "FROMGIT: arm64: mm: account for hotplug memory when randomizing the linear region"

thestinger
authored and
maade93791
committed
move tipc modules to x86_64 GKI modules list

thestinger
authored and
maade93791
committed
android: ABI update
maade93791
committed
Revert "x86_64: enable forced module signing"

muhomorr
authored and
maade93791
committed
Revert "arm64: temporarily disable forced module signing"

muhomorr
authored and
maade93791
committed
Revert "enable lockdown LSM in confidentiality mode"

muhomorr
authored and
maade93791
committed
Revert "switch to forced module signing"

muhomorr
authored and
maade93791
committed
Revert "switch to sha256 for module signing"

muhomorr
authored and
maade93791
committed