Merge remote-tracking branch 'pcc/mitig'

CONFIG_RANDOMIZE_BASE enables KASLR. It doesn't increase the size of the
kernel image for OpenWrt One (technically it increases .text size by 256
bytes, but that was cancelled out by alignment padding). Set this to y on
arm64. The other architectures are not modified (arm doesn't support it,
and mips only supports it for some targets).

CONFIG_ARM64_PTR_AUTH is enabled by default by the kernel and enables
pointer authentication instructions at entry and exit of most kernel
functions. However, none of our targets support pointer authentication,
so these instructions are just taking up space for no purpose. Set this
one to n, which reduces OpenWrt One kernel image size by 24KB.

THOUGHTS.txt

@@ -8748,3 +8748,15 @@ time the file changes, which doesn't seem less complicated as it adds
 some kind of inotify to the thigs that can go wrong.
 
 fennel or rust?
+
+Wed Apr 29 11:52:58 BST 2026
+
+I left the slops code on my laptop, but we can fake it using nginx for
+testing purposes
+
+Need
+
+- a source of secrets accessible through bordervm, preferably at the
+same url as it would be in "prod"
+ 
+- for outsdie,          x

modules/arch/aarch64.nix

@@ -16,6 +16,9 @@
 
       OF = "y";
       # USE_OF = "y";
+
+      ARM64_PTR_AUTH = "n";
+      RANDOMIZE_BASE = "y";
     };
     hardware.ram.startAddress = lim.parseInt "0x40000000";
     system.outputs.u-boot = pkgs.ubootQemuAarch64;

modules/kernel/default.nix

@@ -130,6 +130,9 @@ in
         # at boot time unless we disable trying to call it.
         # https://lkml.org/lkml/2013/8/5/175
         FW_LOADER_USER_HELPER = "n";
+
+        # SPI NAND access may be slow without this.
+        HIGH_RES_TIMERS = "y";
       };
     };
   };