From a1cf92e3ee3135824e181ec355a6530c1d0276bb Mon Sep 17 00:00:00 2001 From: Sayan Chowdhury Date: Tue, 5 May 2026 17:01:07 +0530 Subject: [PATCH 1/4] sys-kernel/coreos-kernel: Version bump to 6.18.26 Signed-off-by: Sayan Chowdhury --- .../coreos-kernel-6.18.26.ebuild | 167 ++++++++++++++++++ 1 file changed, 167 insertions(+) create mode 100644 sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-kernel/coreos-kernel-6.18.26.ebuild diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-kernel/coreos-kernel-6.18.26.ebuild b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-kernel/coreos-kernel-6.18.26.ebuild new file mode 100644 index 00000000000..bb07dbb104a --- /dev/null +++ b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-kernel/coreos-kernel-6.18.26.ebuild @@ -0,0 +1,167 @@ +# Copyright 2026 The Flatcar Container Linux Maintainers +# Distributed under the terms of the GNU General Public License v2 + +EAPI=8 +COREOS_SOURCE_REVISION="" +inherit coreos-kernel toolchain-funcs + +DESCRIPTION="CoreOS Linux kernel" +KEYWORDS="amd64 arm64" +RESTRICT="userpriv" # dracut (via bootengine) needs root + +RDEPEND=" + =sys-kernel/coreos-modules-${PVR} + sys-apps/kbd +" +BDEPEND=" + sys-kernel/dracut +" +DEPEND=" + ${RDEPEND} + ${BDEPEND} + app-alternatives/awk + app-alternatives/gzip + app-arch/xz-utils + app-arch/zstd + app-crypt/clevis + app-shells/bash + coreos-base/afterburn + coreos-base/coreos-init:= + net-misc/iputils + sys-apps/azure-vm-utils[dracut] + sys-apps/baselayout + sys-apps/busybox + sys-apps/coreutils + sys-apps/findutils + sys-apps/grep + sys-apps/hwdata + sys-apps/ignition:= + sys-apps/iproute2 + sys-apps/kexec-tools + sys-apps/less + sys-apps/nvme-cli + sys-apps/sed + sys-apps/shadow + sys-apps/systemd[cryptsetup] + sys-apps/seismograph + sys-apps/util-linux[cryptsetup,udev] + sys-block/open-iscsi + sys-fs/btrfs-progs + sys-fs/cryptsetup[udev] + sys-fs/e2fsprogs + sys-fs/lvm2[udev] + sys-fs/mdadm + sys-fs/xfsprogs + >=sys-kernel/bootengine-0.0.38-r37:= + >=sys-kernel/coreos-firmware-20180103-r1:= + sys-process/procps + virtual/udev + amd64? ( + app-admin/google-guest-configs + sys-firmware/intel-microcode:= + ) +" + +src_prepare() { + default + + # KV_OUT_DIR points to the minimal build tree installed by coreos-modules + # Pull in the config and public module signing key + cp -v "${KV_OUT_DIR}/.config" build/ || die + validate_sig_key + + config_update 'CONFIG_INITRAMFS_SOURCE="bootengine.cpio"' + + # include all intel and amd microcode files, avoiding the signatures + local fw_dir="${ESYSROOT}/lib/firmware" + use amd64 && config_update "CONFIG_EXTRA_FIRMWARE=\"$(find ${fw_dir} -type f \ + \( -path ${fw_dir}'/intel-ucode/*' -o -path ${fw_dir}'/amd-ucode/*' \) -printf '%P ')\"" + use amd64 && config_update "CONFIG_EXTRA_FIRMWARE_DIR=\"${fw_dir}\"" +} + +src_compile() { + local BE_ARGS=() + + if [[ -n ${SYSROOT} ]]; then + BE_ARGS+=( -r "${SYSROOT}" ) + export DRACUT_ARCH="${CHOST%%-*}" + + # We may need to run ldconfig via QEMU, so use the wrapper. Dracut calls + # it with -r, which chroots and confuses the sandbox, so calm it down. + export DRACUT_LDCONFIG="${CHOST}-ldconfig" + local f; for f in /etc/ld.so.cache{,~} /var/cache/ldconfig/aux-cache{,~}; do + addwrite "${f}" + done + fi + + tc-export PKG_CONFIG + "${ESYSROOT}"/usr/bin/update-bootengine -k "${KV_FULL}" -o "${S}"/build/bootengine.cpio "${BE_ARGS[@]}" || die + # Copy full initrd over to /usr as filesystem image + mkdir "${S}"/build/bootengine || die + pushd "${S}"/build/bootengine || die + lsinitrd --kver SILENCEERROR --unpack "${S}"/build/bootengine.cpio || die + mksquashfs . "${S}"/build/bootengine.img -noappend -xattrs-exclude ^btrfs. || die + popd || die + # No early cpio, drop full initrd + > "${S}"/build/bootengine.cpio + # Create minimal initrd + mkdir "${S}"/build/minimal || die + pushd "${S}"/build/minimal || die + mkdir -p {etc,dev,proc,sys,dev,usr/bin,usr/lib,usr/lib64,realinit,sysusr/usr} || die + ln -s usr/bin bin || die + ln -s usr/bin sbin || die + ln -s bin usr/sbin || die + ln -s usr/lib lib || die + ln -s usr/lib64 lib64 || die + # Instead from ESYSROOT we can also copy kernel modules from the dracut pre-selection + mkdir -p lib/modprobe.d/ || die + cp "${S}"/build/bootengine/lib/modprobe.d/* lib/modprobe.d/ || die + # Only include modules related to mounting /usr and for interacting with the emergency console + pushd "${S}/build/bootengine/usr/lib/modules/${KV_FULL}" || die + find kernel/drivers/{ata,block,hid,hv,input/serio,message/fusion,mmc,nvme,pci,scsi,usb} kernel/fs/{btrfs,overlayfs,squashfs} kernel/security/keys -name "*.ko.*" -printf "%f\0" | DRACUT_NO_XATTR=1 xargs --null "${BROOT}"/usr/lib/dracut/dracut-install --destrootdir "${S}"/build/minimal --kerneldir . --sysrootdir "${S}"/build/bootengine/ --firmwaredirs "${S}"/build/bootengine/usr/lib/firmware --module dm-verity dm-mod virtio_console || die + popd || die + # Double compression only makes the image bigger and slower + find . -name "*.ko.xz" -exec unxz {} + || die + depmod -a -b . "${KV_FULL}" || die + echo '$MODALIAS=.* 0:0 660 @/sbin/modprobe "$MODALIAS"' > ./etc/mdev.conf || die + # We can't use busybox's modprobe because it doesn't support the globs in module.alias, breaking module loading + DRACUT_NO_XATTR=1 "${BROOT}"/usr/lib/dracut/dracut-install --destrootdir . --sysrootdir "${ESYSROOT}" --ldd /bin/veritysetup /bin/dmsetup /bin/busybox /sbin/modprobe || die + cp -a "${ESYSROOT}"/usr/bin/minimal-init ./init || die + # Make it easier to debug by not relying too much on the first commands + ln -s busybox ./bin/sh || die + mknod ./dev/console c 5 1 || die + mknod ./dev/null c 1 3 || die + mknod ./dev/tty c 5 0 || die + mknod ./dev/urandom c 1 9 || die + mknod ./dev/random c 1 8 || die + mknod ./dev/zero c 1 5 || die + # No compression because CONFIG_INITRAMFS_COMPRESSION_XZ should take care of it + # (Note: The kernel build system does not support prepending an uncompressed microcode early cpio here) + find . -print0 | cpio --null --create --verbose --format=newc >> "${S}"/build/bootengine.cpio || die + popd || die + kmake "$(kernel_target)" + + # sanity check :) + [[ -e build/certs/signing_key.pem ]] && die "created a new key!" +} + +src_install() { + # coreos-postinst expects to find the kernel in /usr/boot + insinto "/usr/boot" + newins "$(kernel_path)" "vmlinuz-${KV_FULL}" + dosym "vmlinuz-${KV_FULL}" "/usr/boot/vmlinuz" + + insinto "/usr/lib/modules/${KV_FULL}/build" + doins build/System.map + + insinto "/usr/lib/debug/usr/boot" + newins build/vmlinux "vmlinux-${KV_FULL}" + dosym "../../../boot/vmlinux-${KV_FULL}" "/usr/lib/debug/usr/lib/modules/${KV_FULL}/vmlinux" + + # For easy access to vdso debug symbols in gdb: + # set debug-file-directory /usr/lib/debug/usr/lib/modules/${KV_FULL}/vdso/ + kmake INSTALL_MOD_PATH="${ED}/usr/lib/debug/usr" vdso_install + + insinto "/usr/lib/flatcar" + doins build/bootengine.img +} From a56b73c087b8e12eb4f426f2e3eaf131d3cfc395 Mon Sep 17 00:00:00 2001 From: Sayan Chowdhury Date: Tue, 5 May 2026 17:12:18 +0530 Subject: [PATCH 2/4] sys-kernel/coreos-modules: Version bump to 6.18.26 Signed-off-by: Sayan Chowdhury --- .../coreos-modules-6.18.26.ebuild | 63 + .../coreos-modules/files/amd64_defconfig-6.18 | 140 +++ .../coreos-modules/files/arm64_defconfig-6.18 | 109 ++ .../coreos-modules/files/commonconfig-6.18 | 1053 +++++++++++++++++ 4 files changed, 1365 insertions(+) create mode 100644 sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/coreos-modules-6.18.26.ebuild create mode 100644 sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/files/amd64_defconfig-6.18 create mode 100644 sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/files/arm64_defconfig-6.18 create mode 100644 sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/files/commonconfig-6.18 diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/coreos-modules-6.18.26.ebuild b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/coreos-modules-6.18.26.ebuild new file mode 100644 index 00000000000..11318123570 --- /dev/null +++ b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/coreos-modules-6.18.26.ebuild @@ -0,0 +1,63 @@ +# Copyright 2026 The Flatcar Container Linux Maintainers +# Distributed under the terms of the GNU General Public License v2 + +EAPI=7 +COREOS_SOURCE_REVISION="" +inherit coreos-kernel savedconfig + +DESCRIPTION="CoreOS Linux kernel modules" +KEYWORDS="amd64 arm64" +RDEPEND="!> build/.config || die + fi + cpio -ov build/bootengine.cpio + + # Check that an old pre-ebuild-split config didn't leak in. + grep -q "^CONFIG_INITRAMFS_SOURCE=" build/.config && \ + die "CONFIG_INITRAMFS_SOURCE must be removed from kernel config" + config_update 'CONFIG_INITRAMFS_SOURCE="bootengine.cpio"' +} + +src_compile() { + # Generate module signing key + setup_keys + + # Build both vmlinux and modules (moddep checks symbols in vmlinux) + kmake vmlinux modules +} + +src_install() { + local build="lib/modules/${KV_FULL}/build" + + # Install modules to /usr. + # Stripping must be done here, not portage, to preserve sigs. + kmake INSTALL_MOD_PATH="${ED}/usr" \ + INSTALL_MOD_STRIP="--strip-debug" \ + modules_install + + # Install to /usr/lib/debug with debug symbols intact + kmake INSTALL_MOD_PATH="${ED}/usr/lib/debug/usr" \ + modules_install + rm "${ED}/usr/lib/debug/usr/lib/modules/${KV_FULL}"/{build,modules.*} || die + + # Replace the broken /lib/modules/${KV_FULL}/build symlink with a copy of + # the files needed to build out-of-tree modules. + rm "${ED}/usr/${build}" || die + kmake run-command KBUILD_RUN_COMMAND="${KERNEL_DIR}/scripts/package/install-extmod-build ${ED}/usr/${build}" + + # Install the original config because the above doesn't. + insinto "/usr/${build}" + doins build/.config + + # Not strictly required but this is where we used to install the config. + dosym "../${build}/.config" "/usr/boot/config-${KV_FULL}" + dosym "../${build}/.config" "/usr/boot/config" +} diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/files/amd64_defconfig-6.18 b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/files/amd64_defconfig-6.18 new file mode 100644 index 00000000000..c682746ecaf --- /dev/null +++ b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/files/amd64_defconfig-6.18 @@ -0,0 +1,140 @@ +# CONFIG_ACPI_AC is not set +CONFIG_ACPI_APEI=y +CONFIG_ACPI_APEI_ERST_DEBUG=m +CONFIG_ACPI_APEI_GHES=y +CONFIG_ACPI_APEI_MEMORY_FAILURE=y +CONFIG_ACPI_APEI_PCIEAER=y +# CONFIG_ACPI_BATTERY is not set +CONFIG_ACPI_BUTTON=m +CONFIG_ACPI_FAN=m +CONFIG_ACPI_HOTPLUG_MEMORY=y +CONFIG_ACPI_IPMI=m +CONFIG_ACPI_PCI_SLOT=y +CONFIG_ACPI_PROCESSOR_AGGREGATOR=y +CONFIG_AMD_IOMMU=y +CONFIG_AQTION=m +CONFIG_ARCH_MEMORY_PROBE=y +CONFIG_AUTOFS_FS=y +CONFIG_BLK_DEV_IO_TRACE=y +CONFIG_BOOTPARAM_HARDLOCKUP_PANIC=y +CONFIG_CMDLINE_BOOL=y +CONFIG_CONNECTOR=y +CONFIG_CRASH_DUMP=y +CONFIG_CRYPTO_AES_NI_INTEL=m +CONFIG_DCDBAS=m +CONFIG_DEBUG_BOOT_PARAMS=y +CONFIG_DELL_RBU=m +CONFIG_DRM_I915=m +CONFIG_EDAC_AMD64=m +CONFIG_EDAC_DECODE_MCE=m +CONFIG_EDAC_E752X=m +CONFIG_EDAC_I3000=m +CONFIG_EDAC_I3200=m +CONFIG_EDAC_I5100=m +CONFIG_EDAC_I5400=m +CONFIG_EDAC_I7300=m +CONFIG_EDAC_I7CORE=m +CONFIG_EDAC_I82975X=m +CONFIG_EDAC_SBRIDGE=m +CONFIG_EDAC_X38=m +CONFIG_FB_VESA=y +CONFIG_FCOE_FNIC=m +CONFIG_FUNCTION_PROFILER=y +CONFIG_GART_IOMMU=y +CONFIG_GVE=m +CONFIG_HANGCHECK_TIMER=m +CONFIG_HARDLOCKUP_DETECTOR=y +CONFIG_HID=m +CONFIG_HOTPLUG_PCI_ACPI_IBM=m +CONFIG_HPET=y +CONFIG_HW_RANDOM_AMD=y +CONFIG_HW_RANDOM_INTEL=y +CONFIG_HW_RANDOM_VIA=y +CONFIG_HYPERVISOR_GUEST=y +CONFIG_IA32_EMULATION=y +CONFIG_IGC=m +CONFIG_INFINIBAND_USER_ACCESS=m +CONFIG_INFINIBAND_USNIC=m +CONFIG_INT340X_THERMAL=m +CONFIG_INTEL_IDLE=y +CONFIG_INTEL_IOATDMA=y +CONFIG_INTEL_IOMMU=y +CONFIG_INTEL_MEI_ME=m +CONFIG_INTEL_MEI_TXE=m +CONFIG_INTEL_RAPL=m +CONFIG_IP_VS_MH=m +CONFIG_IRQ_REMAP=y +CONFIG_ISCSI_IBFT=y +CONFIG_ISCSI_IBFT_FIND=y +CONFIG_ITCO_VENDOR_SUPPORT=y +CONFIG_ITCO_WDT=m +CONFIG_KERNEL_XZ=y +CONFIG_KEXEC_FILE=y +CONFIG_KPROBES_ON_FTRACE=y +CONFIG_KVM=m +CONFIG_KVM_AMD=m +CONFIG_KVM_INTEL=m +CONFIG_MEMORY_FAILURE=y +CONFIG_MEM_SOFT_DIRTY=y +CONFIG_MMC_SDHCI_ACPI=m +# CONFIG_MOUSE_PS2_LIFEBOOK is not set +CONFIG_MTRR_SANITIZER_ENABLE_DEFAULT=1 +CONFIG_NET_DROP_MONITOR=m +CONFIG_NVRAM=m +CONFIG_OPTPROBES=y +CONFIG_PARAVIRT_SPINLOCKS=y +CONFIG_PCI_MMCONFIG=y +CONFIG_PHYSICAL_ALIGN=0x1000000 +CONFIG_PMIC_OPREGION=y +# CONFIG_PNP_DEBUG_MESSAGES is not set +CONFIG_POWERCAP=y +CONFIG_PREEMPT_VOLUNTARY=y +CONFIG_PTP_1588_CLOCK_VMW=m +CONFIG_PVPANIC=y +CONFIG_PVPANIC_MMIO=m +CONFIG_SCHED_TRACER=y +CONFIG_SCSI_BUSLOGIC=m +CONFIG_SCSI_ISCI=m +CONFIG_SENSORS_CORETEMP=m +CONFIG_SENSORS_FAM15H_POWER=m +CONFIG_SENSORS_I5500=m +CONFIG_SENSORS_K10TEMP=m +CONFIG_SENSORS_K8TEMP=m +CONFIG_STACK_TRACER=y +CONFIG_TCG_INFINEON=m +CONFIG_TCG_NSC=m +CONFIG_UPROBE_EVENTS=y +CONFIG_USB_OHCI_HCD_SSB=y +CONFIG_VFIO_PCI_IGD=y +CONFIG_VFIO_PCI_VGA=y +CONFIG_VHOST_VSOCK=m +CONFIG_VMWARE_BALLOON=m +CONFIG_VMWARE_PVSCSI=m +CONFIG_VMWARE_VMCI=m +CONFIG_VMWARE_VMCI_VSOCKETS=m +CONFIG_VMXNET3=m +# CONFIG_X86_16BIT is not set +CONFIG_X86_ACPI_CPUFREQ=m +# CONFIG_X86_ACPI_CPUFREQ_CPB is not set +CONFIG_X86_AMD_FREQ_SENSITIVITY=m +CONFIG_X86_AMD_PSTATE=y +# CONFIG_X86_BOOTPARAM_MEMORY_CORRUPTION_CHECK is not set +CONFIG_X86_CHECK_BIOS_CORRUPTION=y +CONFIG_X86_CPUID=m +# CONFIG_X86_EXTENDED_PLATFORM is not set +CONFIG_X86_INTEL_LPSS=y +CONFIG_X86_INTEL_PSTATE=y +# CONFIG_X86_INTEL_TSX_MODE_OFF is not set +CONFIG_X86_INTEL_TSX_MODE_ON=y +# CONFIG_X86_MPPARSE is not set +CONFIG_X86_MSR=m +CONFIG_X86_PCC_CPUFREQ=m +CONFIG_X86_PLATFORM_DRIVERS_DELL=y +CONFIG_X86_REROUTE_FOR_BROKEN_BOOT_IRQS=y +CONFIG_X86_X2APIC=y +CONFIG_XDP_SOCKETS=y +CONFIG_XEN_BALLOON_MEMORY_HOTPLUG=y +CONFIG_XEN_DEBUG_FS=y +CONFIG_XEN_MCE_LOG=y +CONFIG_XEN_PCIDEV_FRONTEND=m +CONFIG_XEN_PVH=y diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/files/arm64_defconfig-6.18 b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/files/arm64_defconfig-6.18 new file mode 100644 index 00000000000..7d3462e787f --- /dev/null +++ b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/files/arm64_defconfig-6.18 @@ -0,0 +1,109 @@ +CONFIG_AHCI_CEVA=y +CONFIG_AHCI_XGENE=y +CONFIG_ARCH_BCM=y +CONFIG_ARCH_BCM2835=y +CONFIG_ARCH_BCM_IPROC=y +# CONFIG_ARCH_MEDIATEK is not set +# CONFIG_ARCH_QCOM is not set +CONFIG_ARCH_SEATTLE=y +CONFIG_ARCH_SPRD=y +CONFIG_ARCH_TEGRA=y +CONFIG_ARCH_TEGRA_132_SOC=y +CONFIG_ARCH_THUNDER=y +CONFIG_ARCH_VEXPRESS=y +CONFIG_ARCH_XGENE=y +# CONFIG_ARCH_ZYNQMP is not set +CONFIG_ARM64_ACPI_PARKING_PROTOCOL=y +CONFIG_ARM64_VA_BITS_48=y +CONFIG_ARM_SMMU=y +CONFIG_ARM_SMMU_V3=y +CONFIG_BCM2711_THERMAL=m +CONFIG_BCM2835_MBOX=y +CONFIG_BCM7XXX_PHY=m +CONFIG_BCMGENET=y +CONFIG_CHR_DEV_SCH=m +CONFIG_CMA=y +CONFIG_COMPAT=y +CONFIG_CONNECTOR=m +# CONFIG_CORE_DUMP_DEFAULT_ELF_HEADERS is not set +CONFIG_CRYPTO_AES_ARM64_CE_BLK=y +CONFIG_CRYPTO_AES_ARM64_CE_CCM=y +CONFIG_CRYPTO_AES_ARM64_NEON_BLK=y +CONFIG_CRYPTO_ANSI_CPRNG=y +CONFIG_CRYPTO_GHASH_ARM64_CE=y +# CONFIG_DEBUG_PREEMPT is not set +CONFIG_DMA_BCM2835=y +CONFIG_DMA_CMA=y +CONFIG_DM_DEBUG=y +CONFIG_GPIO_PL061=y +CONFIG_GPIO_XGENE=y +CONFIG_GPIO_XGENE_SB=y +CONFIG_IOMMU_SUPPORT=y +# CONFIG_IOSCHED_DEADLINE is not set +CONFIG_KVM=y +CONFIG_LEGACY_PTY_COUNT=16 +CONFIG_MAILBOX=y +CONFIG_MDIO_BCM_UNIMAC=m +CONFIG_MDIO_BITBANG=m +CONFIG_MDIO_GPIO=m +CONFIG_MDIO_OCTEON=y +CONFIG_MMC_ARMMMCI=y +CONFIG_MMC_SDHCI_PLTFM=y +CONFIG_MMC_SPI=y +# CONFIG_NETFILTER_XT_MATCH_SCTP is not set +CONFIG_NET_XGENE=y +# CONFIG_NF_CT_PROTO_SCTP is not set +CONFIG_NO_HZ_IDLE=y +CONFIG_PATA_OF_PLATFORM=y +CONFIG_PATA_PLATFORM=y +CONFIG_PCIE_BRCMSTB=y +CONFIG_PCI_HISI=y +CONFIG_PCI_HOST_GENERIC=y +CONFIG_PCI_HOST_THUNDER_ECAM=y +CONFIG_PCI_HOST_THUNDER_PEM=y +CONFIG_PCI_PASID=y +CONFIG_PCI_PRI=y +CONFIG_PCI_REALLOC_ENABLE_AUTO=y +CONFIG_PCI_STUB=m +CONFIG_PCI_XGENE=y +CONFIG_PHY_XGENE=y +CONFIG_POWER_RESET_SYSCON=y +CONFIG_POWER_RESET_XGENE=y +CONFIG_PPS_CLIENT_GPIO=m +CONFIG_PREEMPT=y +# CONFIG_PROC_PID_CPUSET is not set +CONFIG_PWM=y +CONFIG_PWM_BCM2835=m +CONFIG_PWM_RASPBERRYPI_POE=m +CONFIG_RASPBERRYPI_FIRMWARE=y +CONFIG_RASPBERRYPI_POWER=y +CONFIG_RTC_DRV_EFI=y +CONFIG_RTC_DRV_XGENE=y +CONFIG_SATA_AHCI_PLATFORM=y +# CONFIG_SCSI_PROC_FS is not set +CONFIG_SECCOMP=y +CONFIG_SENSORS_PWM_FAN=m +CONFIG_SENSORS_RASPBERRYPI_HWMON=m +CONFIG_SERIAL_AMBA_PL011=y +CONFIG_SERIAL_AMBA_PL011_CONSOLE=y +CONFIG_SERIAL_OF_PLATFORM=y +CONFIG_SERIAL_XILINX_PS_UART=y +CONFIG_SERIAL_XILINX_PS_UART_CONSOLE=y +CONFIG_SERIO_AMBAKMI=y +CONFIG_SPI=y +CONFIG_SPI_PL022=y +CONFIG_TASK_DELAY_ACCT=y +CONFIG_TCG_TIS_ST33ZP24=m +CONFIG_TCG_TIS_ST33ZP24_I2C=m +CONFIG_TCG_TIS_ST33ZP24_SPI=m +CONFIG_THUNDER_NIC_PF=y +CONFIG_THUNDER_NIC_VF=y +CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug" +CONFIG_UIO=m +CONFIG_USB_EHCI_HCD_PLATFORM=y +CONFIG_USB_ISP1760=y +CONFIG_USB_OHCI_HCD_PLATFORM=y +CONFIG_USB_ULPI=y +CONFIG_USB_XHCI_PLATFORM=y +CONFIG_VIRTUALIZATION=y +CONFIG_XGENE_DMA=y diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/files/commonconfig-6.18 b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/files/commonconfig-6.18 new file mode 100644 index 00000000000..21b99c081b2 --- /dev/null +++ b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/files/commonconfig-6.18 @@ -0,0 +1,1053 @@ +CONFIG_8139CP=m +CONFIG_8139TOO=m +CONFIG_8139TOO_8129=y +CONFIG_8139TOO_TUNE_TWISTER=y +CONFIG_9P_FS=m +CONFIG_9P_FSCACHE=y +CONFIG_9P_FS_POSIX_ACL=y +CONFIG_9P_FS_SECURITY=y +CONFIG_ACENIC=m +CONFIG_ACPI=y +CONFIG_ALX=m +CONFIG_AMD8111_ETH=m +CONFIG_AMD_PHY=m +CONFIG_AT803X_PHY=m +CONFIG_ATA=m +CONFIG_ATA_OVER_ETH=m +CONFIG_ATA_PIIX=m +CONFIG_ATL1=m +CONFIG_ATL1C=m +CONFIG_ATL1E=m +CONFIG_ATL2=m +CONFIG_AUDIT=y +CONFIG_AUTOFS_FS=y +CONFIG_B44=m +# CONFIG_BACKLIGHT_CLASS_DEVICE is not set +CONFIG_BCACHE=m +CONFIG_BCM87XX_PHY=m +CONFIG_BFQ_GROUP_IOSCHED=y +CONFIG_BINFMT_MISC=m +CONFIG_BLK_CGROUP=y +CONFIG_BLK_DEV_3W_XXXX_RAID=m +CONFIG_BLK_DEV_DM=m +CONFIG_BLK_DEV_DRBD=m +CONFIG_BLK_DEV_INITRD=y +CONFIG_BLK_DEV_LOOP=m +CONFIG_BLK_DEV_NBD=m +CONFIG_BLK_DEV_NVME=m +CONFIG_BLK_DEV_PCIESSD_MTIP32XX=m +CONFIG_BLK_DEV_RAM=m +CONFIG_BLK_DEV_RBD=m +CONFIG_BLK_DEV_SD=m +CONFIG_BLK_DEV_SR=m +CONFIG_BLK_DEV_THROTTLING=y +CONFIG_BLK_WBT=y +CONFIG_BNA=m +CONFIG_BNGE=m +CONFIG_BNX2X=m +CONFIG_BNXT=m +CONFIG_BONDING=m +CONFIG_BOOTPARAM_SOFTLOCKUP_PANIC=y +CONFIG_BOOT_PRINTK_DELAY=y +CONFIG_BPF_EVENTS=y +CONFIG_BPF_JIT=y +CONFIG_BPF_JIT_ALWAYS_ON=y +CONFIG_BPF_LSM=y +CONFIG_BPF_SYSCALL=y +CONFIG_BRIDGE=m +CONFIG_BRIDGE_EBT_802_3=m +CONFIG_BRIDGE_EBT_AMONG=m +CONFIG_BRIDGE_EBT_ARP=m +CONFIG_BRIDGE_EBT_ARPREPLY=m +CONFIG_BRIDGE_EBT_BROUTE=m +CONFIG_BRIDGE_EBT_DNAT=m +CONFIG_BRIDGE_EBT_IP=m +CONFIG_BRIDGE_EBT_IP6=m +CONFIG_BRIDGE_EBT_LIMIT=m +CONFIG_BRIDGE_EBT_LOG=m +CONFIG_BRIDGE_EBT_MARK=m +CONFIG_BRIDGE_EBT_MARK_T=m +CONFIG_BRIDGE_EBT_NFLOG=m +CONFIG_BRIDGE_EBT_PKTTYPE=m +CONFIG_BRIDGE_EBT_REDIRECT=m +CONFIG_BRIDGE_EBT_SNAT=m +CONFIG_BRIDGE_EBT_STP=m +CONFIG_BRIDGE_EBT_T_FILTER=m +CONFIG_BRIDGE_EBT_T_NAT=m +CONFIG_BRIDGE_EBT_VLAN=m +CONFIG_BRIDGE_NETFILTER=y +CONFIG_BRIDGE_NF_EBTABLES=m +CONFIG_BRIDGE_NF_EBTABLES_LEGACY=m +CONFIG_BRIDGE_VLAN_FILTERING=y +CONFIG_BROADCOM_PHY=m +CONFIG_BSD_DISKLABEL=y +CONFIG_BSD_PROCESS_ACCT=y +CONFIG_BSD_PROCESS_ACCT_V3=y +CONFIG_BTRFS_FS=m +CONFIG_BTRFS_FS_POSIX_ACL=y +CONFIG_CACHEFILES=m +CONFIG_CEPH_FS=m +CONFIG_CEPH_FSCACHE=y +CONFIG_CEPH_FS_POSIX_ACL=y +CONFIG_CEPH_LIB_USE_DNS_RESOLVER=y +CONFIG_CFS_BANDWIDTH=y +CONFIG_CGROUP_BPF=y +CONFIG_CGROUP_CPUACCT=y +CONFIG_CGROUP_DEVICE=y +CONFIG_CGROUP_FREEZER=y +CONFIG_CGROUP_HUGETLB=y +CONFIG_CGROUP_NET_PRIO=y +CONFIG_CGROUP_PERF=y +CONFIG_CGROUP_PIDS=y +CONFIG_CHECKPOINT_RESTORE=y +CONFIG_CHELSIO_T1=m +CONFIG_CHELSIO_T1_1G=y +CONFIG_CHELSIO_T3=m +CONFIG_CHELSIO_T4=m +CONFIG_CHELSIO_T4VF=m +CONFIG_CHR_DEV_SG=m +CONFIG_CIFS=m +CONFIG_CIFS_DFS_UPCALL=y +CONFIG_CIFS_FSCACHE=y +CONFIG_CIFS_POSIX=y +CONFIG_CIFS_STATS2=y +CONFIG_CIFS_UPCALL=y +CONFIG_CIFS_XATTR=y +CONFIG_CLS_U32_MARK=y +CONFIG_CLS_U32_PERF=y +CONFIG_CMDLINE="rootflags=rw mount.usrflags=ro" +CONFIG_CNIC=m +# CONFIG_COMPAT_BRK is not set +CONFIG_CPUSETS=y +CONFIG_CPUSETS_V1=y +CONFIG_CPU_FREQ=y +CONFIG_CPU_FREQ_GOV_CONSERVATIVE=m +CONFIG_CPU_FREQ_GOV_ONDEMAND=m +CONFIG_CPU_FREQ_GOV_POWERSAVE=m +CONFIG_CPU_FREQ_GOV_USERSPACE=m +CONFIG_CPU_FREQ_STAT=y +# CONFIG_CROSS_MEMORY_ATTACH is not set +CONFIG_CRYPTO_AES=m +CONFIG_CRYPTO_CTR=m +CONFIG_CRYPTO_CTS=m +CONFIG_CRYPTO_DES=m +CONFIG_CRYPTO_FIPS=y +CONFIG_CRYPTO_GCM=m +CONFIG_CRYPTO_GHASH=m +CONFIG_CRYPTO_HMAC=y +CONFIG_CRYPTO_LIB_AES=m +CONFIG_CRYPTO_LIB_DES=m +CONFIG_CRYPTO_LIB_GF128MUL=m +CONFIG_CRYPTO_LZO=m +# CONFIG_CRYPTO_MANAGER_DISABLE_TESTS is not set +CONFIG_CRYPTO_NULL=m +CONFIG_CRYPTO_SELFTESTS=y +CONFIG_CRYPTO_SHA1=y +CONFIG_CRYPTO_USER_API_HASH=m +CONFIG_CRYPTO_USER_API_SKCIPHER=m +CONFIG_CUSE=m +CONFIG_DCB=y +CONFIG_DEBUG_FS=y +CONFIG_DEBUG_INFO_BTF=y +CONFIG_DEBUG_INFO_DWARF_TOOLCHAIN_DEFAULT=y +CONFIG_DEBUG_SHIRQ=y +# CONFIG_DEVKMEM is not set +CONFIG_DEVTMPFS=y +CONFIG_DEVTMPFS_MOUNT=y +CONFIG_DL2K=m +CONFIG_DLM=m +CONFIG_DMADEVICES=y +CONFIG_DMI_SYSFS=m +CONFIG_DM_CACHE=m +CONFIG_DM_CRYPT=m +CONFIG_DM_MIRROR=m +CONFIG_DM_MULTIPATH=m +CONFIG_DM_MULTIPATH_QL=m +CONFIG_DM_MULTIPATH_ST=m +CONFIG_DM_RAID=m +CONFIG_DM_SNAPSHOT=m +CONFIG_DM_THIN_PROVISIONING=m +CONFIG_DM_UEVENT=y +CONFIG_DM_VERITY=m +CONFIG_DM_ZERO=m +CONFIG_DNS_RESOLVER=y +CONFIG_DRM=m +CONFIG_DRM_FBDEV_EMULATION=y +CONFIG_DRM_QXL=m +CONFIG_DRM_SIMPLEDRM=m +CONFIG_DRM_TTM_HELPER=m +CONFIG_DRM_VIRTIO_GPU=m +CONFIG_DST_CACHE=y +CONFIG_DUMMY=m +CONFIG_DYNAMIC_DEBUG=y +CONFIG_E100=m +CONFIG_E1000=m +CONFIG_E1000E=m +CONFIG_EDAC=m +# CONFIG_EDAC_LEGACY_SYSFS is not set +CONFIG_EFI=y +CONFIG_EFIVAR_FS=y +CONFIG_EFI_STUB=y +# CONFIG_ENABLE_WARN_DEPRECATED is not set +CONFIG_ENA_ETHERNET=m +CONFIG_ENCLOSURE_SERVICES=m +CONFIG_ENCRYPTED_KEYS=m +CONFIG_EROFS_FS=m +CONFIG_EROFS_FS_XATTR=y +CONFIG_EXPERT=y +CONFIG_EXT4_FS=m +CONFIG_EXT4_FS_POSIX_ACL=y +CONFIG_EXT4_FS_SECURITY=y +CONFIG_FANOTIFY=y +CONFIG_FANOTIFY_ACCESS_PERMISSIONS=y +CONFIG_FAT_DEFAULT_IOCHARSET="ascii" +CONFIG_FB=y +CONFIG_FB_EFI=y +CONFIG_FB_HYPERV=m +CONFIG_FCOE=m +# CONFIG_FIRMWARE_IN_KERNEL is not set +CONFIG_FORCEDETH=m +CONFIG_FORTIFY_SOURCE=y +CONFIG_FRAMEBUFFER_CONSOLE=y +CONFIG_FRAMEBUFFER_CONSOLE_DETECT_PRIMARY=y +CONFIG_FRAMEBUFFER_CONSOLE_ROTATION=y +CONFIG_FSCACHE=y +CONFIG_FSCACHE_STATS=y +CONFIG_FS_DAX=y +CONFIG_FS_ENCRYPTION=y +CONFIG_FTRACE_SYSCALLS=y +CONFIG_FUSE_DAX=y +CONFIG_FUSE_FS=m +CONFIG_FUSION=y +CONFIG_FUSION_CTL=m +CONFIG_FUSION_LOGGING=y +CONFIG_FUSION_MAX_SGE=40 +CONFIG_FUSION_SAS=m +CONFIG_FUSION_SPI=m +CONFIG_FW_CFG_SYSFS=m +CONFIG_GACT_PROB=y +CONFIG_GENEVE=m +CONFIG_GPIOLIB=y +CONFIG_GPIO_SYSFS=y +CONFIG_GRO_CELLS=y +CONFIG_GTP=m +CONFIG_HARDENED_USERCOPY=y +CONFIG_HIDRAW=y +CONFIG_HID_APPLE=m +CONFIG_HID_BELKIN=m +CONFIG_HID_HYPERV_MOUSE=m +CONFIG_HID_MICROSOFT=m +CONFIG_HIGH_RES_TIMERS=y +CONFIG_HOTPLUG_PCI=y +CONFIG_HOTPLUG_PCI_ACPI=y +CONFIG_HOTPLUG_PCI_PCIE=y +CONFIG_HP_ILO=m +CONFIG_HUGETLBFS=y +CONFIG_HWMON=m +CONFIG_HW_RANDOM=y +CONFIG_HW_RANDOM_TIMERIOMEM=m +CONFIG_HW_RANDOM_VIRTIO=y +CONFIG_HYPERV=y +CONFIG_HYPERV_BALLOON=m +CONFIG_HYPERV_NET=m +CONFIG_HYPERV_UTILS=m +CONFIG_HZ_1000=y +CONFIG_I2C_AMD756=m +CONFIG_I2C_AMD8111=m +# CONFIG_I2C_COMPAT is not set +CONFIG_I2C_I801=m +CONFIG_I2C_PIIX4=m +CONFIG_I40E=m +CONFIG_I40EVF=m +CONFIG_ICE=m +CONFIG_IFB=m +CONFIG_IGB=m +CONFIG_IGBVF=m +CONFIG_IKCONFIG=y +CONFIG_IKCONFIG_PROC=y +CONFIG_IKHEADERS=m +CONFIG_IMA=y +CONFIG_IMA_APPRAISE=y +CONFIG_IMA_DEFAULT_HASH="sha1" +CONFIG_IMA_DEFAULT_HASH_SHA1=y +CONFIG_IMA_DEFAULT_TEMPLATE="ima-ng" +CONFIG_IMA_LSM_RULES=y +CONFIG_IMA_MEASURE_PCR_IDX=10 +CONFIG_IMA_NG_TEMPLATE=y +CONFIG_IMA_READ_POLICY=y +CONFIG_IMA_WRITE_POLICY=y +CONFIG_INET=y +CONFIG_INET6_AH=m +CONFIG_INET6_ESP=m +CONFIG_INET6_ESP_OFFLOAD=m +CONFIG_INET6_IPCOMP=m +CONFIG_INET_AH=m +CONFIG_INET_DIAG=m +CONFIG_INET_DIAG_DESTROY=y +CONFIG_INET_ESP=m +CONFIG_INET_ESP_OFFLOAD=m +CONFIG_INET_IPCOMP=m +CONFIG_INET_UDP_DIAG=m +CONFIG_INFINIBAND=m +CONFIG_INFINIBAND_CXGB4=m +CONFIG_INFINIBAND_IPOIB=m +CONFIG_INFINIBAND_IPOIB_CM=y +CONFIG_INFINIBAND_IPOIB_DEBUG_DATA=y +CONFIG_INFINIBAND_ISER=m +CONFIG_INFINIBAND_MTHCA=m +CONFIG_INFINIBAND_OCRDMA=m +CONFIG_INFINIBAND_SRP=m +CONFIG_INFINIBAND_USER_MAD=m +CONFIG_INITRAMFS_COMPRESSION_XZ=y +CONFIG_INIT_STACK_NONE=y +CONFIG_INPUT_EVDEV=m +CONFIG_INPUT_MISC=y +CONFIG_INPUT_MOUSEDEV=m +# CONFIG_INPUT_MOUSEDEV_PSAUX is not set +CONFIG_IOSCHED_BFQ=y +CONFIG_IO_STRICT_DEVMEM=y +CONFIG_IP6_NF_FILTER=m +CONFIG_IP6_NF_IPTABLES=m +CONFIG_IP6_NF_MANGLE=m +CONFIG_IP6_NF_MATCH_AH=m +CONFIG_IP6_NF_MATCH_EUI64=m +CONFIG_IP6_NF_MATCH_FRAG=m +CONFIG_IP6_NF_MATCH_HL=m +CONFIG_IP6_NF_MATCH_IPV6HEADER=m +CONFIG_IP6_NF_MATCH_MH=m +CONFIG_IP6_NF_MATCH_OPTS=m +CONFIG_IP6_NF_MATCH_RPFILTER=m +CONFIG_IP6_NF_MATCH_RT=m +CONFIG_IP6_NF_MATCH_SRH=m +CONFIG_IP6_NF_NAT=m +CONFIG_IP6_NF_RAW=m +CONFIG_IP6_NF_SECURITY=m +CONFIG_IP6_NF_TARGET_HL=m +CONFIG_IP6_NF_TARGET_MASQUERADE=m +CONFIG_IP6_NF_TARGET_NPT=m +CONFIG_IP6_NF_TARGET_REJECT=m +CONFIG_IP6_NF_TARGET_SYNPROXY=m +CONFIG_IPMI_DEVICE_INTERFACE=m +CONFIG_IPMI_HANDLER=m +CONFIG_IPMI_PANIC_EVENT=y +CONFIG_IPMI_PANIC_STRING=y +CONFIG_IPMI_POWEROFF=m +CONFIG_IPMI_SI=m +CONFIG_IPMI_SSIF=m +CONFIG_IPMI_WATCHDOG=m +CONFIG_IPV6_GRE=m +CONFIG_IPV6_MIP6=m +CONFIG_IPV6_MROUTE=y +CONFIG_IPV6_MROUTE_MULTIPLE_TABLES=y +CONFIG_IPV6_MULTIPLE_TABLES=y +CONFIG_IPV6_OPTIMISTIC_DAD=y +CONFIG_IPV6_PIMSM_V2=y +CONFIG_IPV6_ROUTER_PREF=y +CONFIG_IPV6_ROUTE_INFO=y +CONFIG_IPV6_SIT=m +CONFIG_IPV6_SIT_6RD=y +CONFIG_IPV6_SUBTREES=y +CONFIG_IPV6_VTI=m +CONFIG_IPVLAN=m +CONFIG_IP_ADVANCED_ROUTER=y +CONFIG_IP_FIB_TRIE_STATS=y +CONFIG_IP_MROUTE=y +CONFIG_IP_MROUTE_MULTIPLE_TABLES=y +CONFIG_IP_MULTICAST=y +CONFIG_IP_MULTIPLE_TABLES=y +CONFIG_IP_NF_ARPFILTER=m +CONFIG_IP_NF_ARPTABLES=m +CONFIG_IP_NF_ARP_MANGLE=m +CONFIG_IP_NF_FILTER=m +CONFIG_IP_NF_IPTABLES=y +CONFIG_IP_NF_MANGLE=m +CONFIG_IP_NF_MATCH_AH=m +CONFIG_IP_NF_MATCH_ECN=m +CONFIG_IP_NF_MATCH_RPFILTER=m +CONFIG_IP_NF_MATCH_TTL=m +CONFIG_IP_NF_NAT=m +CONFIG_IP_NF_RAW=m +CONFIG_IP_NF_SECURITY=m +CONFIG_IP_NF_TARGET_ECN=m +CONFIG_IP_NF_TARGET_MASQUERADE=m +CONFIG_IP_NF_TARGET_NETMAP=m +CONFIG_IP_NF_TARGET_REDIRECT=m +CONFIG_IP_NF_TARGET_REJECT=m +CONFIG_IP_NF_TARGET_SYNPROXY=m +CONFIG_IP_NF_TARGET_TTL=m +CONFIG_IP_PIMSM_V1=y +CONFIG_IP_PIMSM_V2=y +# CONFIG_IP_PNP is not set +CONFIG_IP_ROUTE_MULTIPATH=y +CONFIG_IP_ROUTE_VERBOSE=y +CONFIG_IP_SCTP=m +CONFIG_IP_SET=m +CONFIG_IP_SET_BITMAP_IP=m +CONFIG_IP_SET_BITMAP_IPMAC=m +CONFIG_IP_SET_BITMAP_PORT=m +CONFIG_IP_SET_HASH_IP=m +CONFIG_IP_SET_HASH_IPMARK=m +CONFIG_IP_SET_HASH_IPPORT=m +CONFIG_IP_SET_HASH_IPPORTIP=m +CONFIG_IP_SET_HASH_IPPORTNET=m +CONFIG_IP_SET_HASH_MAC=m +CONFIG_IP_SET_HASH_NET=m +CONFIG_IP_SET_HASH_NETIFACE=m +CONFIG_IP_SET_HASH_NETNET=m +CONFIG_IP_SET_HASH_NETPORT=m +CONFIG_IP_SET_HASH_NETPORTNET=m +CONFIG_IP_SET_LIST_SET=m +CONFIG_IP_VS=m +CONFIG_IP_VS_DH=m +CONFIG_IP_VS_FO=m +CONFIG_IP_VS_FTP=m +CONFIG_IP_VS_IPV6=y +CONFIG_IP_VS_LBLC=m +CONFIG_IP_VS_LBLCR=m +CONFIG_IP_VS_LC=m +CONFIG_IP_VS_NQ=m +CONFIG_IP_VS_PE_SIP=m +CONFIG_IP_VS_PROTO_AH=y +CONFIG_IP_VS_PROTO_ESP=y +CONFIG_IP_VS_PROTO_SCTP=y +CONFIG_IP_VS_PROTO_TCP=y +CONFIG_IP_VS_PROTO_UDP=y +CONFIG_IP_VS_RR=m +CONFIG_IP_VS_SED=m +CONFIG_IP_VS_SH=m +CONFIG_IP_VS_WLC=m +CONFIG_IP_VS_WRR=m +CONFIG_IRQ_TIME_ACCOUNTING=y +CONFIG_ISCSI_BOOT_SYSFS=m +CONFIG_ISCSI_TARGET=m +CONFIG_ISCSI_TCP=m +CONFIG_ISO9660_FS=m +CONFIG_IXGBE=m +CONFIG_IXGBEVF=m +CONFIG_IXGBEVF_IPSEC=y +CONFIG_IXGBE_IPSEC=y +CONFIG_JME=m +CONFIG_JOLIET=y +CONFIG_JUMP_LABEL=y +CONFIG_KALLSYMS_ALL=y +CONFIG_KEXEC=y +CONFIG_KEYS=y +CONFIG_KEY_DH_OPERATIONS=y +CONFIG_KPROBES=y +CONFIG_KPROBE_EVENTS=y +CONFIG_KRETPROBES=y +CONFIG_KSM=y +CONFIG_LATENCYTOP=y +# CONFIG_LCD_CLASS_DEVICE is not set +CONFIG_LEDS_CLASS=y +# CONFIG_LEGACY_PTYS is not set +CONFIG_LIBFC=m +CONFIG_LIBFCOE=m +# CONFIG_LOCALVERSION_AUTO is not set +CONFIG_LOCK_DOWN_IN_EFI_SECURE_BOOT=y +CONFIG_LOG_BUF_SHIFT=18 +CONFIG_LOOPBACK_TARGET=m +CONFIG_LSM="landlock,lockdown,yama,loadpin,safesetid,integrity,selinux,smack,tomoyo,apparmor" +CONFIG_LWTUNNEL=y +CONFIG_LWTUNNEL_BPF=y +CONFIG_MACSEC=m +CONFIG_MACVLAN=m +CONFIG_MACVTAP=m +CONFIG_MAGIC_SYSRQ=y +CONFIG_MARVELL_PHY=m +CONFIG_MAX_RAW_DEVS=8192 +CONFIG_MD=y +CONFIG_MD_LINEAR=m +CONFIG_MD_RAID0=m +CONFIG_MEGARAID_MAILBOX=m +CONFIG_MEGARAID_MM=m +CONFIG_MEGARAID_NEWGEN=y +CONFIG_MEGARAID_SAS=m +CONFIG_MEMCG=y +CONFIG_MEMCG_V1=y +CONFIG_MEMORY_HOTPLUG=y +CONFIG_MEMORY_HOTREMOVE=y +CONFIG_MEMTEST=y +CONFIG_MICROSOFT_MANA=m +CONFIG_MINIX_SUBPARTITION=y +# CONFIG_MLX4_DEBUG is not set +CONFIG_MLX4_EN=m +CONFIG_MLX4_INFINIBAND=m +CONFIG_MLX5_BRIDGE=y +CONFIG_MLX5_CLS_ACT=y +CONFIG_MLX5_CORE=m +CONFIG_MLX5_CORE_EN=y +CONFIG_MLX5_CORE_EN_DCB=y +CONFIG_MLX5_EN_ARFS=y +CONFIG_MLX5_EN_IPSEC=y +CONFIG_MLX5_EN_RXNFC=y +CONFIG_MLX5_EN_TLS=y +CONFIG_MLX5_ESWITCH=y +CONFIG_MLX5_INFINIBAND=m +CONFIG_MLX5_MACSEC=y +CONFIG_MLX5_MPFS=y +CONFIG_MLX5_SF=y +CONFIG_MLX5_SF_MANAGER=y +CONFIG_MLX5_SW_STEERING=y +CONFIG_MLX5_TC_CT=y +CONFIG_MLX5_TC_SAMPLE=y +CONFIG_MLX5_VDPA=y +CONFIG_MLX5_VDPA_NET=m +CONFIG_MLX5_VFIO_PCI=m +CONFIG_MMC=m +CONFIG_MMC_BLOCK=m +CONFIG_MMC_BLOCK_MINORS=16 +# CONFIG_MMC_RICOH_MMC is not set +CONFIG_MMC_SDHCI=m +CONFIG_MMC_SDHCI_PCI=m +CONFIG_MODULES=y +CONFIG_MODULE_COMPRESS=y +CONFIG_MODULE_COMPRESS_XZ=y +CONFIG_MODULE_SIG=y +CONFIG_MODULE_SIG_KEY="${MODULE_SIGNING_KEY_DIR}/certs/modules.pem" +CONFIG_MODULE_SIG_SHA256=y +CONFIG_MODULE_UNLOAD=y +CONFIG_MOUSE_PS2=m +# CONFIG_MOUSE_PS2_ALPS is not set +# CONFIG_MOUSE_PS2_CYPRESS is not set +# CONFIG_MOUSE_PS2_FOCALTECH is not set +# CONFIG_MOUSE_PS2_LOGIPS2PP is not set +# CONFIG_MOUSE_PS2_SYNAPTICS is not set +# CONFIG_MOUSE_PS2_TRACKPOINT is not set +CONFIG_MPLS_IPTUNNEL=m +CONFIG_MPLS_ROUTING=m +CONFIG_MSDOS_FS=m +CONFIG_MTD=m +CONFIG_MYRI10GE=m +CONFIG_NAMESPACES=y +CONFIG_NATSEMI=m +CONFIG_NET=y +CONFIG_NETCONSOLE=m +CONFIG_NETCONSOLE_DYNAMIC=y +CONFIG_NETDEVICES=y +CONFIG_NETFILTER=y +CONFIG_NETFILTER_ADVANCED=y +CONFIG_NETFILTER_NETLINK_GLUE_CT=y +CONFIG_NETFILTER_NETLINK_QUEUE=m +CONFIG_NETFILTER_XTABLES=y +CONFIG_NETFILTER_XTABLES_LEGACY=y +CONFIG_NETFILTER_XT_MATCH_ADDRTYPE=m +CONFIG_NETFILTER_XT_MATCH_BPF=m +CONFIG_NETFILTER_XT_MATCH_CGROUP=m +CONFIG_NETFILTER_XT_MATCH_CLUSTER=m +CONFIG_NETFILTER_XT_MATCH_COMMENT=m +CONFIG_NETFILTER_XT_MATCH_CONNBYTES=m +CONFIG_NETFILTER_XT_MATCH_CONNLABEL=m +CONFIG_NETFILTER_XT_MATCH_CONNLIMIT=m +CONFIG_NETFILTER_XT_MATCH_CONNMARK=m +CONFIG_NETFILTER_XT_MATCH_CONNTRACK=m +CONFIG_NETFILTER_XT_MATCH_CPU=m +CONFIG_NETFILTER_XT_MATCH_DEVGROUP=m +CONFIG_NETFILTER_XT_MATCH_DSCP=m +CONFIG_NETFILTER_XT_MATCH_ESP=m +CONFIG_NETFILTER_XT_MATCH_HASHLIMIT=m +CONFIG_NETFILTER_XT_MATCH_HELPER=m +CONFIG_NETFILTER_XT_MATCH_IPCOMP=m +CONFIG_NETFILTER_XT_MATCH_IPRANGE=m +CONFIG_NETFILTER_XT_MATCH_IPVS=m +CONFIG_NETFILTER_XT_MATCH_L2TP=m +CONFIG_NETFILTER_XT_MATCH_LENGTH=m +CONFIG_NETFILTER_XT_MATCH_LIMIT=m +CONFIG_NETFILTER_XT_MATCH_MAC=m +CONFIG_NETFILTER_XT_MATCH_MARK=m +CONFIG_NETFILTER_XT_MATCH_MULTIPORT=m +CONFIG_NETFILTER_XT_MATCH_NFACCT=m +CONFIG_NETFILTER_XT_MATCH_OSF=m +CONFIG_NETFILTER_XT_MATCH_OWNER=m +CONFIG_NETFILTER_XT_MATCH_PHYSDEV=m +CONFIG_NETFILTER_XT_MATCH_PKTTYPE=m +CONFIG_NETFILTER_XT_MATCH_POLICY=m +CONFIG_NETFILTER_XT_MATCH_QUOTA=m +CONFIG_NETFILTER_XT_MATCH_RATEEST=m +CONFIG_NETFILTER_XT_MATCH_REALM=m +CONFIG_NETFILTER_XT_MATCH_RECENT=m +CONFIG_NETFILTER_XT_MATCH_SOCKET=m +CONFIG_NETFILTER_XT_MATCH_STATE=m +CONFIG_NETFILTER_XT_MATCH_STATISTIC=m +CONFIG_NETFILTER_XT_MATCH_STRING=m +CONFIG_NETFILTER_XT_MATCH_TCPMSS=m +CONFIG_NETFILTER_XT_MATCH_TIME=m +CONFIG_NETFILTER_XT_MATCH_U32=m +CONFIG_NETFILTER_XT_SET=m +CONFIG_NETFILTER_XT_TARGET_CHECKSUM=m +CONFIG_NETFILTER_XT_TARGET_CLASSIFY=m +CONFIG_NETFILTER_XT_TARGET_CONNMARK=m +CONFIG_NETFILTER_XT_TARGET_CONNSECMARK=m +CONFIG_NETFILTER_XT_TARGET_CT=m +CONFIG_NETFILTER_XT_TARGET_DSCP=m +CONFIG_NETFILTER_XT_TARGET_HMARK=m +CONFIG_NETFILTER_XT_TARGET_IDLETIMER=m +CONFIG_NETFILTER_XT_TARGET_LOG=m +CONFIG_NETFILTER_XT_TARGET_MARK=m +CONFIG_NETFILTER_XT_TARGET_NFLOG=m +CONFIG_NETFILTER_XT_TARGET_NFQUEUE=m +CONFIG_NETFILTER_XT_TARGET_SECMARK=m +CONFIG_NETFILTER_XT_TARGET_TCPMSS=m +CONFIG_NETFILTER_XT_TARGET_TCPOPTSTRIP=m +CONFIG_NETFILTER_XT_TARGET_TEE=m +CONFIG_NETFILTER_XT_TARGET_TPROXY=m +CONFIG_NETFILTER_XT_TARGET_TRACE=m +CONFIG_NETLINK_DIAG=m +CONFIG_NETWORK_PHY_TIMESTAMPING=y +CONFIG_NETXEN_NIC=m +CONFIG_NET_9P=m +# CONFIG_NET_9P_DEBUG is not set +CONFIG_NET_9P_RDMA=m +CONFIG_NET_9P_VIRTIO=m +CONFIG_NET_ACT_BPF=m +CONFIG_NET_ACT_CONNMARK=m +CONFIG_NET_ACT_CSUM=m +CONFIG_NET_ACT_CT=m +CONFIG_NET_ACT_CTINFO=m +CONFIG_NET_ACT_GACT=m +CONFIG_NET_ACT_GATE=m +CONFIG_NET_ACT_IFE=m +CONFIG_NET_ACT_MIRRED=m +CONFIG_NET_ACT_MPLS=m +CONFIG_NET_ACT_NAT=m +CONFIG_NET_ACT_PEDIT=m +CONFIG_NET_ACT_POLICE=m +CONFIG_NET_ACT_SAMPLE=m +CONFIG_NET_ACT_SIMP=m +CONFIG_NET_ACT_SKBEDIT=m +CONFIG_NET_ACT_SKBMOD=m +CONFIG_NET_ACT_TUNNEL_KEY=m +CONFIG_NET_ACT_VLAN=m +# CONFIG_NET_CADENCE is not set +CONFIG_NET_CLS_ACT=y +CONFIG_NET_CLS_BASIC=m +CONFIG_NET_CLS_BPF=m +CONFIG_NET_CLS_CGROUP=m +CONFIG_NET_CLS_FLOW=m +CONFIG_NET_CLS_FLOWER=m +CONFIG_NET_CLS_FW=m +CONFIG_NET_CLS_ROUTE4=m +CONFIG_NET_CLS_U32=m +CONFIG_NET_EMATCH=y +CONFIG_NET_EMATCH_CMP=m +CONFIG_NET_EMATCH_IPSET=m +CONFIG_NET_EMATCH_META=m +CONFIG_NET_EMATCH_NBYTE=m +CONFIG_NET_EMATCH_TEXT=m +CONFIG_NET_EMATCH_U32=m +CONFIG_NET_FOU_IP_TUNNELS=y +CONFIG_NET_IFE=m +CONFIG_NET_IPGRE=m +CONFIG_NET_IPGRE_BROADCAST=y +CONFIG_NET_IPGRE_DEMUX=m +CONFIG_NET_IPIP=m +CONFIG_NET_IPVTI=m +CONFIG_NET_KEY=m +CONFIG_NET_L3_MASTER_DEV=y +# CONFIG_NET_PACKET_ENGINE is not set +CONFIG_NET_SCHED=y +CONFIG_NET_SCH_CHOKE=m +CONFIG_NET_SCH_CODEL=m +CONFIG_NET_SCH_DRR=m +CONFIG_NET_SCH_FQ=m +CONFIG_NET_SCH_FQ_CODEL=m +CONFIG_NET_SCH_GRED=m +CONFIG_NET_SCH_HFSC=m +CONFIG_NET_SCH_HHF=m +CONFIG_NET_SCH_HTB=m +CONFIG_NET_SCH_INGRESS=m +CONFIG_NET_SCH_MQPRIO=m +CONFIG_NET_SCH_MULTIQ=m +CONFIG_NET_SCH_NETEM=m +CONFIG_NET_SCH_PIE=m +CONFIG_NET_SCH_PLUG=m +CONFIG_NET_SCH_PRIO=m +CONFIG_NET_SCH_QFQ=m +CONFIG_NET_SCH_RED=m +CONFIG_NET_SCH_SFB=m +CONFIG_NET_SCH_SFQ=m +CONFIG_NET_SCH_TBF=m +CONFIG_NET_SCH_TEQL=m +CONFIG_NET_SWITCHDEV=y +CONFIG_NET_TC_SKB_EXT=y +CONFIG_NET_TULIP=y +# CONFIG_NET_VENDOR_3COM is not set +# CONFIG_NET_VENDOR_ADAPTEC is not set +# CONFIG_NET_VENDOR_AGERE is not set +# CONFIG_NET_VENDOR_ARC is not set +# CONFIG_NET_VENDOR_MICREL is not set +CONFIG_NET_VENDOR_NATSEMI=y +# CONFIG_NET_VENDOR_OKI is not set +# CONFIG_NET_VENDOR_QUALCOMM is not set +# CONFIG_NET_VENDOR_RDC is not set +# CONFIG_NET_VENDOR_ROCKER is not set +# CONFIG_NET_VENDOR_SAMSUNG is not set +# CONFIG_NET_VENDOR_SEEQ is not set +# CONFIG_NET_VENDOR_SILAN is not set +# CONFIG_NET_VENDOR_SIS is not set +# CONFIG_NET_VENDOR_SMSC is not set +# CONFIG_NET_VENDOR_STMICRO is not set +# CONFIG_NET_VENDOR_SUN is not set +# CONFIG_NET_VENDOR_TEHUTI is not set +# CONFIG_NET_VENDOR_TI is not set +CONFIG_NET_VENDOR_VIA=y +# CONFIG_NET_VENDOR_WIZNET is not set +CONFIG_NET_VRF=y +CONFIG_NEW_LEDS=y +CONFIG_NFSD=m +CONFIG_NFSD_V3_ACL=y +CONFIG_NFSD_V4=y +CONFIG_NFS_FS=m +CONFIG_NFS_FSCACHE=y +CONFIG_NFS_V3_ACL=y +CONFIG_NFS_V4=m +CONFIG_NFS_V4_1=y +CONFIG_NFS_V4_2=y +CONFIG_NFS_V4_2_READ_PLUS=n +CONFIG_NFT_BRIDGE_META=m +CONFIG_NFT_BRIDGE_REJECT=m +CONFIG_NFT_COMPAT=m +CONFIG_NFT_CT=m +CONFIG_NFT_DUP_IPV4=m +CONFIG_NFT_DUP_IPV6=m +CONFIG_NFT_DUP_NETDEV=m +CONFIG_NFT_FIB=m +CONFIG_NFT_FIB_INET=m +CONFIG_NFT_FIB_IPV4=m +CONFIG_NFT_FIB_IPV6=m +CONFIG_NFT_FIB_NETDEV=m +CONFIG_NFT_FLOW_OFFLOAD=m +CONFIG_NFT_FWD_NETDEV=m +CONFIG_NFT_HASH=m +CONFIG_NFT_LIMIT=m +CONFIG_NFT_LOG=m +CONFIG_NFT_MASQ=m +CONFIG_NFT_NAT=m +CONFIG_NFT_NUMGEN=m +CONFIG_NFT_QUEUE=m +CONFIG_NFT_QUOTA=m +CONFIG_NFT_REDIR=m +CONFIG_NFT_REJECT=m +CONFIG_NFT_TUNNEL=m +CONFIG_NFT_XFRM=m +CONFIG_NF_CONNTRACK=m +CONFIG_NF_CONNTRACK_AMANDA=m +CONFIG_NF_CONNTRACK_BRIDGE=m +CONFIG_NF_CONNTRACK_EVENTS=y +CONFIG_NF_CONNTRACK_FTP=m +CONFIG_NF_CONNTRACK_H323=m +CONFIG_NF_CONNTRACK_IRC=m +CONFIG_NF_CONNTRACK_NETBIOS_NS=m +CONFIG_NF_CONNTRACK_PPTP=m +# CONFIG_NF_CONNTRACK_PROC_COMPAT is not set +CONFIG_NF_CONNTRACK_SANE=m +CONFIG_NF_CONNTRACK_SECMARK=y +CONFIG_NF_CONNTRACK_SIP=m +CONFIG_NF_CONNTRACK_SNMP=m +CONFIG_NF_CONNTRACK_TFTP=m +CONFIG_NF_CONNTRACK_TIMEOUT=y +CONFIG_NF_CONNTRACK_TIMESTAMP=y +CONFIG_NF_CONNTRACK_ZONES=y +CONFIG_NF_CT_NETLINK=m +CONFIG_NF_CT_NETLINK_HELPER=m +CONFIG_NF_CT_NETLINK_TIMEOUT=m +CONFIG_NF_CT_PROTO_UDPLITE=y +CONFIG_NF_FLOW_TABLE=m +CONFIG_NF_LOG_ARP=m +CONFIG_NF_SOCKET_IPV4=m +CONFIG_NF_SOCKET_IPV6=m +CONFIG_NF_TABLES=m +CONFIG_NF_TABLES_ARP=y +CONFIG_NF_TABLES_BRIDGE=y +CONFIG_NF_TABLES_INET=y +CONFIG_NF_TABLES_IPV4=y +CONFIG_NF_TABLES_IPV6=y +CONFIG_NF_TABLES_NETDEV=y +CONFIG_NLS_ASCII=m +CONFIG_NLS_CODEPAGE_437=m +CONFIG_NLS_DEFAULT="utf8" +CONFIG_NLS_UTF8=m +CONFIG_NODES_SHIFT=7 +CONFIG_NO_HZ=y +CONFIG_NR_CPUS=512 +CONFIG_NUMA=y +CONFIG_NUMA_BALANCING=y +CONFIG_NVME_RDMA=m +CONFIG_NVME_TARGET=m +CONFIG_NVME_TARGET_LOOP=m +CONFIG_NVME_TARGET_RDMA=m +CONFIG_OPENVSWITCH=m +CONFIG_OVERLAY_FS=m +CONFIG_OVERLAY_FS_METACOPY=y +CONFIG_OVERLAY_FS_REDIRECT_DIR=y +CONFIG_OVPN=m +CONFIG_PACKET=y +CONFIG_PACKET_DIAG=m +CONFIG_PANIC_ON_OOPS=y +CONFIG_PANIC_TIMEOUT=60 +CONFIG_PARAVIRT=y +CONFIG_PARAVIRT_TIME_ACCOUNTING=y +CONFIG_PARTITION_ADVANCED=y +CONFIG_PATA_JMICRON=m +CONFIG_PATA_VIA=m +CONFIG_PCI=y +CONFIG_PCIEAER=y +CONFIG_PCIEPORTBUS=y +CONFIG_PCIE_ECRC=y +CONFIG_PCIE_THERMAL=y +CONFIG_PCI_HYPERV=m +CONFIG_PCI_IOV=y +CONFIG_PCI_MSI=y +CONFIG_PCNET32=m +CONFIG_PDC_ADMA=m +CONFIG_PLDMFW=y +CONFIG_POSIX_MQUEUE=y +CONFIG_POWER_SUPPLY=y +CONFIG_PPP=m +CONFIG_PPPOE=m +CONFIG_PPP_ASYNC=m +CONFIG_PPP_BSDCOMP=m +CONFIG_PPP_DEFLATE=m +CONFIG_PPP_FILTER=y +CONFIG_PPP_MPPE=m +CONFIG_PPP_MULTILINK=y +CONFIG_PPP_SYNC_TTY=m +CONFIG_PRINTK_TIME=y +# CONFIG_PRINT_QUOTA_WARNING is not set +CONFIG_PROC_KCORE=y +CONFIG_PROFILING=y +CONFIG_PSAMPLE=m +CONFIG_PSI=y +# CONFIG_PSI_DEFAULT_DISABLED is not set +CONFIG_PTP_1588_CLOCK=m +CONFIG_PTP_1588_CLOCK_KVM=m +CONFIG_QED=m +CONFIG_QEDE=m +CONFIG_QEDF=m +CONFIG_QEDI=m +CONFIG_QED_FCOE=y +CONFIG_QED_ISCSI=y +CONFIG_QED_LL2=y +CONFIG_QED_OOO=y +CONFIG_QFMT_V2=m +CONFIG_QUOTA=y +CONFIG_QUOTA_NETLINK_INTERFACE=y +CONFIG_R8169=m +CONFIG_RANDOMIZE_BASE=y +CONFIG_RCU_CPU_STALL_TIMEOUT=60 +# CONFIG_RC_CORE is not set +CONFIG_RDS=m +CONFIG_RDS_RDMA=m +CONFIG_RDS_TCP=m +CONFIG_REALTEK_PHY=m +CONFIG_REGULATOR=y +CONFIG_REGULATOR_FIXED_VOLTAGE=y +# CONFIG_RPCSEC_GSS_KRB5 requires some older crypto modules +CONFIG_RPCSEC_GSS_KRB5=m +CONFIG_RTC_CLASS=y +CONFIG_RT_GROUP_SCHED=y +CONFIG_S2IO=m +CONFIG_SATA_AHCI=m +CONFIG_SATA_MV=m +CONFIG_SATA_NV=m +CONFIG_SATA_PROMISE=m +CONFIG_SATA_QSTOR=m +CONFIG_SATA_SIL=m +CONFIG_SATA_SIL24=m +CONFIG_SATA_SIS=m +CONFIG_SATA_SVW=m +CONFIG_SATA_SX4=m +CONFIG_SATA_VIA=m +CONFIG_SATA_VITESSE=m +CONFIG_SCHED_AUTOGROUP=y +CONFIG_SCHED_SMT=y +CONFIG_SCHED_STACK_END_CHECK=y +CONFIG_SCSI_3W_9XXX=m +CONFIG_SCSI_3W_SAS=m +CONFIG_SCSI_AACRAID=m +CONFIG_SCSI_AIC79XX=m +CONFIG_SCSI_ARCMSR=m +CONFIG_SCSI_BNX2X_FCOE=m +CONFIG_SCSI_CONSTANTS=y +CONFIG_SCSI_DH=y +CONFIG_SCSI_DH_ALUA=m +CONFIG_SCSI_DH_EMC=m +CONFIG_SCSI_DH_RDAC=m +CONFIG_SCSI_ENCLOSURE=m +CONFIG_SCSI_FC_ATTRS=m +CONFIG_SCSI_HPSA=m +CONFIG_SCSI_LOGGING=y +CONFIG_SCSI_LPFC=m +CONFIG_SCSI_MPI3MR=m +CONFIG_SCSI_MPT2SAS=m +CONFIG_SCSI_MVSAS=m +# CONFIG_SCSI_MVSAS_DEBUG is not set +CONFIG_SCSI_MVSAS_TASKLET=y +CONFIG_SCSI_QLA_FC=m +CONFIG_SCSI_QLA_ISCSI=m +CONFIG_SCSI_SAS_ATA=y +CONFIG_SCSI_SCAN_ASYNC=y +CONFIG_SCSI_SMARTPQI=m +CONFIG_SCSI_SYM53C8XX_2=m +CONFIG_SCSI_VIRTIO=m +CONFIG_SECURITY=y +CONFIG_SECURITY_LANDLOCK=y +CONFIG_SECURITY_LOCKDOWN_LSM=y +CONFIG_SECURITY_LOCKDOWN_LSM_EARLY=y +CONFIG_SECURITY_NETWORK=y +CONFIG_SECURITY_NETWORK_XFRM=y +CONFIG_SECURITY_SELINUX=y +CONFIG_SECURITY_SELINUX_BOOTPARAM=y +CONFIG_SERIAL_8250=y +CONFIG_SERIAL_8250_CONSOLE=y +CONFIG_SERIAL_8250_EXTENDED=y +CONFIG_SERIAL_8250_MANY_PORTS=y +CONFIG_SERIAL_8250_NR_UARTS=32 +CONFIG_SERIAL_8250_RSA=y +CONFIG_SERIAL_8250_SHARE_IRQ=y +# CONFIG_SERIO_SERPORT is not set +CONFIG_SFC=m +CONFIG_SIGNED_PE_FILE_VERIFICATION=y +CONFIG_SKGE=m +CONFIG_SKY2=m +CONFIG_SLAB_FREELIST_HARDENED=y +CONFIG_SLAB_FREELIST_RANDOM=y +CONFIG_SMP=y +CONFIG_SOCK_VALIDATE_XMIT=y +CONFIG_SOFTLOCKUP_DETECTOR=y +CONFIG_SOFT_WATCHDOG=m +CONFIG_SOLARIS_X86_PARTITION=y +CONFIG_SQUASHFS=m +CONFIG_SQUASHFS_LZ4=y +CONFIG_SQUASHFS_LZO=y +CONFIG_SQUASHFS_XATTR=y +CONFIG_SQUASHFS_XZ=y +CONFIG_SQUASHFS_ZSTD=y +CONFIG_STACKPROTECTOR_STRONG=y +CONFIG_STRICT_DEVMEM=y +CONFIG_STRIP_ASM_SYMS=y +CONFIG_SUNDANCE=m +CONFIG_SUNRPC_DEBUG=y +CONFIG_SYSFS=y +CONFIG_SYSVIPC=y +CONFIG_TARGET_CORE=m +CONFIG_TASKSTATS=y +CONFIG_TASK_IO_ACCOUNTING=y +CONFIG_TASK_XACCT=y +CONFIG_TCG_ATMEL=m +CONFIG_TCG_TIS=m +CONFIG_TCG_TIS_I2C_ATMEL=m +CONFIG_TCG_TIS_I2C_INFINEON=m +CONFIG_TCG_TIS_I2C_NUVOTON=m +CONFIG_TCG_VTPM_PROXY=m +CONFIG_TCG_XEN=m +CONFIG_TCM_FILEIO=m +CONFIG_TCM_IBLOCK=m +CONFIG_TCM_PSCSI=m +CONFIG_TCM_USER2=m +CONFIG_TCP_CONG_ADVANCED=y +CONFIG_TCP_CONG_BBR=m +# CONFIG_TCP_CONG_BIC is not set +# CONFIG_TCP_CONG_HTCP is not set +CONFIG_TCP_CONG_HYBLA=m +# CONFIG_TCP_CONG_WESTWOOD is not set +CONFIG_TCP_MD5SIG=y +CONFIG_TIGON3=m +CONFIG_TLS=m +CONFIG_TLS_DEVICE=y +CONFIG_TLS_TOE=y +CONFIG_TMPFS=y +CONFIG_TMPFS_POSIX_ACL=y +CONFIG_TRACEFS_AUTOMOUNT_DEPRECATED=n +CONFIG_TRANSPARENT_HUGEPAGE=y +CONFIG_TRUSTED_KEYS=m +CONFIG_TTY_PRINTK=y +CONFIG_TULIP=m +CONFIG_TULIP_MMIO=y +CONFIG_TULIP_NAPI=y +CONFIG_TUN=m +CONFIG_UDF_FS=m +# CONFIG_UEVENT_HELPER is not set +CONFIG_UNIX=y +CONFIG_UNIXWARE_DISKLABEL=y +CONFIG_UNIX_DIAG=m +CONFIG_USB=m +CONFIG_USB_ACM=m +CONFIG_USB_EHCI_HCD=m +CONFIG_USB_HIDDEV=y +CONFIG_USB_NET_AX8817X=m +CONFIG_USB_NET_DRIVERS=m +CONFIG_USB_OHCI_HCD=m +CONFIG_USB_RTL8152=m +CONFIG_USB_SERIAL=m +CONFIG_USB_SERIAL_CP210X=m +CONFIG_USB_SERIAL_FTDI_SIO=m +CONFIG_USB_SERIAL_GENERIC=y +CONFIG_USB_SERIAL_PL2303=m +CONFIG_USB_STORAGE=m +CONFIG_USB_UAS=m +CONFIG_USB_UHCI_HCD=m +CONFIG_USB_USBNET=m +CONFIG_USB_XHCI_HCD=m +CONFIG_USER_NS=y +CONFIG_VDPA=m +CONFIG_VETH=m +CONFIG_VFAT_FS=m +CONFIG_VFIO=m +CONFIG_VFIO_PCI=m +CONFIG_VFIO_PCI_CORE=m +CONFIG_VFIO_PCI_INTX=y +CONFIG_VHOST_IOTLB=m +CONFIG_VHOST_NET=m +CONFIG_VHOST_RING=m +CONFIG_VIA_RHINE=m +CONFIG_VIA_RHINE_MMIO=y +CONFIG_VIRTIO_BALLOON=m +CONFIG_VIRTIO_BLK=m +CONFIG_VIRTIO_CONSOLE=m +CONFIG_VIRTIO_FS=m +CONFIG_VIRTIO_INPUT=m +CONFIG_VIRTIO_MMIO=y +CONFIG_VIRTIO_MMIO_CMDLINE_DEVICES=y +CONFIG_VIRTIO_NET=m +CONFIG_VIRTIO_PCI=y +CONFIG_VIRTIO_RTC=m +CONFIG_VIRTIO_VSOCKETS=m +CONFIG_VIRT_DRIVERS=y +CONFIG_VLAN_8021Q=m +CONFIG_VLAN_8021Q_GVRP=y +CONFIG_VLAN_8021Q_MVRP=y +CONFIG_VSOCKETS=m +CONFIG_VXLAN=m +CONFIG_WATCHDOG=y +CONFIG_WIREGUARD=m +# CONFIG_WIRELESS is not set +# CONFIG_WLAN is not set +CONFIG_XEN=y +CONFIG_XENFS=m +CONFIG_XEN_BLKDEV_BACKEND=m +CONFIG_XEN_BLKDEV_FRONTEND=m +CONFIG_XEN_DEV_EVTCHN=m +CONFIG_XEN_FBDEV_FRONTEND=m +CONFIG_XEN_NETDEV_BACKEND=m +CONFIG_XEN_NETDEV_FRONTEND=m +CONFIG_XEN_SCSI_FRONTEND=m +CONFIG_XEN_WDT=m +CONFIG_XFRM=y +CONFIG_XFRM_MIGRATE=y +CONFIG_XFRM_OFFLOAD=y +CONFIG_XFRM_STATISTICS=y +CONFIG_XFRM_SUB_POLICY=y +CONFIG_XFRM_USER=m +CONFIG_XFS_FS=m +CONFIG_XFS_POSIX_ACL=y +CONFIG_XFS_QUOTA=y +# CONFIG_XZ_DEC_ARM is not set +# CONFIG_XZ_DEC_ARMTHUMB is not set +# CONFIG_XZ_DEC_IA64 is not set +# CONFIG_XZ_DEC_POWERPC is not set +# CONFIG_XZ_DEC_SPARC is not set +CONFIG_ZISOFS=y +CONFIG_ZONE_DEVICE=y +CONFIG_ZRAM=m +CONFIG_ZSMALLOC=m From efa3983888fa8f687d442d3cf908ab7b5ace4cc9 Mon Sep 17 00:00:00 2001 From: Sayan Chowdhury Date: Fri, 5 Jun 2026 12:35:17 +0530 Subject: [PATCH 3/4] sys-kernel/coreos-sources: Version bump to 6.18.26 Signed-off-by: Sayan Chowdhury --- .../sys-kernel/coreos-sources/Manifest | 2 + .../coreos-sources-6.18.26.ebuild | 45 +++++ ...1-pahole-support-reproducible-builds.patch | 26 +++ ...6-boot-Remove-the-bugger-off-message.patch | 103 +++++++++++ ...ECURE_BOOT-flag-to-indicate-secure-b.patch | 166 ++++++++++++++++++ ...ecure_boot-flag-to-indicate-secure-b.patch | 153 ++++++++++++++++ ...e-kernel-if-booted-in-secure-boot-mo.patch | 135 ++++++++++++++ ...e-kernel-if-booted-in-secure-boot-mo.patch | 121 +++++++++++++ ...sable-slram-and-phram-when-locked-do.patch | 75 ++++++++ ...Disable-when-the-kernel-is-locked-do.patch | 82 +++++++++ ...-config-option-to-lock-down-when-in-.patch | 164 +++++++++++++++++ ...s-hv-fix-cross-compilation-for-ARM64.patch | 35 ++++ 12 files changed, 1107 insertions(+) create mode 100644 sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/coreos-sources-6.18.26.ebuild create mode 100644 sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.18/z0001-pahole-support-reproducible-builds.patch create mode 100644 sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.18/z0002-Revert-x86-boot-Remove-the-bugger-off-message.patch create mode 100644 sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.18/z0003-efi-Add-an-EFI_SECURE_BOOT-flag-to-indicate-secure-b.patch create mode 100644 sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.18/z0003-efi-add-an-efi_secure_boot-flag-to-indicate-secure-b.patch create mode 100644 sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.18/z0004-efi-Lock-down-the-kernel-if-booted-in-secure-boot-mo.patch create mode 100644 sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.18/z0004-efi-lock-down-the-kernel-if-booted-in-secure-boot-mo.patch create mode 100644 sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.18/z0005-mtd-disable-slram-and-phram-when-locked-do.patch create mode 100644 sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.18/z0005-mtd-phram-slram-Disable-when-the-kernel-is-locked-do.patch create mode 100644 sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.18/z0006-arm64-add-kernel-config-option-to-lock-down-when-in-.patch create mode 100644 sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.18/z0007-tools-hv-fix-cross-compilation-for-ARM64.patch diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/Manifest b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/Manifest index e4339a8cae9..0c20b62a5fc 100644 --- a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/Manifest +++ b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/Manifest @@ -1,2 +1,4 @@ DIST linux-6.12.tar.xz 147906904 BLAKE2B b2ec2fc69218cacabbbe49f78384a5d259ca581b717617c12b000b16f4a4c59ee348ea886b37147f5f70fb9a7a01c1e2c8f19021078f6b23f5bc62d1c48d5e5e SHA512 a37b1823df7b4f72542f689b65882634740ba0401a42fdcf6601d9efd2e132e5a7650e70450ba76f6cd1f13ca31180f2ccee9d54fe4df89bc0000ade4380a548 DIST patch-6.12.101.xz 5441064 BLAKE2B 43c53214ad4455f2ef5fa618050f112a24c7e2d00004a76eec63a651f36f4e3c74e4c89f2188a61bef94735c45cde1ea82d2994a8825f065a82349e03e3178dc SHA512 e87b9b56afaa9d42703204d133094e5017f766e5d32961b2e2fe829fc845fca47619faa039653fbd3c43a1d3e7a68e1c9a9e7ad1882fc1e5885496cb66a78534 +DIST linux-6.18.tar.xz 154309096 BLAKE2B b94b7b9bf18aca0c3e50baf79b009a1448fc6cd9c3ee019f641cc247dcf53a4abef4274ee0608ad8cd4943af69854363a95d26e117ff23620bb07dccb158859f SHA512 88599ffdec96d150c1feb9b261ba93bb0301a9d0e1ad6bef7aeab1f5372cbfc57d8b43c7e902bd8f76921d1dbd8189663c142ea869e51d0e2b483b150ee00fe0 +DIST patch-6.18.26.xz 1538696 BLAKE2B 327bc85624fd2d2e6c72f42037d1b02ada8b486ff0736ef440cabbf320c1cb52e4685647a47f04507ddf933df36ea7ffbcbc8dacb32b208844d7554ed8d81a4c SHA512 e983f3c6d9ca2fe1ab878d0f7897fe398befd1819239e416e123679427c92f64f708567c2361c82d8b210c0db500088781079dd60b68584fe5fa939ceea91444 diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/coreos-sources-6.18.26.ebuild b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/coreos-sources-6.18.26.ebuild new file mode 100644 index 00000000000..87d0374887e --- /dev/null +++ b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/coreos-sources-6.18.26.ebuild @@ -0,0 +1,45 @@ +# Copyright 2026 The Flatcar Container Linux Maintainers +# Distributed under the terms of the GNU General Public License v2 + +EAPI=7 +ETYPE="sources" + +# -rc releases should be versioned L.M_rcN +# Final releases should be versioned L.M.N, even for N == 0 + +# Only needed for RCs +K_BASE_VER="5.15" + +inherit kernel-2 +EXTRAVERSION="-flatcar" +detect_version + +DESCRIPTION="Full sources for the CoreOS Linux kernel" +HOMEPAGE="http://www.kernel.org" +if [[ "${PV%%_rc*}" != "${PV}" ]]; then + SRC_URI="https://git.kernel.org/torvalds/p/v${KV%-coreos}/v${OKV} -> patch-${KV%-coreos}.patch ${KERNEL_BASE_URI}/linux-${OKV}.tar.xz" + PATCH_DIR="${FILESDIR}/${KV_MAJOR}.${KV_PATCH}" +else + SRC_URI="${KERNEL_URI}" + PATCH_DIR="${FILESDIR}/${KV_MAJOR}.${KV_MINOR}" +fi + +# make modules_prepare depends on pahole +RDEPEND="dev-util/pahole" + +KEYWORDS="amd64 arm64" +IUSE="" + +# XXX: Note we must prefix the patch filenames with "z" to ensure they are +# applied _after_ a potential patch-${KV}.patch file, present when building a +# patchlevel revision. We mustn't apply our patches first, it fails when the +# local patches overlap with the upstream patch. +UNIPATCH_LIST=" + ${PATCH_DIR}/z0001-pahole-support-reproducible-builds.patch \ + ${PATCH_DIR}/z0002-Revert-x86-boot-Remove-the-bugger-off-message.patch \ + ${PATCH_DIR}/z0003-efi-Add-an-EFI_SECURE_BOOT-flag-to-indicate-secure-b.patch \ + ${PATCH_DIR}/z0004-efi-Lock-down-the-kernel-if-booted-in-secure-boot-mo.patch \ + ${PATCH_DIR}/z0005-mtd-phram-slram-Disable-when-the-kernel-is-locked-do.patch \ + ${PATCH_DIR}/z0006-arm64-add-kernel-config-option-to-lock-down-when-in-.patch \ + ${PATCH_DIR}/z0007-tools-hv-fix-cross-compilation-for-ARM64.patch \ +" diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.18/z0001-pahole-support-reproducible-builds.patch b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.18/z0001-pahole-support-reproducible-builds.patch new file mode 100644 index 00000000000..dd815a84f3e --- /dev/null +++ b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.18/z0001-pahole-support-reproducible-builds.patch @@ -0,0 +1,26 @@ +From b8dc4700a839ff99d33b61321281368699fc6339 Mon Sep 17 00:00:00 2001 +From: Adrian Vladu +Date: Tue, 17 Sep 2024 13:44:14 +0000 +Subject: [PATCH 1/8] pahole: support reproducible builds + +--- + scripts/Makefile.btf | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/scripts/Makefile.btf b/scripts/Makefile.btf +index db76335dd917..bba03bdbbdc6 100644 +--- a/scripts/Makefile.btf ++++ b/scripts/Makefile.btf +@@ -29,6 +29,9 @@ ifneq ($(KBUILD_EXTMOD),) + module-pahole-flags-$(call test-ge, $(pahole-ver), 128) += --btf_features=distilled_base + endif + ++# Support reproducible builds. ++pahole-flags-$(call test-ge, $(pahole-ver), 127) = -j --btf_features=encode_force,var,float,enum64,decl_tag,type_tag,optimized_func,consistent_func,decl_tag_kfuncs,reproducible_build ++ + endif + + pahole-flags-$(CONFIG_PAHOLE_HAS_LANG_EXCLUDE) += --lang_exclude=rust +-- +2.51.0 + diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.18/z0002-Revert-x86-boot-Remove-the-bugger-off-message.patch b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.18/z0002-Revert-x86-boot-Remove-the-bugger-off-message.patch new file mode 100644 index 00000000000..0ce03062c03 --- /dev/null +++ b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.18/z0002-Revert-x86-boot-Remove-the-bugger-off-message.patch @@ -0,0 +1,103 @@ +From 01bcd1ecda9a9a50a97e20c7987a90cda4a0998f Mon Sep 17 00:00:00 2001 +From: Kai Lueke +Date: Fri, 15 Mar 2024 11:49:50 +0100 +Subject: [PATCH 2/8] Revert "x86/boot: Remove the 'bugger off' message" + +This reverts commit 768171d7ebbce005210e1cf8456f043304805c15 because for +now this is still needed to store the dm-verity hash. +--- + arch/x86/boot/header.S | 49 ++++++++++++++++++++++++++++++++++++++++++ + arch/x86/boot/setup.ld | 7 +++--- + 2 files changed, 52 insertions(+), 4 deletions(-) + +diff --git a/arch/x86/boot/header.S b/arch/x86/boot/header.S +index 9bea5a1e2c52..e929789e2cf4 100644 +--- a/arch/x86/boot/header.S ++++ b/arch/x86/boot/header.S +@@ -41,15 +41,64 @@ SYSSEG = 0x1000 /* historical load address >> 4 */ + + .code16 + .section ".bstext", "ax" ++ ++ .global bootsect_start ++bootsect_start: + #ifdef CONFIG_EFI_STUB + # "MZ", MS-DOS header + .word IMAGE_DOS_SIGNATURE ++#endif ++ ++ # Normalize the start address ++ ljmp $BOOTSEG, $start2 ++ ++start2: ++ movw %cs, %ax ++ movw %ax, %ds ++ movw %ax, %es ++ movw %ax, %ss ++ xorw %sp, %sp ++ sti ++ cld ++ ++ movw $bugger_off_msg, %si ++ ++msg_loop: ++ lodsb ++ andb %al, %al ++ jz bs_die ++ movb $0xe, %ah ++ movw $7, %bx ++ int $0x10 ++ jmp msg_loop ++ ++bs_die: ++ # Allow the user to press a key, then reboot ++ xorw %ax, %ax ++ int $0x16 ++ int $0x19 ++ ++ # int 0x19 should never return. In case it does anyway, ++ # invoke the BIOS reset code... ++ ljmp $0xf000,$0xfff0 ++ ++#ifdef CONFIG_EFI_STUB + .org 0x38 + # + # Offset to the PE header. + # + .long LINUX_PE_MAGIC + .long pe_header ++#endif /* CONFIG_EFI_STUB */ ++ ++ .section ".bsdata", "a" ++bugger_off_msg: ++ .ascii "Use a boot loader.\r\n" ++ .ascii "\n" ++ .ascii "Remove disk and press any key to reboot...\r\n" ++ .byte 0 ++ ++#ifdef CONFIG_EFI_STUB + pe_header: + .long IMAGE_NT_SIGNATURE + +diff --git a/arch/x86/boot/setup.ld b/arch/x86/boot/setup.ld +index e1d594a60204..f2dc13420a93 100644 +--- a/arch/x86/boot/setup.ld ++++ b/arch/x86/boot/setup.ld +@@ -10,11 +10,10 @@ ENTRY(_start) + SECTIONS + { + . = 0; +- .bstext : { +- *(.bstext) +- . = 495; +- } =0xffffffff ++ .bstext : { *(.bstext) } ++ .bsdata : { *(.bsdata) } + ++ . = 495; + .header : { *(.header) } + .entrytext : { *(.entrytext) } + .inittext : { *(.inittext) } +-- +2.51.0 + diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.18/z0003-efi-Add-an-EFI_SECURE_BOOT-flag-to-indicate-secure-b.patch b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.18/z0003-efi-Add-an-EFI_SECURE_BOOT-flag-to-indicate-secure-b.patch new file mode 100644 index 00000000000..12978a8dc0f --- /dev/null +++ b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.18/z0003-efi-Add-an-EFI_SECURE_BOOT-flag-to-indicate-secure-b.patch @@ -0,0 +1,166 @@ +From b8c17d573de9d6c4ae2da1ef51a255a128090a8c Mon Sep 17 00:00:00 2001 +From: David Howells +Date: Mon, 18 Feb 2019 12:45:03 +0000 +Subject: [PATCH 3/8] efi: Add an EFI_SECURE_BOOT flag to indicate secure boot + mode + +UEFI machines can be booted in Secure Boot mode. Add an EFI_SECURE_BOOT +flag that can be passed to efi_enabled() to find out whether secure boot is +enabled. + +Move the switch-statement in x86's setup_arch() that inteprets the +secure_boot boot parameter to generic code and set the bit there. + +Suggested-by: Ard Biesheuvel +Signed-off-by: David Howells +Reviewed-by: Ard Biesheuvel +cc: linux-efi@vger.kernel.org +[rperier: Forward-ported to 5.5: + - Use pr_warn() + - Adjust context] +[bwh: Forward-ported to 5.6: adjust context] +[bwh: Forward-ported to 5.7: + - Use the next available bit in efi.flags + - Adjust context] +--- + arch/x86/kernel/setup.c | 14 +---------- + drivers/firmware/efi/Makefile | 1 + + drivers/firmware/efi/secureboot.c | 39 +++++++++++++++++++++++++++++++ + include/linux/efi.h | 17 ++++++++------ + 4 files changed, 51 insertions(+), 20 deletions(-) + create mode 100644 drivers/firmware/efi/secureboot.c + +diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c +index 1b2edd07a3e1..41b41f677b1e 100644 +--- a/arch/x86/kernel/setup.c ++++ b/arch/x86/kernel/setup.c +@@ -1154,19 +1154,7 @@ void __init setup_arch(char **cmdline_p) + /* Allocate bigger log buffer */ + setup_log_buf(1); + +- if (efi_enabled(EFI_BOOT)) { +- switch (boot_params.secure_boot) { +- case efi_secureboot_mode_disabled: +- pr_info("Secure boot disabled\n"); +- break; +- case efi_secureboot_mode_enabled: +- pr_info("Secure boot enabled\n"); +- break; +- default: +- pr_info("Secure boot could not be determined\n"); +- break; +- } +- } ++ efi_set_secure_boot(boot_params.secure_boot); + + reserve_initrd(); + +diff --git a/drivers/firmware/efi/Makefile b/drivers/firmware/efi/Makefile +index 8efbcf699e4f..96d5a1ca981d 100644 +--- a/drivers/firmware/efi/Makefile ++++ b/drivers/firmware/efi/Makefile +@@ -25,6 +25,7 @@ subdir-$(CONFIG_EFI_STUB) += libstub + obj-$(CONFIG_EFI_BOOTLOADER_CONTROL) += efibc.o + obj-$(CONFIG_EFI_TEST) += test/ + obj-$(CONFIG_EFI_DEV_PATH_PARSER) += dev-path-parser.o ++obj-$(CONFIG_EFI) += secureboot.o + obj-$(CONFIG_APPLE_PROPERTIES) += apple-properties.o + obj-$(CONFIG_EFI_RCI2_TABLE) += rci2-table.o + obj-$(CONFIG_EFI_EMBEDDED_FIRMWARE) += embedded-firmware.o +diff --git a/drivers/firmware/efi/secureboot.c b/drivers/firmware/efi/secureboot.c +new file mode 100644 +index 000000000000..b6620669e32b +--- /dev/null ++++ b/drivers/firmware/efi/secureboot.c +@@ -0,0 +1,39 @@ ++ ++/* Core kernel secure boot support. ++ * ++ * Copyright (C) 2017 Red Hat, Inc. All Rights Reserved. ++ * Written by David Howells (dhowells@redhat.com) ++ * ++ * This program is free software; you can redistribute it and/or ++ * modify it under the terms of the GNU General Public Licence ++ * as published by the Free Software Foundation; either version ++ * 2 of the Licence, or (at your option) any later version. ++ */ ++ ++#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt ++ ++#include ++#include ++#include ++ ++/* ++ * Decide what to do when UEFI secure boot mode is enabled. ++ */ ++void __init efi_set_secure_boot(enum efi_secureboot_mode mode) ++{ ++ if (efi_enabled(EFI_BOOT)) { ++ switch (mode) { ++ case efi_secureboot_mode_disabled: ++ pr_info("Secure boot disabled\n"); ++ break; ++ case efi_secureboot_mode_enabled: ++ set_bit(EFI_SECURE_BOOT, &efi.flags); ++ pr_info("Secure boot enabled\n"); ++ break; ++ default: ++ pr_warn("Secure boot could not be determined (mode %u)\n", ++ mode); ++ break; ++ } ++ } ++} +diff --git a/include/linux/efi.h b/include/linux/efi.h +index a98cc39e7aaa..1d5f8fa07b4d 100644 +--- a/include/linux/efi.h ++++ b/include/linux/efi.h +@@ -865,6 +865,14 @@ static inline int efi_range_is_wc(unsigned long start, unsigned long len) + #define EFI_MEM_ATTR 9 /* Did firmware publish an EFI_MEMORY_ATTRIBUTES table? */ + #define EFI_MEM_NO_SOFT_RESERVE 10 /* Is the kernel configured to ignore soft reservations? */ + #define EFI_PRESERVE_BS_REGIONS 11 /* Are EFI boot-services memory segments available? */ ++#define EFI_SECURE_BOOT 12 /* Are we in Secure Boot mode? */ ++ ++enum efi_secureboot_mode { ++ efi_secureboot_mode_unset, ++ efi_secureboot_mode_unknown, ++ efi_secureboot_mode_disabled, ++ efi_secureboot_mode_enabled, ++}; + + #ifdef CONFIG_EFI + /* +@@ -889,6 +897,7 @@ static inline bool efi_rt_services_supported(unsigned int mask) + return (efi.runtime_supported_mask & mask) == mask; + } + extern void efi_find_mirror(void); ++extern void __init efi_set_secure_boot(enum efi_secureboot_mode mode); + #else + static inline bool efi_enabled(int feature) + { +@@ -908,6 +917,7 @@ static inline bool efi_rt_services_supported(unsigned int mask) + } + + static inline void efi_find_mirror(void) {} ++static inline void efi_set_secure_boot(enum efi_secureboot_mode mode) {} + #endif + + extern int efi_status_to_err(efi_status_t status); +@@ -1126,13 +1136,6 @@ static inline bool efi_runtime_disabled(void) { return true; } + extern void efi_call_virt_check_flags(unsigned long flags, const void *caller); + extern unsigned long efi_call_virt_save_flags(void); + +-enum efi_secureboot_mode { +- efi_secureboot_mode_unset, +- efi_secureboot_mode_unknown, +- efi_secureboot_mode_disabled, +- efi_secureboot_mode_enabled, +-}; +- + static inline + enum efi_secureboot_mode efi_get_secureboot_mode(efi_get_variable_t *get_var) + { +-- +2.51.0 + diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.18/z0003-efi-add-an-efi_secure_boot-flag-to-indicate-secure-b.patch b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.18/z0003-efi-add-an-efi_secure_boot-flag-to-indicate-secure-b.patch new file mode 100644 index 00000000000..822beab21c1 --- /dev/null +++ b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.18/z0003-efi-add-an-efi_secure_boot-flag-to-indicate-secure-b.patch @@ -0,0 +1,153 @@ +From: David Howells +Date: Mon, 18 Feb 2019 12:45:03 +0000 +Subject: [28/30] efi: Add an EFI_SECURE_BOOT flag to indicate secure boot mode +Origin: https://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs.git/commit?id=a5d70c55c603233c192b375f72116a395909da28 + +UEFI machines can be booted in Secure Boot mode. Add an EFI_SECURE_BOOT +flag that can be passed to efi_enabled() to find out whether secure boot is +enabled. + +Move the switch-statement in x86's setup_arch() that inteprets the +secure_boot boot parameter to generic code and set the bit there. + +Suggested-by: Ard Biesheuvel +Signed-off-by: David Howells +Reviewed-by: Ard Biesheuvel +cc: linux-efi@vger.kernel.org +[rperier: Forward-ported to 5.5: + - Use pr_warn() + - Adjust context] +[bwh: Forward-ported to 5.6: adjust context] +[bwh: Forward-ported to 5.7: + - Use the next available bit in efi.flags + - Adjust context] +--- + arch/x86/kernel/setup.c | 14 +---------- + drivers/firmware/efi/Makefile | 1 + + drivers/firmware/efi/secureboot.c | 39 +++++++++++++++++++++++++++++++ + include/linux/efi.h | 16 ++++++++----- + 4 files changed, 51 insertions(+), 19 deletions(-) + create mode 100644 drivers/firmware/efi/secureboot.c + +--- a/arch/x86/kernel/setup.c ++++ b/arch/x86/kernel/setup.c +@@ -1193,19 +1193,7 @@ void __init setup_arch(char **cmdline_p) + /* Allocate bigger log buffer */ + setup_log_buf(1); + +- if (efi_enabled(EFI_BOOT)) { +- switch (boot_params.secure_boot) { +- case efi_secureboot_mode_disabled: +- pr_info("Secure boot disabled\n"); +- break; +- case efi_secureboot_mode_enabled: +- pr_info("Secure boot enabled\n"); +- break; +- default: +- pr_info("Secure boot could not be determined\n"); +- break; +- } +- } ++ efi_set_secure_boot(boot_params.secure_boot); + + reserve_initrd(); + +--- a/drivers/firmware/efi/Makefile ++++ b/drivers/firmware/efi/Makefile +@@ -25,6 +25,7 @@ obj-$(CONFIG_EFI_FAKE_MEMMAP) += fake_m + obj-$(CONFIG_EFI_BOOTLOADER_CONTROL) += efibc.o + obj-$(CONFIG_EFI_TEST) += test/ + obj-$(CONFIG_EFI_DEV_PATH_PARSER) += dev-path-parser.o ++obj-$(CONFIG_EFI) += secureboot.o + obj-$(CONFIG_APPLE_PROPERTIES) += apple-properties.o + obj-$(CONFIG_EFI_RCI2_TABLE) += rci2-table.o + obj-$(CONFIG_EFI_EMBEDDED_FIRMWARE) += embedded-firmware.o +--- /dev/null ++++ b/drivers/firmware/efi/secureboot.c +@@ -0,0 +1,39 @@ ++ ++/* Core kernel secure boot support. ++ * ++ * Copyright (C) 2017 Red Hat, Inc. All Rights Reserved. ++ * Written by David Howells (dhowells@redhat.com) ++ * ++ * This program is free software; you can redistribute it and/or ++ * modify it under the terms of the GNU General Public Licence ++ * as published by the Free Software Foundation; either version ++ * 2 of the Licence, or (at your option) any later version. ++ */ ++ ++#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt ++ ++#include ++#include ++#include ++ ++/* ++ * Decide what to do when UEFI secure boot mode is enabled. ++ */ ++void __init efi_set_secure_boot(enum efi_secureboot_mode mode) ++{ ++ if (efi_enabled(EFI_BOOT)) { ++ switch (mode) { ++ case efi_secureboot_mode_disabled: ++ pr_info("Secure boot disabled\n"); ++ break; ++ case efi_secureboot_mode_enabled: ++ set_bit(EFI_SECURE_BOOT, &efi.flags); ++ pr_info("Secure boot enabled\n"); ++ break; ++ default: ++ pr_warn("Secure boot could not be determined (mode %u)\n", ++ mode); ++ break; ++ } ++ } ++} +--- a/include/linux/efi.h ++++ b/include/linux/efi.h +@@ -871,6 +871,14 @@ extern int __init efi_setup_pcdp_console + #define EFI_MEM_ATTR 10 /* Did firmware publish an EFI_MEMORY_ATTRIBUTES table? */ + #define EFI_MEM_NO_SOFT_RESERVE 11 /* Is the kernel configured to ignore soft reservations? */ + #define EFI_PRESERVE_BS_REGIONS 12 /* Are EFI boot-services memory segments available? */ ++#define EFI_SECURE_BOOT 13 /* Are we in Secure Boot mode? */ ++ ++enum efi_secureboot_mode { ++ efi_secureboot_mode_unset, ++ efi_secureboot_mode_unknown, ++ efi_secureboot_mode_disabled, ++ efi_secureboot_mode_enabled, ++}; + + #ifdef CONFIG_EFI + /* +@@ -895,6 +903,7 @@ static inline bool efi_rt_services_suppo + return (efi.runtime_supported_mask & mask) == mask; + } + extern void efi_find_mirror(void); ++extern void __init efi_set_secure_boot(enum efi_secureboot_mode mode); + #else + static inline bool efi_enabled(int feature) + { +@@ -914,6 +923,7 @@ static inline bool efi_rt_services_suppo + } + + static inline void efi_find_mirror(void) {} ++static inline void efi_set_secure_boot(enum efi_secureboot_mode mode) {} + #endif + + extern int efi_status_to_err(efi_status_t status); +@@ -1133,13 +1143,6 @@ static inline bool efi_runtime_disabled( + extern void efi_call_virt_check_flags(unsigned long flags, const void *caller); + extern unsigned long efi_call_virt_save_flags(void); + +-enum efi_secureboot_mode { +- efi_secureboot_mode_unset, +- efi_secureboot_mode_unknown, +- efi_secureboot_mode_disabled, +- efi_secureboot_mode_enabled, +-}; +- + static inline + enum efi_secureboot_mode efi_get_secureboot_mode(efi_get_variable_t *get_var) + { diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.18/z0004-efi-Lock-down-the-kernel-if-booted-in-secure-boot-mo.patch b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.18/z0004-efi-Lock-down-the-kernel-if-booted-in-secure-boot-mo.patch new file mode 100644 index 00000000000..6c4e43b4ba0 --- /dev/null +++ b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.18/z0004-efi-Lock-down-the-kernel-if-booted-in-secure-boot-mo.patch @@ -0,0 +1,135 @@ +From 994c5501984e4e6ef2577ba148e9aa4a023570d8 Mon Sep 17 00:00:00 2001 +From: Ben Hutchings +Date: Tue, 10 Sep 2019 11:54:28 +0100 +Subject: [PATCH 4/8] efi: Lock down the kernel if booted in secure boot mode + +Based on an earlier patch by David Howells, who wrote the following +description: + +> UEFI Secure Boot provides a mechanism for ensuring that the firmware will +> only load signed bootloaders and kernels. Certain use cases may also +> require that all kernel modules also be signed. Add a configuration option +> that to lock down the kernel - which includes requiring validly signed +> modules - if the kernel is secure-booted. + +Signed-off-by: Ben Hutchings +[Salvatore Bonaccorso: After fixing https://bugs.debian.org/956197 the +help text for LOCK_DOWN_IN_EFI_SECURE_BOOT was adjusted to mention that +lockdown is triggered in integrity mode (https://bugs.debian.org/1025417)] +Signed-off-by: Salvatore Bonaccorso +--- + arch/x86/kernel/setup.c | 4 ++-- + drivers/firmware/efi/secureboot.c | 5 +++++ + include/linux/security.h | 6 ++++++ + security/lockdown/Kconfig | 15 +++++++++++++++ + security/lockdown/lockdown.c | 2 +- + 5 files changed, 29 insertions(+), 3 deletions(-) + +diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c +index 41b41f677b1e..db2b2c2765b7 100644 +--- a/arch/x86/kernel/setup.c ++++ b/arch/x86/kernel/setup.c +@@ -991,6 +991,8 @@ void __init setup_arch(char **cmdline_p) + if (efi_enabled(EFI_BOOT)) + efi_init(); + ++ efi_set_secure_boot(boot_params.secure_boot); ++ + reserve_ibft_region(); + x86_init.resources.dmi_setup(); + +@@ -1154,8 +1156,6 @@ void __init setup_arch(char **cmdline_p) + /* Allocate bigger log buffer */ + setup_log_buf(1); + +- efi_set_secure_boot(boot_params.secure_boot); +- + reserve_initrd(); + + acpi_table_upgrade(); +diff --git a/drivers/firmware/efi/secureboot.c b/drivers/firmware/efi/secureboot.c +index b6620669e32b..8f2554291fb1 100644 +--- a/drivers/firmware/efi/secureboot.c ++++ b/drivers/firmware/efi/secureboot.c +@@ -15,6 +15,7 @@ + #include + #include + #include ++#include + + /* + * Decide what to do when UEFI secure boot mode is enabled. +@@ -28,6 +29,10 @@ void __init efi_set_secure_boot(enum efi_secureboot_mode mode) + break; + case efi_secureboot_mode_enabled: + set_bit(EFI_SECURE_BOOT, &efi.flags); ++#ifdef CONFIG_LOCK_DOWN_IN_EFI_SECURE_BOOT ++ lock_kernel_down("EFI Secure Boot", ++ LOCKDOWN_INTEGRITY_MAX); ++#endif + pr_info("Secure boot enabled\n"); + break; + default: +diff --git a/include/linux/security.h b/include/linux/security.h +index 521bcb5b9717..d139d8ce8849 100644 +--- a/include/linux/security.h ++++ b/include/linux/security.h +@@ -575,6 +575,7 @@ int security_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen); + int security_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen); + int security_inode_getsecctx(struct inode *inode, struct lsm_context *cp); + int security_locked_down(enum lockdown_reason what); ++int lock_kernel_down(const char *where, enum lockdown_reason level); + int lsm_fill_user_ctx(struct lsm_ctx __user *uctx, u32 *uctx_len, + void *val, size_t val_len, u64 id, u64 flags); + int security_bdev_alloc(struct block_device *bdev); +@@ -1588,6 +1589,11 @@ static inline int security_locked_down(enum lockdown_reason what) + { + return 0; + } ++static inline int ++lock_kernel_down(const char *where, enum lockdown_reason level) ++{ ++ return -EOPNOTSUPP; ++} + static inline int lsm_fill_user_ctx(struct lsm_ctx __user *uctx, + u32 *uctx_len, void *val, size_t val_len, + u64 id, u64 flags) +diff --git a/security/lockdown/Kconfig b/security/lockdown/Kconfig +index e84ddf484010..4175b50b1e6e 100644 +--- a/security/lockdown/Kconfig ++++ b/security/lockdown/Kconfig +@@ -45,3 +45,18 @@ config LOCK_DOWN_KERNEL_FORCE_CONFIDENTIALITY + disabled. + + endchoice ++ ++config LOCK_DOWN_IN_EFI_SECURE_BOOT ++ bool "Lock down the kernel in EFI Secure Boot mode" ++ default n ++ depends on SECURITY_LOCKDOWN_LSM ++ depends on EFI ++ select SECURITY_LOCKDOWN_LSM_EARLY ++ help ++ UEFI Secure Boot provides a mechanism for ensuring that the firmware ++ will only load signed bootloaders and kernels. Secure boot mode may ++ be determined from EFI variables provided by the system firmware if ++ not indicated by the boot parameters. ++ ++ Enabling this option results in kernel lockdown being ++ triggered in integrity mode if EFI Secure Boot is set. +diff --git a/security/lockdown/lockdown.c b/security/lockdown/lockdown.c +index cf83afa1d879..5ff10bd656d2 100644 +--- a/security/lockdown/lockdown.c ++++ b/security/lockdown/lockdown.c +@@ -24,7 +24,7 @@ static const enum lockdown_reason lockdown_levels[] = {LOCKDOWN_NONE, + /* + * Put the kernel into lock-down mode. + */ +-static int lock_kernel_down(const char *where, enum lockdown_reason level) ++int lock_kernel_down(const char *where, enum lockdown_reason level) + { + if (kernel_locked_down >= level) + return -EPERM; +-- +2.51.0 + diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.18/z0004-efi-lock-down-the-kernel-if-booted-in-secure-boot-mo.patch b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.18/z0004-efi-lock-down-the-kernel-if-booted-in-secure-boot-mo.patch new file mode 100644 index 00000000000..6fff3f89675 --- /dev/null +++ b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.18/z0004-efi-lock-down-the-kernel-if-booted-in-secure-boot-mo.patch @@ -0,0 +1,121 @@ +From: Ben Hutchings +Date: Tue, 10 Sep 2019 11:54:28 +0100 +Subject: efi: Lock down the kernel if booted in secure boot mode + +Based on an earlier patch by David Howells, who wrote the following +description: + +> UEFI Secure Boot provides a mechanism for ensuring that the firmware will +> only load signed bootloaders and kernels. Certain use cases may also +> require that all kernel modules also be signed. Add a configuration option +> that to lock down the kernel - which includes requiring validly signed +> modules - if the kernel is secure-booted. + +Signed-off-by: Ben Hutchings +[Salvatore Bonaccorso: After fixing https://bugs.debian.org/956197 the +help text for LOCK_DOWN_IN_EFI_SECURE_BOOT was adjusted to mention that +lockdown is triggered in integrity mode (https://bugs.debian.org/1025417)] +Signed-off-by: Salvatore Bonaccorso +--- + arch/x86/kernel/setup.c | 4 ++-- + drivers/firmware/efi/secureboot.c | 3 +++ + include/linux/security.h | 6 ++++++ + security/lockdown/Kconfig | 15 +++++++++++++++ + security/lockdown/lockdown.c | 2 +- + 5 files changed, 27 insertions(+), 3 deletions(-) + +--- a/arch/x86/kernel/setup.c ++++ b/arch/x86/kernel/setup.c +@@ -904,6 +904,8 @@ void __init setup_arch(char **cmdline_p) + if (efi_enabled(EFI_BOOT)) + efi_init(); + ++ efi_set_secure_boot(boot_params.secure_boot); ++ + reserve_ibft_region(); + x86_init.resources.dmi_setup(); + +@@ -1070,8 +1072,6 @@ void __init setup_arch(char **cmdline_p) + /* Allocate bigger log buffer */ + setup_log_buf(1); + +- efi_set_secure_boot(boot_params.secure_boot); +- + reserve_initrd(); + + acpi_table_upgrade(); +--- a/drivers/firmware/efi/secureboot.c ++++ b/drivers/firmware/efi/secureboot.c +@@ -15,6 +15,7 @@ + #include + #include + #include ++#include + + /* + * Decide what to do when UEFI secure boot mode is enabled. +@@ -28,6 +29,10 @@ void __init efi_set_secure_boot(enum efi + break; + case efi_secureboot_mode_enabled: + set_bit(EFI_SECURE_BOOT, &efi.flags); ++#ifdef CONFIG_LOCK_DOWN_IN_EFI_SECURE_BOOT ++ lock_kernel_down("EFI Secure Boot", ++ LOCKDOWN_INTEGRITY_MAX); ++#endif + pr_info("Secure boot enabled\n"); + break; + default: +--- a/include/linux/security.h ++++ b/include/linux/security.h +@@ -522,6 +522,7 @@ int security_inode_notifysecctx(struct i + int security_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen); + int security_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen); + int security_locked_down(enum lockdown_reason what); ++int lock_kernel_down(const char *where, enum lockdown_reason level); + int lsm_fill_user_ctx(struct lsm_ctx __user *uctx, u32 *uctx_len, + void *val, size_t val_len, u64 id, u64 flags); + int security_bdev_alloc(struct block_device *bdev); +@@ -1504,6 +1505,11 @@ static inline int security_locked_down(e + { + return 0; + } ++static inline int ++lock_kernel_down(const char *where, enum lockdown_reason level) ++{ ++ return -EOPNOTSUPP; ++} + static inline int lsm_fill_user_ctx(struct lsm_ctx __user *uctx, + u32 *uctx_len, void *val, size_t val_len, + u64 id, u64 flags) +--- a/security/lockdown/Kconfig ++++ b/security/lockdown/Kconfig +@@ -45,3 +45,18 @@ config LOCK_DOWN_KERNEL_FORCE_CONFIDENTI + disabled. + + endchoice ++ ++config LOCK_DOWN_IN_EFI_SECURE_BOOT ++ bool "Lock down the kernel in EFI Secure Boot mode" ++ default n ++ depends on SECURITY_LOCKDOWN_LSM ++ depends on EFI ++ select SECURITY_LOCKDOWN_LSM_EARLY ++ help ++ UEFI Secure Boot provides a mechanism for ensuring that the firmware ++ will only load signed bootloaders and kernels. Secure boot mode may ++ be determined from EFI variables provided by the system firmware if ++ not indicated by the boot parameters. ++ ++ Enabling this option results in kernel lockdown being ++ triggered in integrity mode if EFI Secure Boot is set. +--- a/security/lockdown/lockdown.c ++++ b/security/lockdown/lockdown.c +@@ -24,7 +24,7 @@ static const enum lockdown_reason lockdo + /* + * Put the kernel into lock-down mode. + */ +-static int lock_kernel_down(const char *where, enum lockdown_reason level) ++int lock_kernel_down(const char *where, enum lockdown_reason level) + { + if (kernel_locked_down >= level) + return -EPERM; diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.18/z0005-mtd-disable-slram-and-phram-when-locked-do.patch b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.18/z0005-mtd-disable-slram-and-phram-when-locked-do.patch new file mode 100644 index 00000000000..c718e7e2f02 --- /dev/null +++ b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.18/z0005-mtd-disable-slram-and-phram-when-locked-do.patch @@ -0,0 +1,75 @@ +From: Ben Hutchings +Date: Fri, 30 Aug 2019 15:54:24 +0100 +Subject: mtd: phram,slram: Disable when the kernel is locked down +Forwarded: https://lore.kernel.org/linux-security-module/20190830154720.eekfjt6c4jzvlbfz@decadent.org.uk/ + +These drivers allow mapping arbitrary memory ranges as MTD devices. +This should be disabled to preserve the kernel's integrity when it is +locked down. + +* Add the HWPARAM flag to the module parameters +* When slram is built-in, it uses __setup() to read kernel parameters, + so add an explicit check security_locked_down() check + +Signed-off-by: Ben Hutchings +Cc: Matthew Garrett +Cc: David Howells +Cc: Joern Engel +Cc: linux-mtd@lists.infradead.org +--- + drivers/mtd/devices/phram.c | 6 +++++- + drivers/mtd/devices/slram.c | 9 ++++++++- + 2 files changed, 13 insertions(+), 2 deletions(-) + +--- a/drivers/mtd/devices/phram.c ++++ b/drivers/mtd/devices/phram.c +@@ -364,7 +364,11 @@ static int phram_param_call(const char * + #endif + } + +-module_param_call(phram, phram_param_call, NULL, NULL, 0200); ++static const struct kernel_param_ops phram_param_ops = { ++ .set = phram_param_call ++}; ++__module_param_call(MODULE_PARAM_PREFIX, phram, &phram_param_ops, NULL, ++ 0200, -1, KERNEL_PARAM_FL_HWPARAM | hwparam_iomem); + MODULE_PARM_DESC(phram, "Memory region to map. \"phram=,,[,]\""); + + #ifdef CONFIG_OF +--- a/drivers/mtd/devices/slram.c ++++ b/drivers/mtd/devices/slram.c +@@ -43,6 +43,7 @@ + #include + #include + #include ++#include + + #include + +@@ -65,7 +66,7 @@ typedef struct slram_mtd_list { + #ifdef MODULE + static char *map[SLRAM_MAX_DEVICES_PARAMS]; + +-module_param_array(map, charp, NULL, 0); ++module_param_hw_array(map, charp, iomem, NULL, 0); + MODULE_PARM_DESC(map, "List of memory regions to map. \"map=, , \""); + #else + static char *map; +@@ -281,11 +282,17 @@ static int __init init_slram(void) + #ifndef MODULE + char *devstart; + char *devlength; ++ int ret; + + if (!map) { + E("slram: not enough parameters.\n"); + return(-EINVAL); + } ++ ++ ret = security_locked_down(LOCKDOWN_MODULE_PARAMETERS); ++ if (ret) ++ return ret; ++ + while (map) { + devname = devstart = devlength = NULL; + diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.18/z0005-mtd-phram-slram-Disable-when-the-kernel-is-locked-do.patch b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.18/z0005-mtd-phram-slram-Disable-when-the-kernel-is-locked-do.patch new file mode 100644 index 00000000000..6b62bcb57d8 --- /dev/null +++ b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.18/z0005-mtd-phram-slram-Disable-when-the-kernel-is-locked-do.patch @@ -0,0 +1,82 @@ +From 06ae62500c1e2bb641b8f16eb9313a41c4061ab9 Mon Sep 17 00:00:00 2001 +From: Ben Hutchings +Date: Fri, 30 Aug 2019 15:54:24 +0100 +Subject: [PATCH 5/8] mtd: phram,slram: Disable when the kernel is locked down + +These drivers allow mapping arbitrary memory ranges as MTD devices. +This should be disabled to preserve the kernel's integrity when it is +locked down. + +* Add the HWPARAM flag to the module parameters +* When slram is built-in, it uses __setup() to read kernel parameters, + so add an explicit check security_locked_down() check + +Signed-off-by: Ben Hutchings +Cc: Matthew Garrett +Cc: David Howells +Cc: Joern Engel +Cc: linux-mtd@lists.infradead.org +--- + drivers/mtd/devices/phram.c | 6 +++++- + drivers/mtd/devices/slram.c | 9 ++++++++- + 2 files changed, 13 insertions(+), 2 deletions(-) + +diff --git a/drivers/mtd/devices/phram.c b/drivers/mtd/devices/phram.c +index fd9ec165e61a..8652139ecbe9 100644 +--- a/drivers/mtd/devices/phram.c ++++ b/drivers/mtd/devices/phram.c +@@ -365,7 +365,11 @@ static int phram_param_call(const char *val, const struct kernel_param *kp) + #endif + } + +-module_param_call(phram, phram_param_call, NULL, NULL, 0200); ++static const struct kernel_param_ops phram_param_ops = { ++ .set = phram_param_call ++}; ++__module_param_call(MODULE_PARAM_PREFIX, phram, &phram_param_ops, NULL, ++ 0200, -1, KERNEL_PARAM_FL_HWPARAM | hwparam_iomem); + MODULE_PARM_DESC(phram, "Memory region to map. \"phram=,,[,]\""); + + #ifdef CONFIG_OF +diff --git a/drivers/mtd/devices/slram.c b/drivers/mtd/devices/slram.c +index 8297b366a066..9f762d988c0b 100644 +--- a/drivers/mtd/devices/slram.c ++++ b/drivers/mtd/devices/slram.c +@@ -43,6 +43,7 @@ + #include + #include + #include ++#include + + #include + +@@ -65,7 +66,7 @@ typedef struct slram_mtd_list { + #ifdef MODULE + static char *map[SLRAM_MAX_DEVICES_PARAMS]; + +-module_param_array(map, charp, NULL, 0); ++module_param_hw_array(map, charp, iomem, NULL, 0); + MODULE_PARM_DESC(map, "List of memory regions to map. \"map=, , \""); + #else + static char *map; +@@ -281,11 +282,17 @@ static int __init init_slram(void) + #ifndef MODULE + char *devstart; + char *devlength; ++ int ret; + + if (!map) { + E("slram: not enough parameters.\n"); + return(-EINVAL); + } ++ ++ ret = security_locked_down(LOCKDOWN_MODULE_PARAMETERS); ++ if (ret) ++ return ret; ++ + while (map) { + devname = devstart = devlength = NULL; + +-- +2.51.0 + diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.18/z0006-arm64-add-kernel-config-option-to-lock-down-when-in-.patch b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.18/z0006-arm64-add-kernel-config-option-to-lock-down-when-in-.patch new file mode 100644 index 00000000000..62be9cbd0d5 --- /dev/null +++ b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.18/z0006-arm64-add-kernel-config-option-to-lock-down-when-in-.patch @@ -0,0 +1,164 @@ +From ddb2f010a8a881d181bce3b8961ad92117f4e8bb Mon Sep 17 00:00:00 2001 +From: Linn Crosetto +Date: Tue, 30 Aug 2016 11:54:38 -0600 +Subject: [PATCH 6/8] arm64: add kernel config option to lock down when in + Secure Boot mode + +Add a kernel configuration option to lock down the kernel, to restrict +userspace's ability to modify the running kernel when UEFI Secure Boot is +enabled. Based on the x86 patch by Matthew Garrett. + +Determine the state of Secure Boot in the EFI stub and pass this to the +kernel using the FDT. + +Signed-off-by: Linn Crosetto +[bwh: Forward-ported to 4.10: adjust context] +[Lukas Wunner: Forward-ported to 4.11: drop parts applied upstream] +[bwh: Forward-ported to 4.15 and lockdown patch set: + - Pass result of efi_get_secureboot() in stub through to + efi_set_secure_boot() in main kernel + - Use lockdown API and naming] +[bwh: Forward-ported to 4.19.3: adjust context in update_fdt()] +[dannf: Moved init_lockdown() call after uefi_init(), fixing SB detection] +[bwh: Drop call to init_lockdown(), as efi_set_secure_boot() now calls this] +[bwh: Forward-ported to 5.6: efi_get_secureboot() no longer takes a + sys_table parameter] +[bwh: Forward-ported to 5.7: EFI initialisation from FDT was rewritten, so: + - Add Secure Boot mode to the parameter enumeration in fdtparams.c + - Add a parameter to efi_get_fdt_params() to return the Secure Boot mode + - Since Xen does not have a property name defined for Secure Boot mode, + change efi_get_fdt_prop() to handle a missing property name by clearing + the output variable] +[Salvatore Bonaccorso: Forward-ported to 5.10: f30f242fb131 ("efi: Rename +arm-init to efi-init common for all arch") renamed arm-init.c to efi-init.c] +--- + drivers/firmware/efi/efi-init.c | 5 ++++- + drivers/firmware/efi/fdtparams.c | 12 +++++++++++- + drivers/firmware/efi/libstub/fdt.c | 6 ++++++ + include/linux/efi.h | 3 ++- + 4 files changed, 23 insertions(+), 3 deletions(-) + +diff --git a/drivers/firmware/efi/efi-init.c b/drivers/firmware/efi/efi-init.c +index a00e07b853f2..8a0390d8da98 100644 +--- a/drivers/firmware/efi/efi-init.c ++++ b/drivers/firmware/efi/efi-init.c +@@ -213,9 +213,10 @@ void __init efi_init(void) + { + struct efi_memory_map_data data; + u64 efi_system_table; ++ u32 secure_boot; + + /* Grab UEFI information placed in FDT by stub */ +- efi_system_table = efi_get_fdt_params(&data); ++ efi_system_table = efi_get_fdt_params(&data, &secure_boot); + if (!efi_system_table) + return; + +@@ -237,6 +238,8 @@ void __init efi_init(void) + return; + } + ++ efi_set_secure_boot(secure_boot); ++ + reserve_regions(); + /* + * For memblock manipulation, the cap should come after the memblock_add(). +diff --git a/drivers/firmware/efi/fdtparams.c b/drivers/firmware/efi/fdtparams.c +index b815d2a754ee..69a2eb539d38 100644 +--- a/drivers/firmware/efi/fdtparams.c ++++ b/drivers/firmware/efi/fdtparams.c +@@ -16,6 +16,7 @@ enum { + MMSIZE, + DCSIZE, + DCVERS, ++ SBMODE, + + PARAMCOUNT + }; +@@ -26,6 +27,7 @@ static __initconst const char name[][22] = { + [MMSIZE] = "MemMap Size ", + [DCSIZE] = "MemMap Desc. Size ", + [DCVERS] = "MemMap Desc. Version ", ++ [SBMODE] = "Secure Boot Enabled ", + }; + + static __initconst const struct { +@@ -43,6 +45,7 @@ static __initconst const struct { + [MMSIZE] = "xen,uefi-mmap-size", + [DCSIZE] = "xen,uefi-mmap-desc-size", + [DCVERS] = "xen,uefi-mmap-desc-ver", ++ [SBMODE] = "", + } + }, { + #endif +@@ -53,6 +56,7 @@ static __initconst const struct { + [MMSIZE] = "linux,uefi-mmap-size", + [DCSIZE] = "linux,uefi-mmap-desc-size", + [DCVERS] = "linux,uefi-mmap-desc-ver", ++ [SBMODE] = "linux,uefi-secure-boot", + } + } + }; +@@ -64,6 +68,11 @@ static int __init efi_get_fdt_prop(const void *fdt, int node, const char *pname, + int len; + u64 val; + ++ if (!pname[0]) { ++ memset(var, 0, size); ++ return 0; ++ } ++ + prop = fdt_getprop(fdt, node, pname, &len); + if (!prop) + return 1; +@@ -81,7 +90,7 @@ static int __init efi_get_fdt_prop(const void *fdt, int node, const char *pname, + return 0; + } + +-u64 __init efi_get_fdt_params(struct efi_memory_map_data *mm) ++u64 __init efi_get_fdt_params(struct efi_memory_map_data *mm, u32 *secure_boot) + { + const void *fdt = initial_boot_params; + unsigned long systab; +@@ -95,6 +104,7 @@ u64 __init efi_get_fdt_params(struct efi_memory_map_data *mm) + [MMSIZE] = { &mm->size, sizeof(mm->size) }, + [DCSIZE] = { &mm->desc_size, sizeof(mm->desc_size) }, + [DCVERS] = { &mm->desc_version, sizeof(mm->desc_version) }, ++ [SBMODE] = { secure_boot, sizeof(*secure_boot) }, + }; + + BUILD_BUG_ON(ARRAY_SIZE(target) != ARRAY_SIZE(name)); +diff --git a/drivers/firmware/efi/libstub/fdt.c b/drivers/firmware/efi/libstub/fdt.c +index 6a337f1f8787..6c679da644dd 100644 +--- a/drivers/firmware/efi/libstub/fdt.c ++++ b/drivers/firmware/efi/libstub/fdt.c +@@ -132,6 +132,12 @@ static efi_status_t update_fdt(void *orig_fdt, unsigned long orig_fdt_size, + } + } + ++ fdt_val32 = cpu_to_fdt32(efi_get_secureboot()); ++ status = fdt_setprop(fdt, node, "linux,uefi-secure-boot", ++ &fdt_val32, sizeof(fdt_val32)); ++ if (status) ++ goto fdt_set_fail; ++ + /* Shrink the FDT back to its minimum size: */ + fdt_pack(fdt); + +diff --git a/include/linux/efi.h b/include/linux/efi.h +index 1d5f8fa07b4d..6e826b53a0ce 100644 +--- a/include/linux/efi.h ++++ b/include/linux/efi.h +@@ -755,7 +755,8 @@ extern int efi_mem_desc_lookup(u64 phys_addr, efi_memory_desc_t *out_md); + extern int __efi_mem_desc_lookup(u64 phys_addr, efi_memory_desc_t *out_md); + extern void efi_mem_reserve(phys_addr_t addr, u64 size); + extern int efi_mem_reserve_persistent(phys_addr_t addr, u64 size); +-extern u64 efi_get_fdt_params(struct efi_memory_map_data *data); ++extern u64 efi_get_fdt_params(struct efi_memory_map_data *data, ++ u32 *secure_boot); + extern struct kobject *efi_kobj; + + extern int efi_reboot_quirk_mode; +-- +2.51.0 + diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.18/z0007-tools-hv-fix-cross-compilation-for-ARM64.patch b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.18/z0007-tools-hv-fix-cross-compilation-for-ARM64.patch new file mode 100644 index 00000000000..eed99bf2f49 --- /dev/null +++ b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.18/z0007-tools-hv-fix-cross-compilation-for-ARM64.patch @@ -0,0 +1,35 @@ +From 52fe3ead528c899b7db29870c97d25cec0671625 Mon Sep 17 00:00:00 2001 +From: Adrian Vladu +Date: Thu, 19 Sep 2024 07:59:59 +0000 +Subject: [PATCH 7/8] tools: hv: fix cross-compilation for ARM64 + +--- + tools/hv/Makefile | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/tools/hv/Makefile b/tools/hv/Makefile +index 34ffcec264ab..7a7ece3cdf03 100644 +--- a/tools/hv/Makefile ++++ b/tools/hv/Makefile +@@ -2,7 +2,9 @@ + # Makefile for Hyper-V tools + include ../scripts/Makefile.include + ++ifeq ($(ARCH),) + ARCH := $(shell uname -m 2>/dev/null) ++endif + sbindir ?= /usr/sbin + libexecdir ?= /usr/libexec + sharedstatedir ?= /var/lib +@@ -20,7 +22,7 @@ override CFLAGS += -O2 -Wall -g -D_GNU_SOURCE -I$(OUTPUT)include + override CFLAGS += -Wno-address-of-packed-member + + ALL_TARGETS := hv_kvp_daemon hv_vss_daemon +-ifneq ($(ARCH), aarch64) ++ifeq ($(filter $(ARCH),aarch64 arm64),) + ALL_TARGETS += hv_fcopy_uio_daemon + endif + ALL_PROGRAMS := $(patsubst %,$(OUTPUT)%,$(ALL_TARGETS)) +-- +2.51.0 + From 8c7ac50c0a5d33325501516f438caba3fce164fd Mon Sep 17 00:00:00 2001 From: Sayan Chowdhury Date: Thu, 18 Jun 2026 13:47:28 +0530 Subject: [PATCH 4/4] x11-drivers/old-nvidia-drivers: Adjust the patches for 550 for Linux 6.18 Signed-off-by: Sayan Chowdhury --- .../coreos-modules/files/commonconfig-6.18 | 1 + ...reset-to-avoid-GPL-only-vma_start_wr.patch | 155 ++++++++++ ...63.01-pass-drm_format_info-to-nv_drm.patch | 280 ++++++++++++++++++ ...dia-use-hrtimer_setup-for-Linux-6.15.patch | 44 +++ ...-iommu_dev_enable_disable_feature-fo.patch | 91 ++++++ ...d-SMMU-WAR-code-with-UVM_ATS_SMMU_WA.patch | 121 ++++++++ .../old-nvidia-drivers-550.163.01-r2.ebuild | 31 +- 7 files changed, 722 insertions(+), 1 deletion(-) create mode 100644 sdk_container/src/third_party/coreos-overlay/x11-drivers/old-nvidia-drivers/files/0001-mm-use-vm_flags_reset-to-avoid-GPL-only-vma_start_wr.patch create mode 100644 sdk_container/src/third_party/coreos-overlay/x11-drivers/old-nvidia-drivers/files/0002-nvidia-drm-550.163.01-pass-drm_format_info-to-nv_drm.patch create mode 100644 sdk_container/src/third_party/coreos-overlay/x11-drivers/old-nvidia-drivers/files/0003-nvidia-use-hrtimer_setup-for-Linux-6.15.patch create mode 100644 sdk_container/src/third_party/coreos-overlay/x11-drivers/old-nvidia-drivers/files/0004-nvidia-uvm-guard-iommu_dev_enable_disable_feature-fo.patch create mode 100644 sdk_container/src/third_party/coreos-overlay/x11-drivers/old-nvidia-drivers/files/0005-nvidia-uvm-guard-SMMU-WAR-code-with-UVM_ATS_SMMU_WA.patch diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/files/commonconfig-6.18 b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/files/commonconfig-6.18 index 21b99c081b2..05a5bb86727 100644 --- a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/files/commonconfig-6.18 +++ b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/files/commonconfig-6.18 @@ -128,6 +128,7 @@ CONFIG_CPU_FREQ_GOV_USERSPACE=m CONFIG_CPU_FREQ_STAT=y # CONFIG_CROSS_MEMORY_ATTACH is not set CONFIG_CRYPTO_AES=m +CONFIG_CRYPTO_CRC32C=y CONFIG_CRYPTO_CTR=m CONFIG_CRYPTO_CTS=m CONFIG_CRYPTO_DES=m diff --git a/sdk_container/src/third_party/coreos-overlay/x11-drivers/old-nvidia-drivers/files/0001-mm-use-vm_flags_reset-to-avoid-GPL-only-vma_start_wr.patch b/sdk_container/src/third_party/coreos-overlay/x11-drivers/old-nvidia-drivers/files/0001-mm-use-vm_flags_reset-to-avoid-GPL-only-vma_start_wr.patch new file mode 100644 index 00000000000..32c494fc3e3 --- /dev/null +++ b/sdk_container/src/third_party/coreos-overlay/x11-drivers/old-nvidia-drivers/files/0001-mm-use-vm_flags_reset-to-avoid-GPL-only-vma_start_wr.patch @@ -0,0 +1,155 @@ +From d1154945f8b2d22392d30a5e522612dfbcf17cff Mon Sep 17 00:00:00 2001 +From: Sayan Chowdhury +Date: Wed, 17 Jun 2026 15:48:55 +0530 +Subject: [PATCH 1/2] mm: use vm_flags_reset to avoid GPL-only + vma_start_write() + +Linux 6.15 made vma_start_write() GPL-only, which nv_vm_flags_set/clear +depend on via vm_flags_set/vm_flags_clear. Redefine them using +vm_flags_reset which carries no such restriction. + +Applied to both the proprietary kernel/ and open-source kernel-open/ trees. + +Signed-off-by: Sayan Chowdhury +--- + kernel-open/nvidia-drm/nvidia-drm-gem-user-memory.c | 7 +++++++ + kernel-open/nvidia-drm/nvidia-drm-gem.c | 7 +++++++ + kernel-open/nvidia/nv-mmap.c | 7 +++++++ + kernel/nvidia-drm/nvidia-drm-gem-user-memory.c | 7 +++++++ + kernel/nvidia-drm/nvidia-drm-gem.c | 7 +++++++ + kernel/nvidia/nv-mmap.c | 7 +++++++ + 6 files changed, 42 insertions(+) + +diff --git a/kernel-module-source/kernel-open/nvidia-drm/nvidia-drm-gem-user-memory.c b/kernel-module-source/kernel-open/nvidia-drm/nvidia-drm-gem-user-memory.c +index 9d2a0512..e473b66f 100644 +--- a/kernel-module-source/kernel-open/nvidia-drm/nvidia-drm-gem-user-memory.c ++++ b/kernel-module-source/kernel-open/nvidia-drm/nvidia-drm-gem-user-memory.c +@@ -40,6 +40,13 @@ + #include + #endif + ++#include ++ ++#if LINUX_VERSION_CODE >= KERNEL_VERSION(6, 15, 0) ++#define nv_vm_flags_set(vma, f) vm_flags_reset((vma), (vma)->vm_flags | (f)) ++#define nv_vm_flags_clear(vma, f) vm_flags_reset((vma), (vma)->vm_flags & ~(f)) ++#endif ++ + static inline + void __nv_drm_gem_user_memory_free(struct nv_drm_gem_object *nv_gem) + { +diff --git a/kernel-module-source/kernel-open/nvidia-drm/nvidia-drm-gem.c b/kernel-module-source/kernel-open/nvidia-drm/nvidia-drm-gem.c +index ef0e0f83..c8489a72 100644 +--- a/kernel-module-source/kernel-open/nvidia-drm/nvidia-drm-gem.c ++++ b/kernel-module-source/kernel-open/nvidia-drm/nvidia-drm-gem.c +@@ -51,6 +51,13 @@ + + #include "nv-mm.h" + ++#include ++ ++#if LINUX_VERSION_CODE >= KERNEL_VERSION(6, 15, 0) ++#define nv_vm_flags_set(vma, f) vm_flags_reset((vma), (vma)->vm_flags | (f)) ++#define nv_vm_flags_clear(vma, f) vm_flags_reset((vma), (vma)->vm_flags & ~(f)) ++#endif ++ + void nv_drm_gem_free(struct drm_gem_object *gem) + { + struct nv_drm_gem_object *nv_gem = to_nv_gem_object(gem); +diff --git a/kernel-module-source/kernel-open/nvidia/nv-mmap.c b/kernel-module-source/kernel-open/nvidia/nv-mmap.c +index 8e98c817..f72731c0 100644 +--- a/kernel-module-source/kernel-open/nvidia/nv-mmap.c ++++ b/kernel-module-source/kernel-open/nvidia/nv-mmap.c +@@ -25,6 +25,13 @@ + + #include "os-interface.h" + #include "nv-linux.h" ++ ++#include ++ ++#if LINUX_VERSION_CODE >= KERNEL_VERSION(6, 15, 0) ++#define nv_vm_flags_set(vma, f) vm_flags_reset((vma), (vma)->vm_flags | (f)) ++#define nv_vm_flags_clear(vma, f) vm_flags_reset((vma), (vma)->vm_flags & ~(f)) ++#endif + #include "nv_speculation_barrier.h" + + /* +diff --git a/kernel-module-source/kernel-open/nvidia-uvm/uvm.c b/kernel-module-source/kernel-open/nvidia-uvm/uvm.c +index 1a2b3c4d..5e6f7a8b 100644 +--- a/kernel-module-source/kernel-open/nvidia-uvm/uvm.c ++++ b/kernel-module-source/kernel-open/nvidia-uvm/uvm.c +@@ -21,6 +21,8 @@ + + *******************************************************************************/ + ++#include ++ + #include "uvm_api.h" + #include "uvm_global.h" + #include "uvm_gpu_replayable_faults.h" +@@ -40,4 +42,9 @@ + + #define NVIDIA_UVM_DEVICE_NAME "nvidia-uvm" + ++#if LINUX_VERSION_CODE >= KERNEL_VERSION(6, 15, 0) ++#define nv_vm_flags_set(v, f) vm_flags_reset((v), (v)->vm_flags | (f)) ++#define nv_vm_flags_clear(v, f) vm_flags_reset((v), (v)->vm_flags & ~(f)) ++#endif ++ + static dev_t g_uvm_base_dev; +diff --git a/kernel/nvidia-drm/nvidia-drm-gem-user-memory.c b/kernel/nvidia-drm/nvidia-drm-gem-user-memory.c +index 9d2a0512..e473b66f 100644 +--- a/kernel/nvidia-drm/nvidia-drm-gem-user-memory.c ++++ b/kernel/nvidia-drm/nvidia-drm-gem-user-memory.c +@@ -40,6 +40,13 @@ + #include + #endif + ++#include ++ ++#if LINUX_VERSION_CODE >= KERNEL_VERSION(6, 15, 0) ++#define nv_vm_flags_set(vma, f) vm_flags_reset((vma), (vma)->vm_flags | (f)) ++#define nv_vm_flags_clear(vma, f) vm_flags_reset((vma), (vma)->vm_flags & ~(f)) ++#endif ++ + static inline + void __nv_drm_gem_user_memory_free(struct nv_drm_gem_object *nv_gem) + { +diff --git a/kernel/nvidia-drm/nvidia-drm-gem.c b/kernel/nvidia-drm/nvidia-drm-gem.c +index ef0e0f83..c8489a72 100644 +--- a/kernel/nvidia-drm/nvidia-drm-gem.c ++++ b/kernel/nvidia-drm/nvidia-drm-gem.c +@@ -51,6 +51,13 @@ + + #include "nv-mm.h" + ++#include ++ ++#if LINUX_VERSION_CODE >= KERNEL_VERSION(6, 15, 0) ++#define nv_vm_flags_set(vma, f) vm_flags_reset((vma), (vma)->vm_flags | (f)) ++#define nv_vm_flags_clear(vma, f) vm_flags_reset((vma), (vma)->vm_flags & ~(f)) ++#endif ++ + void nv_drm_gem_free(struct drm_gem_object *gem) + { + struct nv_drm_gem_object *nv_gem = to_nv_gem_object(gem); +diff --git a/kernel/nvidia/nv-mmap.c b/kernel/nvidia/nv-mmap.c +index 8e98c817..f72731c0 100644 +--- a/kernel/nvidia/nv-mmap.c ++++ b/kernel/nvidia/nv-mmap.c +@@ -25,6 +25,13 @@ + + #include "os-interface.h" + #include "nv-linux.h" ++ ++#include ++ ++#if LINUX_VERSION_CODE >= KERNEL_VERSION(6, 15, 0) ++#define nv_vm_flags_set(vma, f) vm_flags_reset((vma), (vma)->vm_flags | (f)) ++#define nv_vm_flags_clear(vma, f) vm_flags_reset((vma), (vma)->vm_flags & ~(f)) ++#endif + #include "nv_speculation_barrier.h" + + /* +-- +2.53.0 diff --git a/sdk_container/src/third_party/coreos-overlay/x11-drivers/old-nvidia-drivers/files/0002-nvidia-drm-550.163.01-pass-drm_format_info-to-nv_drm.patch b/sdk_container/src/third_party/coreos-overlay/x11-drivers/old-nvidia-drivers/files/0002-nvidia-drm-550.163.01-pass-drm_format_info-to-nv_drm.patch new file mode 100644 index 00000000000..34aa1d59103 --- /dev/null +++ b/sdk_container/src/third_party/coreos-overlay/x11-drivers/old-nvidia-drivers/files/0002-nvidia-drm-550.163.01-pass-drm_format_info-to-nv_drm.patch @@ -0,0 +1,280 @@ +From 828e2d5aa8808f34030a726fb5f1038ea474add7 Mon Sep 17 00:00:00 2001 +From: Sayan Chowdhury +Date: Wed, 17 Jun 2026 16:45:03 +0530 +Subject: [PATCH 2/2] nvidia-drm 550.163.01: pass drm_format_info to + nv_drm_framebuffer_create for Linux 6.17+ + +Linux kernel commit 81112eaac559 ("drm: Pass the format info to +.fb_create()") changed drm_mode_config_funcs.fb_create to take a 4th +argument: const struct drm_format_info *info + +This landed in v6.17-rc1; we hit it while updating our build target +to Linux 6.18, which carries the same API forward. + +Simultaneously, drm_helper_mode_fill_fb_struct() gained the same +parameter between the framebuffer and the mode_cmd arguments (4 args +total with dev). + +Use a conftest probe (NV_DRM_FB_CREATE_TAKES_FORMAT_INFO) rather than +a hardcoded LINUX_VERSION_CODE check, since this detects the feature +directly against the actual kernel headers and remains correct for +backports or non-standard kernel versioning. + +Applied to both the proprietary kernel/ and open-source kernel-open/ trees. + +Signed-off-by: Sayan Chowdhury +--- + kernel-open/conftest.sh | 19 +++++++++++++++++++ + kernel-open/nvidia-drm/nvidia-drm-drv.c | 6 ++++++ + kernel-open/nvidia-drm/nvidia-drm-fb.c | 7 +++++++ + kernel-open/nvidia-drm/nvidia-drm-fb.h | 4 ++++ + kernel-open/nvidia-drm/nvidia-drm-sources.mk | 1 + + kernel/conftest.sh | 19 +++++++++++++++++++ + kernel/nvidia-drm/nvidia-drm-drv.c | 6 ++++++ + kernel/nvidia-drm/nvidia-drm-fb.c | 7 +++++++ + kernel/nvidia-drm/nvidia-drm-fb.h | 4 ++++ + kernel/nvidia-drm/nvidia-drm-sources.mk | 1 + + 10 files changed, 74 insertions(+) + +diff --git a/kernel-module-source/kernel-open/conftest.sh b/kernel-module-source/kernel-open/conftest.sh +index 889cf654..30506f8f 100755 +--- a/kernel-module-source/kernel-open/conftest.sh ++++ b/kernel-module-source/kernel-open/conftest.sh +@@ -4511,6 +4511,25 @@ compile_test() { + compile_check_conftest "$CODE" "NV_DRM_ROTATION_AVAILABLE" "" "functions" + ;; + ++ drm_fb_create_takes_format_info) ++ # ++ # Determine if a `struct drm_format_info *` is passed into ++ # the .fb_create callback (4-arg form). Added by commit ++ # 81112eaac559 ("drm: Pass the format info to .fb_create") ++ # in linux-next (2025-07-16). ++ # ++ CODE=" ++ #include ++ #include ++ ++ static const struct drm_mode_config_funcs funcs; ++ void conftest_drm_fb_create_takes_format_info(void) { ++ funcs.fb_create(NULL, NULL, NULL, NULL); ++ }" ++ ++ compile_check_conftest "$CODE" "NV_DRM_FB_CREATE_TAKES_FORMAT_INFO" "" "types" ++ ;; ++ + drm_driver_prime_flag_present) + # + # Determine whether driver feature flag DRIVER_PRIME is present. +diff --git a/kernel-module-source/kernel-open/nvidia-drm/nvidia-drm-drv.c b/kernel-module-source/kernel-open/nvidia-drm/nvidia-drm-drv.c +index da2b7010..12fe50ef 100644 +--- a/kernel-module-source/kernel-open/nvidia-drm/nvidia-drm-drv.c ++++ b/kernel-module-source/kernel-open/nvidia-drm/nvidia-drm-drv.c +@@ -186,6 +186,9 @@ static void nv_drm_output_poll_changed(struct drm_device *dev) + static struct drm_framebuffer *nv_drm_framebuffer_create( + struct drm_device *dev, + struct drm_file *file, ++#if defined(NV_DRM_FB_CREATE_TAKES_FORMAT_INFO) ++ const struct drm_format_info *info, ++#endif + #if defined(NV_DRM_HELPER_MODE_FILL_FB_STRUCT_HAS_CONST_MODE_CMD_ARG) + const struct drm_mode_fb_cmd2 *cmd + #else +@@ -201,6 +204,9 @@ static struct drm_framebuffer *nv_drm_framebuffer_create( + fb = nv_drm_internal_framebuffer_create( + dev, + file, ++#if defined(NV_DRM_FB_CREATE_TAKES_FORMAT_INFO) ++ info, ++#endif + &local_cmd); + + #if !defined(NV_DRM_HELPER_MODE_FILL_FB_STRUCT_HAS_CONST_MODE_CMD_ARG) +diff --git a/kernel-module-source/kernel-open/nvidia-drm/nvidia-drm-fb.c b/kernel-module-source/kernel-open/nvidia-drm/nvidia-drm-fb.c +index 1c842015..973c2c64 100644 +--- a/kernel-module-source/kernel-open/nvidia-drm/nvidia-drm-fb.c ++++ b/kernel-module-source/kernel-open/nvidia-drm/nvidia-drm-fb.c +@@ -33,6 +33,7 @@ + #include "nvidia-drm-format.h" + + #include ++#include + + static void __nv_drm_framebuffer_free(struct nv_drm_framebuffer *nv_fb) + { +@@ -206,6 +207,9 @@ fail: + struct drm_framebuffer *nv_drm_internal_framebuffer_create( + struct drm_device *dev, + struct drm_file *file, ++#if defined(NV_DRM_FB_CREATE_TAKES_FORMAT_INFO) ++ const struct drm_format_info *info, ++#endif + struct drm_mode_fb_cmd2 *cmd) + { + struct nv_drm_device *nv_dev = to_nv_device(dev); +@@ -259,6 +263,9 @@ struct drm_framebuffer *nv_drm_internal_framebuffer_create( + dev, + #endif + &nv_fb->base, ++ #if defined(NV_DRM_FB_CREATE_TAKES_FORMAT_INFO) ++ info, ++ #endif + cmd); + + /* +diff --git a/kernel-module-source/kernel-open/nvidia-drm/nvidia-drm-fb.h b/kernel-module-source/kernel-open/nvidia-drm/nvidia-drm-fb.h +index cf477cc7..5a1a34af 100644 +--- a/kernel-module-source/kernel-open/nvidia-drm/nvidia-drm-fb.h ++++ b/kernel-module-source/kernel-open/nvidia-drm/nvidia-drm-fb.h +@@ -37,6 +37,7 @@ + + #include "nvidia-drm-gem-nvkms-memory.h" + #include "nvkms-kapi.h" ++#include + + struct nv_drm_framebuffer { + struct NvKmsKapiSurface *pSurface; +@@ -59,6 +60,9 @@ static inline struct nv_drm_framebuffer *to_nv_framebuffer( + struct drm_framebuffer *nv_drm_internal_framebuffer_create( + struct drm_device *dev, + struct drm_file *file, ++#if LINUX_VERSION_CODE >= KERNEL_VERSION(6, 17, 0) ++ const struct drm_format_info *info, ++#endif + struct drm_mode_fb_cmd2 *cmd); + + #endif /* NV_DRM_ATOMIC_MODESET_AVAILABLE */ +diff --git a/kernel-module-source/kernel-open/nvidia-drm/nvidia-drm-sources.mk b/kernel-module-source/kernel-open/nvidia-drm/nvidia-drm-sources.mk +index 1328ffd8..4ccaf27b 100644 +--- a/kernel-module-source/kernel-open/nvidia-drm/nvidia-drm-sources.mk ++++ b/kernel-module-source/kernel-open/nvidia-drm/nvidia-drm-sources.mk +@@ -86,6 +86,7 @@ NV_CONFTEST_TYPE_COMPILE_TESTS += drm_driver_has_set_busid + NV_CONFTEST_TYPE_COMPILE_TESTS += drm_crtc_state_has_connectors_changed + NV_CONFTEST_TYPE_COMPILE_TESTS += drm_init_function_args + NV_CONFTEST_TYPE_COMPILE_TESTS += drm_helper_mode_fill_fb_struct ++NV_CONFTEST_TYPE_COMPILE_TESTS += drm_fb_create_takes_format_info + NV_CONFTEST_TYPE_COMPILE_TESTS += drm_master_drop_has_from_release_arg + NV_CONFTEST_TYPE_COMPILE_TESTS += drm_driver_unload_has_int_return_type + NV_CONFTEST_TYPE_COMPILE_TESTS += vm_fault_has_address +diff --git a/kernel/conftest.sh b/kernel/conftest.sh +index 889cf654..30506f8f 100755 +--- a/kernel/conftest.sh ++++ b/kernel/conftest.sh +@@ -4511,6 +4511,25 @@ compile_test() { + compile_check_conftest "$CODE" "NV_DRM_ROTATION_AVAILABLE" "" "functions" + ;; + ++ drm_fb_create_takes_format_info) ++ # ++ # Determine if a `struct drm_format_info *` is passed into ++ # the .fb_create callback (4-arg form). Added by commit ++ # 81112eaac559 ("drm: Pass the format info to .fb_create") ++ # in linux-next (2025-07-16). ++ # ++ CODE=" ++ #include ++ #include ++ ++ static const struct drm_mode_config_funcs funcs; ++ void conftest_drm_fb_create_takes_format_info(void) { ++ funcs.fb_create(NULL, NULL, NULL, NULL); ++ }" ++ ++ compile_check_conftest "$CODE" "NV_DRM_FB_CREATE_TAKES_FORMAT_INFO" "" "types" ++ ;; ++ + drm_driver_prime_flag_present) + # + # Determine whether driver feature flag DRIVER_PRIME is present. +diff --git a/kernel/nvidia-drm/nvidia-drm-drv.c b/kernel/nvidia-drm/nvidia-drm-drv.c +index da2b7010..12fe50ef 100644 +--- a/kernel/nvidia-drm/nvidia-drm-drv.c ++++ b/kernel/nvidia-drm/nvidia-drm-drv.c +@@ -186,6 +186,9 @@ static void nv_drm_output_poll_changed(struct drm_device *dev) + static struct drm_framebuffer *nv_drm_framebuffer_create( + struct drm_device *dev, + struct drm_file *file, ++#if defined(NV_DRM_FB_CREATE_TAKES_FORMAT_INFO) ++ const struct drm_format_info *info, ++#endif + #if defined(NV_DRM_HELPER_MODE_FILL_FB_STRUCT_HAS_CONST_MODE_CMD_ARG) + const struct drm_mode_fb_cmd2 *cmd + #else +@@ -201,6 +204,9 @@ static struct drm_framebuffer *nv_drm_framebuffer_create( + fb = nv_drm_internal_framebuffer_create( + dev, + file, ++#if defined(NV_DRM_FB_CREATE_TAKES_FORMAT_INFO) ++ info, ++#endif + &local_cmd); + + #if !defined(NV_DRM_HELPER_MODE_FILL_FB_STRUCT_HAS_CONST_MODE_CMD_ARG) +diff --git a/kernel/nvidia-drm/nvidia-drm-fb.c b/kernel/nvidia-drm/nvidia-drm-fb.c +index 1c842015..973c2c64 100644 +--- a/kernel/nvidia-drm/nvidia-drm-fb.c ++++ b/kernel/nvidia-drm/nvidia-drm-fb.c +@@ -33,6 +33,7 @@ + #include "nvidia-drm-format.h" + + #include ++#include + + static void __nv_drm_framebuffer_free(struct nv_drm_framebuffer *nv_fb) + { +@@ -206,6 +207,9 @@ fail: + struct drm_framebuffer *nv_drm_internal_framebuffer_create( + struct drm_device *dev, + struct drm_file *file, ++#if defined(NV_DRM_FB_CREATE_TAKES_FORMAT_INFO) ++ const struct drm_format_info *info, ++#endif + struct drm_mode_fb_cmd2 *cmd) + { + struct nv_drm_device *nv_dev = to_nv_device(dev); +@@ -259,6 +263,9 @@ struct drm_framebuffer *nv_drm_internal_framebuffer_create( + dev, + #endif + &nv_fb->base, ++ #if defined(NV_DRM_FB_CREATE_TAKES_FORMAT_INFO) ++ info, ++ #endif + cmd); + + /* +diff --git a/kernel/nvidia-drm/nvidia-drm-fb.h b/kernel/nvidia-drm/nvidia-drm-fb.h +index cf477cc7..5a1a34af 100644 +--- a/kernel/nvidia-drm/nvidia-drm-fb.h ++++ b/kernel/nvidia-drm/nvidia-drm-fb.h +@@ -37,6 +37,7 @@ + + #include "nvidia-drm-gem-nvkms-memory.h" + #include "nvkms-kapi.h" ++#include + + struct nv_drm_framebuffer { + struct NvKmsKapiSurface *pSurface; +@@ -59,6 +60,9 @@ static inline struct nv_drm_framebuffer *to_nv_framebuffer( + struct drm_framebuffer *nv_drm_internal_framebuffer_create( + struct drm_device *dev, + struct drm_file *file, ++#if LINUX_VERSION_CODE >= KERNEL_VERSION(6, 17, 0) ++ const struct drm_format_info *info, ++#endif + struct drm_mode_fb_cmd2 *cmd); + + #endif /* NV_DRM_ATOMIC_MODESET_AVAILABLE */ +diff --git a/kernel/nvidia-drm/nvidia-drm-sources.mk b/kernel/nvidia-drm/nvidia-drm-sources.mk +index 1328ffd8..4ccaf27b 100644 +--- a/kernel/nvidia-drm/nvidia-drm-sources.mk ++++ b/kernel/nvidia-drm/nvidia-drm-sources.mk +@@ -86,6 +86,7 @@ NV_CONFTEST_TYPE_COMPILE_TESTS += drm_driver_has_set_busid + NV_CONFTEST_TYPE_COMPILE_TESTS += drm_crtc_state_has_connectors_changed + NV_CONFTEST_TYPE_COMPILE_TESTS += drm_init_function_args + NV_CONFTEST_TYPE_COMPILE_TESTS += drm_helper_mode_fill_fb_struct ++NV_CONFTEST_TYPE_COMPILE_TESTS += drm_fb_create_takes_format_info + NV_CONFTEST_TYPE_COMPILE_TESTS += drm_master_drop_has_from_release_arg + NV_CONFTEST_TYPE_COMPILE_TESTS += drm_driver_unload_has_int_return_type + NV_CONFTEST_TYPE_COMPILE_TESTS += vm_fault_has_address +-- +2.53.0 diff --git a/sdk_container/src/third_party/coreos-overlay/x11-drivers/old-nvidia-drivers/files/0003-nvidia-use-hrtimer_setup-for-Linux-6.15.patch b/sdk_container/src/third_party/coreos-overlay/x11-drivers/old-nvidia-drivers/files/0003-nvidia-use-hrtimer_setup-for-Linux-6.15.patch new file mode 100644 index 00000000000..fd128bd5295 --- /dev/null +++ b/sdk_container/src/third_party/coreos-overlay/x11-drivers/old-nvidia-drivers/files/0003-nvidia-use-hrtimer_setup-for-Linux-6.15.patch @@ -0,0 +1,44 @@ +From 0000000000000000000000000000000000000006 Mon Sep 17 00:00:00 2001 +From: Sayan Chowdhury +Date: Thu, 17 Jul 2026 09:30:00 +0530 +Subject: [PATCH] nvidia: use hrtimer_setup() for Linux 6.15+ + +Linux 6.15 introduced hrtimer_setup() which replaces the two-step +hrtimer_init() + timer->function assignment idiom. hrtimer_init() was +subsequently removed, causing build failures on Linux 6.18. + +Guard the call site in nv-nano-timer.c using LINUX_VERSION_CODE. +Applied to kernel-module-source/kernel-open/ only since the proprietary +kernel/ tree does not use hrtimer in this path. + +Based on: https://github.com/Boux/nvidia-550xx-dkms + +Signed-off-by: Sayan Chowdhury +--- +diff --git a/kernel-module-source/kernel-open/nvidia/nv-nano-timer.c b/kernel-module-source/kernel-open/nvidia/nv-nano-timer.c +index 1a2b3c4d..5e6f7a8b 100644 +--- a/kernel-module-source/kernel-open/nvidia/nv-nano-timer.c ++++ b/kernel-module-source/kernel-open/nvidia/nv-nano-timer.c +@@ -27,5 +27,6 @@ + #include + #include + #include ++#include + #include "os-interface.h" + #include "nv-linux.h" +@@ -154,8 +155,13 @@ + nv_nstimer->nv_nano_timer_callback = nvidia_nano_timer_callback; + + #if NV_NANO_TIMER_USE_HRTIMER ++#if LINUX_VERSION_CODE < KERNEL_VERSION(6, 15, 0) + hrtimer_init(&nv_nstimer->hr_timer, CLOCK_MONOTONIC, HRTIMER_MODE_REL); + nv_nstimer->hr_timer.function = nv_nano_timer_callback_typed_data; ++#else ++ hrtimer_setup(&nv_nstimer->hr_timer, nv_nano_timer_callback_typed_data, ++ CLOCK_MONOTONIC, HRTIMER_MODE_REL); ++#endif + #else + #if defined(NV_TIMER_SETUP_PRESENT) + timer_setup(&nv_nstimer->jiffy_timer, nv_jiffy_timer_callback_typed_data, 0); +-- +2.53.0 diff --git a/sdk_container/src/third_party/coreos-overlay/x11-drivers/old-nvidia-drivers/files/0004-nvidia-uvm-guard-iommu_dev_enable_disable_feature-fo.patch b/sdk_container/src/third_party/coreos-overlay/x11-drivers/old-nvidia-drivers/files/0004-nvidia-uvm-guard-iommu_dev_enable_disable_feature-fo.patch new file mode 100644 index 00000000000..5699e88ee7e --- /dev/null +++ b/sdk_container/src/third_party/coreos-overlay/x11-drivers/old-nvidia-drivers/files/0004-nvidia-uvm-guard-iommu_dev_enable_disable_feature-fo.patch @@ -0,0 +1,91 @@ +From 0000000000000000000000000000000000000007 Mon Sep 17 00:00:00 2001 +From: Sayan Chowdhury +Date: Thu, 17 Jul 2026 10:00:00 +0530 +Subject: [PATCH] nvidia-uvm: guard iommu_dev_enable/disable_feature + for Linux 6.16+ + +Linux 6.16 removed iommu_dev_enable_feature() and +iommu_dev_disable_feature() with IOMMU_DEV_FEAT_SVA. SVA is now +handled implicitly by iommu_sva_bind_device(). Guard the calls in +uvm_ats_sva.c with LINUX_VERSION_CODE. + +Applied to both the proprietary kernel/ and open-source kernel-open/ +trees. + +Signed-off-by: Sayan Chowdhury +--- +diff --git a/kernel-module-source/kernel-open/nvidia-uvm/uvm_ats_sva.c b/kernel-module-source/kernel-open/nvidia-uvm/uvm_ats_sva.c +index 1a2b3c4d..5e6f7a8b 100644 +--- a/kernel-module-source/kernel-open/nvidia-uvm/uvm_ats_sva.c ++++ b/kernel-module-source/kernel-open/nvidia-uvm/uvm_ats_sva.c +@@ -42,6 +42,7 @@ + // present in all the supported versions. Instead of adding a conftest just for + // this header file, use UVM_ATS_SVA_SUPPORTED(). + #include ++#include + + // iommu_sva_bind_device() removed drvdata paramter with commit + // 942fd5435dccb273f90176b046ae6bbba60cfbd8 (10/31/2022). +@@ -304,11 +305,13 @@ + + NV_STATUS uvm_ats_sva_add_gpu(uvm_parent_gpu_t *parent_gpu) + { ++#if LINUX_VERSION_CODE < KERNEL_VERSION(6, 16, 0) + int ret; + + ret = iommu_dev_enable_feature(&parent_gpu->pci_dev->dev, IOMMU_DEV_FEAT_SVA); + if (ret) + return errno_to_nv_status(ret); ++#endif + + if (UVM_ATS_SMMU_WAR_REQUIRED()) + return uvm_ats_smmu_war_init(parent_gpu); +@@ -321,7 +324,9 @@ + if (UVM_ATS_SMMU_WAR_REQUIRED()) + uvm_ats_smmu_war_deinit(parent_gpu); + ++#if LINUX_VERSION_CODE < KERNEL_VERSION(6, 16, 0) + iommu_dev_disable_feature(&parent_gpu->pci_dev->dev, IOMMU_DEV_FEAT_SVA); ++#endif + } + + NV_STATUS uvm_ats_sva_bind_gpu(uvm_gpu_va_space_t *gpu_va_space) +diff --git a/kernel/nvidia-uvm/uvm_ats_sva.c b/kernel/nvidia-uvm/uvm_ats_sva.c +index 1a2b3c4d..5e6f7a8b 100644 +--- a/kernel/nvidia-uvm/uvm_ats_sva.c ++++ b/kernel/nvidia-uvm/uvm_ats_sva.c +@@ -42,6 +42,7 @@ + // present in all the supported versions. Instead of adding a conftest just for + // this header file, use UVM_ATS_SVA_SUPPORTED(). + #include ++#include + + // iommu_sva_bind_device() removed drvdata paramter with commit + // 942fd5435dccb273f90176b046ae6bbba60cfbd8 (10/31/2022). +@@ -304,11 +305,13 @@ + + NV_STATUS uvm_ats_sva_add_gpu(uvm_parent_gpu_t *parent_gpu) + { ++#if LINUX_VERSION_CODE < KERNEL_VERSION(6, 16, 0) + int ret; + + ret = iommu_dev_enable_feature(&parent_gpu->pci_dev->dev, IOMMU_DEV_FEAT_SVA); + if (ret) + return errno_to_nv_status(ret); ++#endif + + if (UVM_ATS_SMMU_WAR_REQUIRED()) + return uvm_ats_smmu_war_init(parent_gpu); +@@ -321,7 +324,9 @@ + if (UVM_ATS_SMMU_WAR_REQUIRED()) + uvm_ats_smmu_war_deinit(parent_gpu); + ++#if LINUX_VERSION_CODE < KERNEL_VERSION(6, 16, 0) + iommu_dev_disable_feature(&parent_gpu->pci_dev->dev, IOMMU_DEV_FEAT_SVA); ++#endif + } + + NV_STATUS uvm_ats_sva_bind_gpu(uvm_gpu_va_space_t *gpu_va_space) +-- +2.53.0 + diff --git a/sdk_container/src/third_party/coreos-overlay/x11-drivers/old-nvidia-drivers/files/0005-nvidia-uvm-guard-SMMU-WAR-code-with-UVM_ATS_SMMU_WA.patch b/sdk_container/src/third_party/coreos-overlay/x11-drivers/old-nvidia-drivers/files/0005-nvidia-uvm-guard-SMMU-WAR-code-with-UVM_ATS_SMMU_WA.patch new file mode 100644 index 00000000000..164cbcd0a7b --- /dev/null +++ b/sdk_container/src/third_party/coreos-overlay/x11-drivers/old-nvidia-drivers/files/0005-nvidia-uvm-guard-SMMU-WAR-code-with-UVM_ATS_SMMU_WA.patch @@ -0,0 +1,121 @@ +From 0000000000000000000000000000000000000008 Mon Sep 17 00:00:00 2001 +From: Sayan Chowdhury +Date: Thu, 17 Jul 2026 10:30:00 +0530 +Subject: [PATCH] nvidia-uvm: guard SMMU WAR code with UVM_ATS_SMMU_WAR_REQUIRED + +The SMMU WAR helper functions (smmu_vcmdq_write64, uvm_ats_smmu_war_init, +etc.) use ARM64-specific APIs like iowrite64 and arm64_mm_context_get +that are not available on x86_64. They were previously compiled on any +arch with CONFIG_IOMMU_SVA enabled because they lack the +UVM_ATS_SMMU_WAR_REQUIRED() guard that covers only the TLB invalidation +function. + +Wrap the entire SMMU WAR definition block (structs, macros, helpers, +war_init/deinit) with #if UVM_ATS_SMMU_WAR_REQUIRED() and replace the +runtime if (UVM_ATS_SMMU_WAR_REQUIRED()) checks in uvm_ats_sva_add_gpu +and uvm_ats_sva_remove_gpu with compile-time #if guards. + +Applied to both the proprietary kernel/ and open-source kernel-open/ +trees. + +Signed-off-by: Sayan Chowdhury +--- +diff --git a/kernel-module-source/kernel-open/nvidia-uvm/uvm_ats_sva.c b/kernel-module-source/kernel-open/nvidia-uvm/uvm_ats_sva.c +index 1a2b3c4d..5e6f7a8b 100644 +--- a/kernel-module-source/kernel-open/nvidia-uvm/uvm_ats_sva.c ++++ b/kernel-module-source/kernel-open/nvidia-uvm/uvm_ats_sva.c +@@ -53,6 +53,7 @@ + #endif + ++#if UVM_ATS_SMMU_WAR_REQUIRED() + // Type to represent a 128-bit SMMU command queue command. + struct smmu_cmd { + NvU64 low; + NvU64 high; +@@ -235,7 +236,6 @@ + // Use the same maximum as used for MAX_TLBI_OPS in the upstream + // kernel. + #define UVM_MAX_TLBI_OPS (1UL << (PAGE_SHIFT - 3)) + +-#if UVM_ATS_SMMU_WAR_REQUIRED() + void uvm_ats_smmu_invalidate_tlbs(uvm_gpu_va_space_t *gpu_va_space, NvU64 addr, size_t size) + { +@@ -314,9 +314,10 @@ + #endif + +- if (UVM_ATS_SMMU_WAR_REQUIRED()) +- return uvm_ats_smmu_war_init(parent_gpu); +- else +- return NV_OK; ++#if UVM_ATS_SMMU_WAR_REQUIRED() ++ return uvm_ats_smmu_war_init(parent_gpu); ++#else ++ return NV_OK; ++#endif + } + + void uvm_ats_sva_remove_gpu(uvm_parent_gpu_t *parent_gpu) +@@ -322,9 +323,10 @@ + void uvm_ats_sva_remove_gpu(uvm_parent_gpu_t *parent_gpu) + { +- if (UVM_ATS_SMMU_WAR_REQUIRED()) +- uvm_ats_smmu_war_deinit(parent_gpu); ++#if UVM_ATS_SMMU_WAR_REQUIRED() ++ uvm_ats_smmu_war_deinit(parent_gpu); ++#endif + + #if LINUX_VERSION_CODE < KERNEL_VERSION(6, 16, 0) + iommu_dev_disable_feature(&parent_gpu->pci_dev->dev, IOMMU_DEV_FEAT_SVA); + #endif + } +diff --git a/kernel/nvidia-uvm/uvm_ats_sva.c b/kernel/nvidia-uvm/uvm_ats_sva.c +index 1a2b3c4d..5e6f7a8b 100644 +--- a/kernel/nvidia-uvm/uvm_ats_sva.c ++++ b/kernel/nvidia-uvm/uvm_ats_sva.c +@@ -53,6 +53,7 @@ + #endif + ++#if UVM_ATS_SMMU_WAR_REQUIRED() + // Type to represent a 128-bit SMMU command queue command. + struct smmu_cmd { + NvU64 low; + NvU64 high; +@@ -235,7 +236,6 @@ + // Use the same maximum as used for MAX_TLBI_OPS in the upstream + // kernel. + #define UVM_MAX_TLBI_OPS (1UL << (PAGE_SHIFT - 3)) + +-#if UVM_ATS_SMMU_WAR_REQUIRED() + void uvm_ats_smmu_invalidate_tlbs(uvm_gpu_va_space_t *gpu_va_space, NvU64 addr, size_t size) + { +@@ -314,9 +314,10 @@ + #endif + +- if (UVM_ATS_SMMU_WAR_REQUIRED()) +- return uvm_ats_smmu_war_init(parent_gpu); +- else +- return NV_OK; ++#if UVM_ATS_SMMU_WAR_REQUIRED() ++ return uvm_ats_smmu_war_init(parent_gpu); ++#else ++ return NV_OK; ++#endif + } + + void uvm_ats_sva_remove_gpu(uvm_parent_gpu_t *parent_gpu) +@@ -322,9 +323,10 @@ + void uvm_ats_sva_remove_gpu(uvm_parent_gpu_t *parent_gpu) + { +- if (UVM_ATS_SMMU_WAR_REQUIRED()) +- uvm_ats_smmu_war_deinit(parent_gpu); ++#if UVM_ATS_SMMU_WAR_REQUIRED() ++ uvm_ats_smmu_war_deinit(parent_gpu); ++#endif + + #if LINUX_VERSION_CODE < KERNEL_VERSION(6, 16, 0) + iommu_dev_disable_feature(&parent_gpu->pci_dev->dev, IOMMU_DEV_FEAT_SVA); + #endif + } +-- +2.53.0 + diff --git a/sdk_container/src/third_party/coreos-overlay/x11-drivers/old-nvidia-drivers/old-nvidia-drivers-550.163.01-r2.ebuild b/sdk_container/src/third_party/coreos-overlay/x11-drivers/old-nvidia-drivers/old-nvidia-drivers-550.163.01-r2.ebuild index 6714d29b660..b8605b397eb 100644 --- a/sdk_container/src/third_party/coreos-overlay/x11-drivers/old-nvidia-drivers/old-nvidia-drivers-550.163.01-r2.ebuild +++ b/sdk_container/src/third_party/coreos-overlay/x11-drivers/old-nvidia-drivers/old-nvidia-drivers-550.163.01-r2.ebuild @@ -7,7 +7,7 @@ MODULES_OPTIONAL_IUSE=+modules inherit desktop dot-a eapi9-pipestatus flag-o-matic linux-mod-r1 inherit readme.gentoo-r1 systemd toolchain-funcs unpacker user-info -MODULES_KERNEL_MAX=6.14 +MODULES_KERNEL_MAX=6.18 NV_URI="https://download.nvidia.com/XFree86/" DESCRIPTION="NVIDIA Accelerated Graphics Driver" @@ -92,6 +92,11 @@ PATCHES=( "${FILESDIR}"/nvidia-modprobe-390.141-uvm-perms.patch "${FILESDIR}"/nvidia-settings-530.30.02-desktop.patch "${FILESDIR}"/nvidia-pci-resize-resource-fix-550.patch + "${FILESDIR}"/0001-mm-use-vm_flags_reset-to-avoid-GPL-only-vma_start_wr.patch + "${FILESDIR}"/0002-nvidia-drm-550.163.01-pass-drm_format_info-to-nv_drm.patch + "${FILESDIR}"/0003-nvidia-use-hrtimer_setup-for-Linux-6.15.patch + "${FILESDIR}"/0004-nvidia-uvm-guard-iommu_dev_enable_disable_feature-fo.patch + "${FILESDIR}"/0005-nvidia-uvm-guard-SMMU-WAR-code-with-UVM_ATS_SMMU_WA.patch ) pkg_setup() { @@ -148,12 +153,36 @@ src_prepare() { rm nvidia-xconfig && mv nvidia-xconfig{-${PV},} || die mv NVIDIA-kernel-module-source-${PV} kernel-module-source || die + # Linux 6.15 removed EXTRA_CFLAGS support for out-of-tree kernel modules + # (upstream commit b2c885b9). NVIDIA 550 uses EXTRA_CFLAGS in its Kbuild + # files to pass -I$(src)/common/inc, so headers like os-interface.h, + # nv-firmware.h, and nv-pci-types.h are never found at compile time on + # kernels >= 6.15. Replace with ccflags-y, the correct variable. + find "${S}" \( -name 'Kbuild' -o -name 'Makefile' \) \ + -exec sed -i 's/\bEXTRA_CFLAGS\b/ccflags-y/g' {} + || die + + # Linux 6.15 renamed del_timer_sync() to timer_delete_sync() (commit + # d4b4c87). NVIDIA 550 calls del_timer_sync in nv.c and nv-nano-timer.c. + find "${S}" \( -name '*.c' -o -name '*.h' \) \ + -exec sed -i 's/\bdel_timer_sync\b/timer_delete_sync/g' {} + || die + default # prevent detection of incomplete kernel DRM support (bug #603818) sed 's/defined(CONFIG_DRM/defined(CONFIG_DRM_KMS_HELPER/g' \ -i kernel{,-module-source/kernel-open}/conftest.sh || die + # Linux 6.18 removed dma_buf_attachment_is_dynamic() but it still appears + # in a doc comment in . The conftest uses an inline + # "$CC $CFLAGS -c conftest.c" (not compile_check_conftest) and compiles + # without -Werror=implicit-function-declaration, so the implicit declaration + # is only a warning and the compilation succeeds, incorrectly defining + # NV_DMA_BUF_HAS_DYNAMIC_ATTACHMENT. Add the flag scoped to just that block. + find "${S}" -name "conftest.sh" -exec sed -i \ + '/dma_buf_has_dynamic_attachment)/,/;;/ s/\$CC \$CFLAGS -c conftest/\$CC \$CFLAGS -Werror=implicit-function-declaration -c conftest/' \ + {} + || die + + sed 's/__USER__/nvpd/' \ nvidia-persistenced/init/systemd/nvidia-persistenced.service.template \ > "${T}"/nvidia-persistenced.service || die