diff --git a/sdk_container/src/third_party/coreos-overlay/app-emulation/hv-daemons/hv-daemons-6.12.105.ebuild b/sdk_container/src/third_party/coreos-overlay/app-emulation/hv-daemons/hv-daemons-6.18.45.ebuild similarity index 100% rename from sdk_container/src/third_party/coreos-overlay/app-emulation/hv-daemons/hv-daemons-6.12.105.ebuild rename to sdk_container/src/third_party/coreos-overlay/app-emulation/hv-daemons/hv-daemons-6.18.45.ebuild diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-kernel/coreos-kernel-6.18.45.ebuild b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-kernel/coreos-kernel-6.18.45.ebuild new file mode 100644 index 00000000000..bb07dbb104a --- /dev/null +++ b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-kernel/coreos-kernel-6.18.45.ebuild @@ -0,0 +1,167 @@ +# Copyright 2026 The Flatcar Container Linux Maintainers +# Distributed under the terms of the GNU General Public License v2 + +EAPI=8 +COREOS_SOURCE_REVISION="" +inherit coreos-kernel toolchain-funcs + +DESCRIPTION="CoreOS Linux kernel" +KEYWORDS="amd64 arm64" +RESTRICT="userpriv" # dracut (via bootengine) needs root + +RDEPEND=" + =sys-kernel/coreos-modules-${PVR} + sys-apps/kbd +" +BDEPEND=" + sys-kernel/dracut +" +DEPEND=" + ${RDEPEND} + ${BDEPEND} + app-alternatives/awk + app-alternatives/gzip + app-arch/xz-utils + app-arch/zstd + app-crypt/clevis + app-shells/bash + coreos-base/afterburn + coreos-base/coreos-init:= + net-misc/iputils + sys-apps/azure-vm-utils[dracut] + sys-apps/baselayout + sys-apps/busybox + sys-apps/coreutils + sys-apps/findutils + sys-apps/grep + sys-apps/hwdata + sys-apps/ignition:= + sys-apps/iproute2 + sys-apps/kexec-tools + sys-apps/less + sys-apps/nvme-cli + sys-apps/sed + sys-apps/shadow + sys-apps/systemd[cryptsetup] + sys-apps/seismograph + sys-apps/util-linux[cryptsetup,udev] + sys-block/open-iscsi + sys-fs/btrfs-progs + sys-fs/cryptsetup[udev] + sys-fs/e2fsprogs + sys-fs/lvm2[udev] + sys-fs/mdadm + sys-fs/xfsprogs + >=sys-kernel/bootengine-0.0.38-r37:= + >=sys-kernel/coreos-firmware-20180103-r1:= + sys-process/procps + virtual/udev + amd64? ( + app-admin/google-guest-configs + sys-firmware/intel-microcode:= + ) +" + +src_prepare() { + default + + # KV_OUT_DIR points to the minimal build tree installed by coreos-modules + # Pull in the config and public module signing key + cp -v "${KV_OUT_DIR}/.config" build/ || die + validate_sig_key + + config_update 'CONFIG_INITRAMFS_SOURCE="bootengine.cpio"' + + # include all intel and amd microcode files, avoiding the signatures + local fw_dir="${ESYSROOT}/lib/firmware" + use amd64 && config_update "CONFIG_EXTRA_FIRMWARE=\"$(find ${fw_dir} -type f \ + \( -path ${fw_dir}'/intel-ucode/*' -o -path ${fw_dir}'/amd-ucode/*' \) -printf '%P ')\"" + use amd64 && config_update "CONFIG_EXTRA_FIRMWARE_DIR=\"${fw_dir}\"" +} + +src_compile() { + local BE_ARGS=() + + if [[ -n ${SYSROOT} ]]; then + BE_ARGS+=( -r "${SYSROOT}" ) + export DRACUT_ARCH="${CHOST%%-*}" + + # We may need to run ldconfig via QEMU, so use the wrapper. Dracut calls + # it with -r, which chroots and confuses the sandbox, so calm it down. + export DRACUT_LDCONFIG="${CHOST}-ldconfig" + local f; for f in /etc/ld.so.cache{,~} /var/cache/ldconfig/aux-cache{,~}; do + addwrite "${f}" + done + fi + + tc-export PKG_CONFIG + "${ESYSROOT}"/usr/bin/update-bootengine -k "${KV_FULL}" -o "${S}"/build/bootengine.cpio "${BE_ARGS[@]}" || die + # Copy full initrd over to /usr as filesystem image + mkdir "${S}"/build/bootengine || die + pushd "${S}"/build/bootengine || die + lsinitrd --kver SILENCEERROR --unpack "${S}"/build/bootengine.cpio || die + mksquashfs . "${S}"/build/bootengine.img -noappend -xattrs-exclude ^btrfs. || die + popd || die + # No early cpio, drop full initrd + > "${S}"/build/bootengine.cpio + # Create minimal initrd + mkdir "${S}"/build/minimal || die + pushd "${S}"/build/minimal || die + mkdir -p {etc,dev,proc,sys,dev,usr/bin,usr/lib,usr/lib64,realinit,sysusr/usr} || die + ln -s usr/bin bin || die + ln -s usr/bin sbin || die + ln -s bin usr/sbin || die + ln -s usr/lib lib || die + ln -s usr/lib64 lib64 || die + # Instead from ESYSROOT we can also copy kernel modules from the dracut pre-selection + mkdir -p lib/modprobe.d/ || die + cp "${S}"/build/bootengine/lib/modprobe.d/* lib/modprobe.d/ || die + # Only include modules related to mounting /usr and for interacting with the emergency console + pushd "${S}/build/bootengine/usr/lib/modules/${KV_FULL}" || die + find kernel/drivers/{ata,block,hid,hv,input/serio,message/fusion,mmc,nvme,pci,scsi,usb} kernel/fs/{btrfs,overlayfs,squashfs} kernel/security/keys -name "*.ko.*" -printf "%f\0" | DRACUT_NO_XATTR=1 xargs --null "${BROOT}"/usr/lib/dracut/dracut-install --destrootdir "${S}"/build/minimal --kerneldir . --sysrootdir "${S}"/build/bootengine/ --firmwaredirs "${S}"/build/bootengine/usr/lib/firmware --module dm-verity dm-mod virtio_console || die + popd || die + # Double compression only makes the image bigger and slower + find . -name "*.ko.xz" -exec unxz {} + || die + depmod -a -b . "${KV_FULL}" || die + echo '$MODALIAS=.* 0:0 660 @/sbin/modprobe "$MODALIAS"' > ./etc/mdev.conf || die + # We can't use busybox's modprobe because it doesn't support the globs in module.alias, breaking module loading + DRACUT_NO_XATTR=1 "${BROOT}"/usr/lib/dracut/dracut-install --destrootdir . --sysrootdir "${ESYSROOT}" --ldd /bin/veritysetup /bin/dmsetup /bin/busybox /sbin/modprobe || die + cp -a "${ESYSROOT}"/usr/bin/minimal-init ./init || die + # Make it easier to debug by not relying too much on the first commands + ln -s busybox ./bin/sh || die + mknod ./dev/console c 5 1 || die + mknod ./dev/null c 1 3 || die + mknod ./dev/tty c 5 0 || die + mknod ./dev/urandom c 1 9 || die + mknod ./dev/random c 1 8 || die + mknod ./dev/zero c 1 5 || die + # No compression because CONFIG_INITRAMFS_COMPRESSION_XZ should take care of it + # (Note: The kernel build system does not support prepending an uncompressed microcode early cpio here) + find . -print0 | cpio --null --create --verbose --format=newc >> "${S}"/build/bootengine.cpio || die + popd || die + kmake "$(kernel_target)" + + # sanity check :) + [[ -e build/certs/signing_key.pem ]] && die "created a new key!" +} + +src_install() { + # coreos-postinst expects to find the kernel in /usr/boot + insinto "/usr/boot" + newins "$(kernel_path)" "vmlinuz-${KV_FULL}" + dosym "vmlinuz-${KV_FULL}" "/usr/boot/vmlinuz" + + insinto "/usr/lib/modules/${KV_FULL}/build" + doins build/System.map + + insinto "/usr/lib/debug/usr/boot" + newins build/vmlinux "vmlinux-${KV_FULL}" + dosym "../../../boot/vmlinux-${KV_FULL}" "/usr/lib/debug/usr/lib/modules/${KV_FULL}/vmlinux" + + # For easy access to vdso debug symbols in gdb: + # set debug-file-directory /usr/lib/debug/usr/lib/modules/${KV_FULL}/vdso/ + kmake INSTALL_MOD_PATH="${ED}/usr/lib/debug/usr" vdso_install + + insinto "/usr/lib/flatcar" + doins build/bootengine.img +} diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/coreos-modules-6.18.45.ebuild b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/coreos-modules-6.18.45.ebuild new file mode 100644 index 00000000000..11318123570 --- /dev/null +++ b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/coreos-modules-6.18.45.ebuild @@ -0,0 +1,63 @@ +# Copyright 2026 The Flatcar Container Linux Maintainers +# Distributed under the terms of the GNU General Public License v2 + +EAPI=7 +COREOS_SOURCE_REVISION="" +inherit coreos-kernel savedconfig + +DESCRIPTION="CoreOS Linux kernel modules" +KEYWORDS="amd64 arm64" +RDEPEND="!> build/.config || die + fi + cpio -ov build/bootengine.cpio + + # Check that an old pre-ebuild-split config didn't leak in. + grep -q "^CONFIG_INITRAMFS_SOURCE=" build/.config && \ + die "CONFIG_INITRAMFS_SOURCE must be removed from kernel config" + config_update 'CONFIG_INITRAMFS_SOURCE="bootengine.cpio"' +} + +src_compile() { + # Generate module signing key + setup_keys + + # Build both vmlinux and modules (moddep checks symbols in vmlinux) + kmake vmlinux modules +} + +src_install() { + local build="lib/modules/${KV_FULL}/build" + + # Install modules to /usr. + # Stripping must be done here, not portage, to preserve sigs. + kmake INSTALL_MOD_PATH="${ED}/usr" \ + INSTALL_MOD_STRIP="--strip-debug" \ + modules_install + + # Install to /usr/lib/debug with debug symbols intact + kmake INSTALL_MOD_PATH="${ED}/usr/lib/debug/usr" \ + modules_install + rm "${ED}/usr/lib/debug/usr/lib/modules/${KV_FULL}"/{build,modules.*} || die + + # Replace the broken /lib/modules/${KV_FULL}/build symlink with a copy of + # the files needed to build out-of-tree modules. + rm "${ED}/usr/${build}" || die + kmake run-command KBUILD_RUN_COMMAND="${KERNEL_DIR}/scripts/package/install-extmod-build ${ED}/usr/${build}" + + # Install the original config because the above doesn't. + insinto "/usr/${build}" + doins build/.config + + # Not strictly required but this is where we used to install the config. + dosym "../${build}/.config" "/usr/boot/config-${KV_FULL}" + dosym "../${build}/.config" "/usr/boot/config" +} diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/files/amd64_defconfig-6.12 b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/files/amd64_defconfig-6.18 similarity index 100% rename from sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/files/amd64_defconfig-6.12 rename to sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/files/amd64_defconfig-6.18 diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/files/arm64_defconfig-6.12 b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/files/arm64_defconfig-6.18 similarity index 100% rename from sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/files/arm64_defconfig-6.12 rename to sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/files/arm64_defconfig-6.18 diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/files/commonconfig-6.12 b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/files/commonconfig-6.18 similarity index 98% rename from sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/files/commonconfig-6.12 rename to sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/files/commonconfig-6.18 index a97b740cbe4..7a618b68be7 100644 --- a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/files/commonconfig-6.12 +++ b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/files/commonconfig-6.18 @@ -42,6 +42,7 @@ CONFIG_BLK_DEV_SR=m CONFIG_BLK_DEV_THROTTLING=y CONFIG_BLK_WBT=y CONFIG_BNA=m +CONFIG_BNGE=m CONFIG_BNX2X=m CONFIG_BNXT=m CONFIG_BONDING=m @@ -75,6 +76,7 @@ CONFIG_BRIDGE_EBT_T_NAT=m CONFIG_BRIDGE_EBT_VLAN=m CONFIG_BRIDGE_NETFILTER=y CONFIG_BRIDGE_NF_EBTABLES=m +CONFIG_BRIDGE_NF_EBTABLES_LEGACY=m CONFIG_BRIDGE_VLAN_FILTERING=y CONFIG_BROADCOM_PHY=m CONFIG_BSD_DISKLABEL=y @@ -125,6 +127,7 @@ CONFIG_CPU_FREQ_GOV_USERSPACE=m CONFIG_CPU_FREQ_STAT=y # CONFIG_CROSS_MEMORY_ATTACH is not set CONFIG_CRYPTO_AES=m +CONFIG_CRYPTO_CRC32C=y CONFIG_CRYPTO_CTR=m CONFIG_CRYPTO_CTS=m CONFIG_CRYPTO_DES=m @@ -138,7 +141,7 @@ CONFIG_CRYPTO_LIB_GF128MUL=m CONFIG_CRYPTO_LZO=m # CONFIG_CRYPTO_MANAGER_DISABLE_TESTS is not set CONFIG_CRYPTO_NULL=m -CONFIG_CRYPTO_NULL2=m +CONFIG_CRYPTO_SELFTESTS=y CONFIG_CRYPTO_SHA1=y CONFIG_CRYPTO_USER_API_HASH=m CONFIG_CRYPTO_USER_API_SKCIPHER=m @@ -168,16 +171,15 @@ CONFIG_DM_UEVENT=y CONFIG_DM_VERITY=m CONFIG_DM_ZERO=m CONFIG_DNS_RESOLVER=y -CONFIG_DRM=y +CONFIG_DRM=m CONFIG_DRM_FBDEV_EMULATION=y CONFIG_DRM_QXL=m CONFIG_DRM_SIMPLEDRM=m CONFIG_DRM_TTM_HELPER=m -CONFIG_DRM_VIRTIO_GPU=y +CONFIG_DRM_VIRTIO_GPU=m CONFIG_DST_CACHE=y CONFIG_DUMMY=m CONFIG_DYNAMIC_DEBUG=y -CONFIG_DYNAMIC_FTRACE=y CONFIG_E100=m CONFIG_E1000=m CONFIG_E1000E=m @@ -209,12 +211,11 @@ CONFIG_FORTIFY_SOURCE=y CONFIG_FRAMEBUFFER_CONSOLE=y CONFIG_FRAMEBUFFER_CONSOLE_DETECT_PRIMARY=y CONFIG_FRAMEBUFFER_CONSOLE_ROTATION=y -CONFIG_FSCACHE=m +CONFIG_FSCACHE=y CONFIG_FSCACHE_STATS=y CONFIG_FS_DAX=y CONFIG_FS_ENCRYPTION=y CONFIG_FTRACE_SYSCALLS=y -CONFIG_FUNCTION_TRACER=y CONFIG_FUSE_DAX=y CONFIG_FUSE_FS=m CONFIG_FUSION=y @@ -232,15 +233,10 @@ CONFIG_GRO_CELLS=y CONFIG_GTP=m CONFIG_HARDENED_USERCOPY=y CONFIG_HIDRAW=y -CONFIG_HID_A4TECH=m CONFIG_HID_APPLE=m CONFIG_HID_BELKIN=m -CONFIG_HID_CHERRY=m -CONFIG_HID_EZKEY=m CONFIG_HID_HYPERV_MOUSE=m -CONFIG_HID_LOGITECH=m CONFIG_HID_MICROSOFT=m -CONFIG_HID_MONTEREY=m CONFIG_HIGH_RES_TIMERS=y CONFIG_HOTPLUG_PCI=y CONFIG_HOTPLUG_PCI_ACPI=y @@ -251,7 +247,7 @@ CONFIG_HWMON=m CONFIG_HW_RANDOM=y CONFIG_HW_RANDOM_TIMERIOMEM=m CONFIG_HW_RANDOM_VIRTIO=y -CONFIG_HYPERV=m +CONFIG_HYPERV=y CONFIG_HYPERV_BALLOON=m CONFIG_HYPERV_NET=m CONFIG_HYPERV_UTILS=m @@ -354,7 +350,6 @@ CONFIG_IPV6_SUBTREES=y CONFIG_IPV6_VTI=m CONFIG_IPVLAN=m CONFIG_IP_ADVANCED_ROUTER=y -CONFIG_IP_DCCP=m CONFIG_IP_FIB_TRIE_STATS=y CONFIG_IP_MROUTE=y CONFIG_IP_MROUTE_MULTIPLE_TABLES=y @@ -385,6 +380,7 @@ CONFIG_IP_PIMSM_V2=y # CONFIG_IP_PNP is not set CONFIG_IP_ROUTE_MULTIPATH=y CONFIG_IP_ROUTE_VERBOSE=y +CONFIG_IP_SCTP=m CONFIG_IP_SET=m CONFIG_IP_SET_BITMAP_IP=m CONFIG_IP_SET_BITMAP_IPMAC=m @@ -534,6 +530,7 @@ CONFIG_NETFILTER_ADVANCED=y CONFIG_NETFILTER_NETLINK_GLUE_CT=y CONFIG_NETFILTER_NETLINK_QUEUE=m CONFIG_NETFILTER_XTABLES=y +CONFIG_NETFILTER_XTABLES_LEGACY=y CONFIG_NETFILTER_XT_MATCH_ADDRTYPE=m CONFIG_NETFILTER_XT_MATCH_BPF=m CONFIG_NETFILTER_XT_MATCH_CGROUP=m @@ -595,7 +592,6 @@ CONFIG_NETFILTER_XT_TARGET_TCPOPTSTRIP=m CONFIG_NETFILTER_XT_TARGET_TEE=m CONFIG_NETFILTER_XT_TARGET_TPROXY=m CONFIG_NETFILTER_XT_TARGET_TRACE=m -CONFIG_NETKIT=y CONFIG_NETLINK_DIAG=m CONFIG_NETWORK_PHY_TIMESTAMPING=y CONFIG_NETXEN_NIC=m @@ -776,17 +772,15 @@ CONFIG_NO_HZ=y CONFIG_NR_CPUS=512 CONFIG_NUMA=y CONFIG_NUMA_BALANCING=y -CONFIG_NVME_MULTIPATH=y CONFIG_NVME_RDMA=m CONFIG_NVME_TARGET=m CONFIG_NVME_TARGET_LOOP=m CONFIG_NVME_TARGET_RDMA=m -CONFIG_NVME_TARGET_TCP=m -CONFIG_NVME_TCP=m CONFIG_OPENVSWITCH=m CONFIG_OVERLAY_FS=m CONFIG_OVERLAY_FS_METACOPY=y CONFIG_OVERLAY_FS_REDIRECT_DIR=y +CONFIG_OVPN=m CONFIG_PACKET=y CONFIG_PACKET_DIAG=m CONFIG_PANIC_ON_OOPS=y @@ -800,6 +794,7 @@ CONFIG_PCI=y CONFIG_PCIEAER=y CONFIG_PCIEPORTBUS=y CONFIG_PCIE_ECRC=y +CONFIG_PCIE_THERMAL=y CONFIG_PCI_HYPERV=m CONFIG_PCI_IOV=y CONFIG_PCI_MSI=y @@ -865,7 +860,6 @@ CONFIG_SATA_SX4=m CONFIG_SATA_VIA=m CONFIG_SATA_VITESSE=m CONFIG_SCHED_AUTOGROUP=y -CONFIG_SCHED_CLASS_EXT=y CONFIG_SCHED_SMT=y CONFIG_SCHED_STACK_END_CHECK=y CONFIG_SCSI_3W_9XXX=m @@ -896,7 +890,6 @@ CONFIG_SCSI_SCAN_ASYNC=y CONFIG_SCSI_SMARTPQI=m CONFIG_SCSI_SYM53C8XX_2=m CONFIG_SCSI_VIRTIO=m -CONFIG_SCTP_COOKIE_HMAC_SHA1=y CONFIG_SECURITY=y CONFIG_SECURITY_LANDLOCK=y CONFIG_SECURITY_LOCKDOWN_LSM=y @@ -965,6 +958,7 @@ CONFIG_TLS_DEVICE=y CONFIG_TLS_TOE=y CONFIG_TMPFS=y CONFIG_TMPFS_POSIX_ACL=y +CONFIG_TRACEFS_AUTOMOUNT_DEPRECATED=n CONFIG_TRANSPARENT_HUGEPAGE=y CONFIG_TRUSTED_KEYS=m CONFIG_TTY_PRINTK=y @@ -1003,7 +997,6 @@ CONFIG_VFIO=m CONFIG_VFIO_PCI=m CONFIG_VFIO_PCI_CORE=m CONFIG_VFIO_PCI_INTX=y -CONFIG_VFIO_PCI_MMAP=y CONFIG_VHOST_IOTLB=m CONFIG_VHOST_NET=m CONFIG_VHOST_RING=m @@ -1011,13 +1004,14 @@ CONFIG_VIA_RHINE=m CONFIG_VIA_RHINE_MMIO=y CONFIG_VIRTIO_BALLOON=m CONFIG_VIRTIO_BLK=m -CONFIG_VIRTIO_CONSOLE=y +CONFIG_VIRTIO_CONSOLE=m CONFIG_VIRTIO_FS=m CONFIG_VIRTIO_INPUT=m CONFIG_VIRTIO_MMIO=y CONFIG_VIRTIO_MMIO_CMDLINE_DEVICES=y CONFIG_VIRTIO_NET=m CONFIG_VIRTIO_PCI=y +CONFIG_VIRTIO_RTC=m CONFIG_VIRTIO_VSOCKETS=m CONFIG_VIRT_DRIVERS=y CONFIG_VLAN_8021Q=m diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/Manifest b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/Manifest index 8fa6f69ee4a..34f33055170 100644 --- a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/Manifest +++ b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/Manifest @@ -1,2 +1,2 @@ -DIST linux-6.12.tar.xz 147906904 BLAKE2B b2ec2fc69218cacabbbe49f78384a5d259ca581b717617c12b000b16f4a4c59ee348ea886b37147f5f70fb9a7a01c1e2c8f19021078f6b23f5bc62d1c48d5e5e SHA512 a37b1823df7b4f72542f689b65882634740ba0401a42fdcf6601d9efd2e132e5a7650e70450ba76f6cd1f13ca31180f2ccee9d54fe4df89bc0000ade4380a548 -DIST patch-6.12.105.xz 5624568 BLAKE2B 0a70f979a8ef937a2881003131a93c785fa30dd2634055f50909cb21995ecb875bfbc9bbcae30bb1c0056f8ebc845f2bc1a704ebdd9cd07e734eaa33d70270ee SHA512 017122b28c1a43ace897e75069286b49b4115d7eda37d46b4a7d682071fc526e9e4bfd290ecbe0dc41e591801976dcb5935afd5b7c16e596860b331d1040bcb7 +DIST linux-6.18.tar.xz 154309096 BLAKE2B b94b7b9bf18aca0c3e50baf79b009a1448fc6cd9c3ee019f641cc247dcf53a4abef4274ee0608ad8cd4943af69854363a95d26e117ff23620bb07dccb158859f SHA512 88599ffdec96d150c1feb9b261ba93bb0301a9d0e1ad6bef7aeab1f5372cbfc57d8b43c7e902bd8f76921d1dbd8189663c142ea869e51d0e2b483b150ee00fe0 +DIST patch-6.18.45.xz 3184312 BLAKE2B aba9fb2692dffd6815719605d067f67b78fe9d829ad41c7b235c3eef8b8259b0a7f48cf74ba71b7e485cb0fe33efc43dcd6bc5aa2d80f43965cc0319bee47dc6 SHA512 07cb6bc7d2ef0ce5ccfc2c68333d0490a452ba18063473e40ec458066f371e17b871edf937c517f318573bbe3836f0e62f21e3caa481051738a47d9eed858bfb diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/coreos-sources-6.12.105.ebuild b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/coreos-sources-6.12.105.ebuild deleted file mode 100644 index eb361930dcd..00000000000 --- a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/coreos-sources-6.12.105.ebuild +++ /dev/null @@ -1,51 +0,0 @@ -# Copyright 2014 CoreOS, Inc. -# Distributed under the terms of the GNU General Public License v2 - -EAPI=7 -ETYPE="sources" - -# -rc releases should be versioned L.M_rcN -# Final releases should be versioned L.M.N, even for N == 0 - -# Only needed for RCs -K_BASE_VER="5.15" - -inherit kernel-2 -detect_version - -# Replace the -coreos suffix with -flatcar. Don't simply reset the whole -# variable because it may have additional numbers before the suffix. This -# doesn't affect the sources directory, which is still suffixed with -coreos, -# but it does affect the Makefile that is used in the build. -EXTRAVERSION="${EXTRAVERSION/-coreos/-flatcar}" - -DESCRIPTION="Full sources for the CoreOS Linux kernel" -HOMEPAGE="http://www.kernel.org" -if [[ "${PV%%_rc*}" != "${PV}" ]]; then - SRC_URI="https://git.kernel.org/torvalds/p/v${KV%-coreos}/v${OKV} -> patch-${KV%-coreos}.patch ${KERNEL_BASE_URI}/linux-${OKV}.tar.xz" - PATCH_DIR="${FILESDIR}/${KV_MAJOR}.${KV_PATCH}" -else - SRC_URI="${KERNEL_URI}" - PATCH_DIR="${FILESDIR}/${KV_MAJOR}.${KV_MINOR}" -fi - -# make modules_prepare depends on pahole -RDEPEND="dev-util/pahole" - -KEYWORDS="amd64 arm64" -IUSE="" - -# XXX: Note we must prefix the patch filenames with "z" to ensure they are -# applied _after_ a potential patch-${KV}.patch file, present when building a -# patchlevel revision. We mustn't apply our patches first, it fails when the -# local patches overlap with the upstream patch. -UNIPATCH_LIST=" - ${PATCH_DIR}/z0001-kbuild-derive-relative-path-for-srctree-from-CURDIR.patch - ${PATCH_DIR}/z0002-pahole-support-reproducible-builds.patch - ${PATCH_DIR}/z0003-Revert-x86-boot-Remove-the-bugger-off-message.patch - ${PATCH_DIR}/z0004-efi-add-an-efi_secure_boot-flag-to-indicate-secure-b.patch - ${PATCH_DIR}/z0005-efi-lock-down-the-kernel-if-booted-in-secure-boot-mo.patch - ${PATCH_DIR}/z0006-mtd-disable-slram-and-phram-when-locked-down.patch - ${PATCH_DIR}/z0007-arm64-add-kernel-config-option-to-lock-down-when.patch - ${PATCH_DIR}/z0009-block-add-partition-uuid-into-uevent.patch -" diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/coreos-sources-6.18.45.ebuild b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/coreos-sources-6.18.45.ebuild new file mode 100644 index 00000000000..c86dfe82872 --- /dev/null +++ b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/coreos-sources-6.18.45.ebuild @@ -0,0 +1,45 @@ +# Copyright 2026 The Flatcar Container Linux Maintainers +# Distributed under the terms of the GNU General Public License v2 + +EAPI=7 +ETYPE="sources" + +# -rc releases should be versioned L.M_rcN +# Final releases should be versioned L.M.N, even for N == 0 + +# Only needed for RCs +K_BASE_VER="5.15" + +inherit kernel-2 +EXTRAVERSION="-flatcar" +detect_version + +DESCRIPTION="Full sources for the CoreOS Linux kernel" +HOMEPAGE="http://www.kernel.org" +if [[ "${PV%%_rc*}" != "${PV}" ]]; then + SRC_URI="https://git.kernel.org/torvalds/p/v${KV%-coreos}/v${OKV} -> patch-${KV%-coreos}.patch ${KERNEL_BASE_URI}/linux-${OKV}.tar.xz" + PATCH_DIR="${FILESDIR}/${KV_MAJOR}.${KV_PATCH}" +else + SRC_URI="${KERNEL_URI}" + PATCH_DIR="${FILESDIR}/${KV_MAJOR}.${KV_MINOR}" +fi + +# make modules_prepare depends on pahole +RDEPEND="dev-util/pahole" + +KEYWORDS="amd64 arm64" +IUSE="" + +# XXX: Note we must prefix the patch filenames with "z" to ensure they are +# applied _after_ a potential patch-${KV}.patch file, present when building a +# patchlevel revision. We mustn't apply our patches first, it fails when the +# local patches overlap with the upstream patch. +UNIPATCH_LIST=" + ${PATCH_DIR}/z0001-pahole-support-reproducible-builds.patch \ + ${PATCH_DIR}/z0002-Revert-x86-boot-Remove-the-bugger-off-message.patch \ + ${PATCH_DIR}/z0003-efi-Add-an-EFI_SECURE_BOOT-flag-to-indicate-secure-b.patch \ + ${PATCH_DIR}/z0004-efi-Lock-down-the-kernel-if-booted-in-secure-boot-mo.patch \ + ${PATCH_DIR}/z0005-mtd-phram-slram-Disable-when-the-kernel-is-locked-do.patch \ + ${PATCH_DIR}/z0006-arm64-add-kernel-config-option-to-lock-down-when-in-.patch \ + ${PATCH_DIR}/z0007-tools-hv-fix-cross-compilation.patch \ +" diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.12/z0001-kbuild-derive-relative-path-for-srctree-from-CURDIR.patch b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.12/z0001-kbuild-derive-relative-path-for-srctree-from-CURDIR.patch deleted file mode 100644 index 8f269fd9de8..00000000000 --- a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.12/z0001-kbuild-derive-relative-path-for-srctree-from-CURDIR.patch +++ /dev/null @@ -1,33 +0,0 @@ -From dcf70e8275cf5cc964a0657312af9210996ae2e7 Mon Sep 17 00:00:00 2001 -From: Vito Caputo -Date: Wed, 25 Nov 2015 02:59:45 -0800 -Subject: [PATCH 1/2] kbuild: derive relative path for srctree from CURDIR - -This enables relocating source and build trees to different roots, -provided they stay reachable relative to one another. Useful for -builds done within a sandbox where the eventual root is prefixed -by some undesirable path component. ---- - Makefile | 6 ++++-- - 1 file changed, 4 insertions(+), 2 deletions(-) - -diff --git a/Makefile b/Makefile -index a5cfcd0a85a9..b81055b65169 100644 ---- a/Makefile -+++ b/Makefile -@@ -262,8 +262,10 @@ else - building_out_of_srctree := 1 - endif - --ifneq ($(KBUILD_ABS_SRCTREE),) --srctree := $(abs_srctree) -+ifneq ($(KBUILD_OUTPUT),) -+ srctree := $(shell realpath --relative-to=$(KBUILD_OUTPUT) $(abs_srctree)) -+else -+ srctree := $(abs_srctree) - endif - - objtree := . --- -2.25.1 - diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.12/z0009-block-add-partition-uuid-into-uevent.patch b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.12/z0009-block-add-partition-uuid-into-uevent.patch deleted file mode 100644 index 754309104eb..00000000000 --- a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.12/z0009-block-add-partition-uuid-into-uevent.patch +++ /dev/null @@ -1,36 +0,0 @@ -From 758737d86f8a2d74c0fa9f8b2523fa7fd1e0d0aa Mon Sep 17 00:00:00 2001 -From: Konstantin Khlebnikov -Date: Fri, 4 Oct 2024 17:13:43 -0700 -Subject: [PATCH] block: add partition uuid into uevent as "PARTUUID" - -Both most common formats have uuid in addition to partition name: -GPT: standard uuid xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx -DOS: 4 byte disk signature and 1 byte partition xxxxxxxx-xx - -Tools from util-linux use the same notation for them. - -Signed-off-by: Konstantin Khlebnikov -Reviewed-by: Kyle Fortin -[dianders: rebased to modern kernels] -Signed-off-by: Douglas Anderson -Signed-off-by: Douglas Anderson -Reviewed-by: Christoph Hellwig -Link: https://lore.kernel.org/r/20241004171340.v2.1.I938c91d10e454e841fdf5d64499a8ae8514dc004@changeid -Signed-off-by: Jens Axboe ---- - block/partitions/core.c | 2 ++ - 1 file changed, 2 insertions(+) - -diff --git a/block/partitions/core.c b/block/partitions/core.c -index cdad05f9764768..815ed33caa1b86 100644 ---- a/block/partitions/core.c -+++ b/block/partitions/core.c -@@ -256,6 +256,8 @@ static int part_uevent(const struct device *dev, struct kobj_uevent_env *env) - add_uevent_var(env, "PARTN=%u", bdev_partno(part)); - if (part->bd_meta_info && part->bd_meta_info->volname[0]) - add_uevent_var(env, "PARTNAME=%s", part->bd_meta_info->volname); -+ if (part->bd_meta_info && part->bd_meta_info->uuid[0]) -+ add_uevent_var(env, "PARTUUID=%s", part->bd_meta_info->uuid); - return 0; - } - diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.12/z0002-pahole-support-reproducible-builds.patch b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.18/z0001-pahole-support-reproducible-builds.patch similarity index 54% rename from sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.12/z0002-pahole-support-reproducible-builds.patch rename to sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.18/z0001-pahole-support-reproducible-builds.patch index dbce2286a3d..dd815a84f3e 100644 --- a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.12/z0002-pahole-support-reproducible-builds.patch +++ b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.18/z0001-pahole-support-reproducible-builds.patch @@ -1,26 +1,26 @@ -From 9faff3734e6456e7927c0914829a4764ec9f1b44 Mon Sep 17 00:00:00 2001 +From b8dc4700a839ff99d33b61321281368699fc6339 Mon Sep 17 00:00:00 2001 From: Adrian Vladu Date: Tue, 17 Sep 2024 13:44:14 +0000 -Subject: [PATCH] pahole: support reproducible builds +Subject: [PATCH 1/8] pahole: support reproducible builds --- scripts/Makefile.btf | 3 +++ 1 file changed, 3 insertions(+) diff --git a/scripts/Makefile.btf b/scripts/Makefile.btf -index 2d6e5ed9081e..b2f88b0fcf37 100644 +index db76335dd917..bba03bdbbdc6 100644 --- a/scripts/Makefile.btf +++ b/scripts/Makefile.btf -@@ -23,6 +23,9 @@ else - # Switch to using --btf_features for v1.26 and later. - pahole-flags-$(call test-ge, $(pahole-ver), 126) = -j --btf_features=encode_force,var,float,enum64,decl_tag,type_tag,optimized_func,consistent_func +@@ -29,6 +29,9 @@ ifneq ($(KBUILD_EXTMOD),) + module-pahole-flags-$(call test-ge, $(pahole-ver), 128) += --btf_features=distilled_base + endif +# Support reproducible builds. -+pahole-flags-$(call test-ge, $(pahole-ver), 127) = -j --btf_features=encode_force,var,float,enum64,decl_tag,type_tag,optimized_func,consistent_func,reproducible_build ++pahole-flags-$(call test-ge, $(pahole-ver), 127) = -j --btf_features=encode_force,var,float,enum64,decl_tag,type_tag,optimized_func,consistent_func,decl_tag_kfuncs,reproducible_build + endif pahole-flags-$(CONFIG_PAHOLE_HAS_LANG_EXCLUDE) += --lang_exclude=rust -- -2.34.1 +2.51.0 diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.12/z0003-Revert-x86-boot-Remove-the-bugger-off-message.patch b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.18/z0002-Revert-x86-boot-Remove-the-bugger-off-message.patch similarity index 87% rename from sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.12/z0003-Revert-x86-boot-Remove-the-bugger-off-message.patch rename to sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.18/z0002-Revert-x86-boot-Remove-the-bugger-off-message.patch index 6f3a7370f8d..0ce03062c03 100644 --- a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.12/z0003-Revert-x86-boot-Remove-the-bugger-off-message.patch +++ b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.18/z0002-Revert-x86-boot-Remove-the-bugger-off-message.patch @@ -1,7 +1,7 @@ -From 9f34a9ffe5b94aee93baa5762719546e0bebc28d Mon Sep 17 00:00:00 2001 +From 01bcd1ecda9a9a50a97e20c7987a90cda4a0998f Mon Sep 17 00:00:00 2001 From: Kai Lueke Date: Fri, 15 Mar 2024 11:49:50 +0100 -Subject: [PATCH] Revert "x86/boot: Remove the 'bugger off' message" +Subject: [PATCH 2/8] Revert "x86/boot: Remove the 'bugger off' message" This reverts commit 768171d7ebbce005210e1cf8456f043304805c15 because for now this is still needed to store the dm-verity hash. @@ -11,7 +11,7 @@ now this is still needed to store the dm-verity hash. 2 files changed, 52 insertions(+), 4 deletions(-) diff --git a/arch/x86/boot/header.S b/arch/x86/boot/header.S -index a1bbedd989e4..c7624caf6840 100644 +index 9bea5a1e2c52..e929789e2cf4 100644 --- a/arch/x86/boot/header.S +++ b/arch/x86/boot/header.S @@ -41,15 +41,64 @@ SYSSEG = 0x1000 /* historical load address >> 4 */ @@ -23,7 +23,7 @@ index a1bbedd989e4..c7624caf6840 100644 +bootsect_start: #ifdef CONFIG_EFI_STUB # "MZ", MS-DOS header - .word MZ_MAGIC + .word IMAGE_DOS_SIGNATURE +#endif + + # Normalize the start address @@ -77,10 +77,10 @@ index a1bbedd989e4..c7624caf6840 100644 + +#ifdef CONFIG_EFI_STUB pe_header: - .long PE_MAGIC + .long IMAGE_NT_SIGNATURE diff --git a/arch/x86/boot/setup.ld b/arch/x86/boot/setup.ld -index 3a2d1360abb0..c3e354d312d0 100644 +index e1d594a60204..f2dc13420a93 100644 --- a/arch/x86/boot/setup.ld +++ b/arch/x86/boot/setup.ld @@ -10,11 +10,10 @@ ENTRY(_start) @@ -99,5 +99,5 @@ index 3a2d1360abb0..c3e354d312d0 100644 .entrytext : { *(.entrytext) } .inittext : { *(.inittext) } -- -2.44.0 +2.51.0 diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.18/z0003-efi-Add-an-EFI_SECURE_BOOT-flag-to-indicate-secure-b.patch b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.18/z0003-efi-Add-an-EFI_SECURE_BOOT-flag-to-indicate-secure-b.patch new file mode 100644 index 00000000000..12978a8dc0f --- /dev/null +++ b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.18/z0003-efi-Add-an-EFI_SECURE_BOOT-flag-to-indicate-secure-b.patch @@ -0,0 +1,166 @@ +From b8c17d573de9d6c4ae2da1ef51a255a128090a8c Mon Sep 17 00:00:00 2001 +From: David Howells +Date: Mon, 18 Feb 2019 12:45:03 +0000 +Subject: [PATCH 3/8] efi: Add an EFI_SECURE_BOOT flag to indicate secure boot + mode + +UEFI machines can be booted in Secure Boot mode. Add an EFI_SECURE_BOOT +flag that can be passed to efi_enabled() to find out whether secure boot is +enabled. + +Move the switch-statement in x86's setup_arch() that inteprets the +secure_boot boot parameter to generic code and set the bit there. + +Suggested-by: Ard Biesheuvel +Signed-off-by: David Howells +Reviewed-by: Ard Biesheuvel +cc: linux-efi@vger.kernel.org +[rperier: Forward-ported to 5.5: + - Use pr_warn() + - Adjust context] +[bwh: Forward-ported to 5.6: adjust context] +[bwh: Forward-ported to 5.7: + - Use the next available bit in efi.flags + - Adjust context] +--- + arch/x86/kernel/setup.c | 14 +---------- + drivers/firmware/efi/Makefile | 1 + + drivers/firmware/efi/secureboot.c | 39 +++++++++++++++++++++++++++++++ + include/linux/efi.h | 17 ++++++++------ + 4 files changed, 51 insertions(+), 20 deletions(-) + create mode 100644 drivers/firmware/efi/secureboot.c + +diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c +index 1b2edd07a3e1..41b41f677b1e 100644 +--- a/arch/x86/kernel/setup.c ++++ b/arch/x86/kernel/setup.c +@@ -1154,19 +1154,7 @@ void __init setup_arch(char **cmdline_p) + /* Allocate bigger log buffer */ + setup_log_buf(1); + +- if (efi_enabled(EFI_BOOT)) { +- switch (boot_params.secure_boot) { +- case efi_secureboot_mode_disabled: +- pr_info("Secure boot disabled\n"); +- break; +- case efi_secureboot_mode_enabled: +- pr_info("Secure boot enabled\n"); +- break; +- default: +- pr_info("Secure boot could not be determined\n"); +- break; +- } +- } ++ efi_set_secure_boot(boot_params.secure_boot); + + reserve_initrd(); + +diff --git a/drivers/firmware/efi/Makefile b/drivers/firmware/efi/Makefile +index 8efbcf699e4f..96d5a1ca981d 100644 +--- a/drivers/firmware/efi/Makefile ++++ b/drivers/firmware/efi/Makefile +@@ -25,6 +25,7 @@ subdir-$(CONFIG_EFI_STUB) += libstub + obj-$(CONFIG_EFI_BOOTLOADER_CONTROL) += efibc.o + obj-$(CONFIG_EFI_TEST) += test/ + obj-$(CONFIG_EFI_DEV_PATH_PARSER) += dev-path-parser.o ++obj-$(CONFIG_EFI) += secureboot.o + obj-$(CONFIG_APPLE_PROPERTIES) += apple-properties.o + obj-$(CONFIG_EFI_RCI2_TABLE) += rci2-table.o + obj-$(CONFIG_EFI_EMBEDDED_FIRMWARE) += embedded-firmware.o +diff --git a/drivers/firmware/efi/secureboot.c b/drivers/firmware/efi/secureboot.c +new file mode 100644 +index 000000000000..b6620669e32b +--- /dev/null ++++ b/drivers/firmware/efi/secureboot.c +@@ -0,0 +1,39 @@ ++ ++/* Core kernel secure boot support. ++ * ++ * Copyright (C) 2017 Red Hat, Inc. All Rights Reserved. ++ * Written by David Howells (dhowells@redhat.com) ++ * ++ * This program is free software; you can redistribute it and/or ++ * modify it under the terms of the GNU General Public Licence ++ * as published by the Free Software Foundation; either version ++ * 2 of the Licence, or (at your option) any later version. ++ */ ++ ++#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt ++ ++#include ++#include ++#include ++ ++/* ++ * Decide what to do when UEFI secure boot mode is enabled. ++ */ ++void __init efi_set_secure_boot(enum efi_secureboot_mode mode) ++{ ++ if (efi_enabled(EFI_BOOT)) { ++ switch (mode) { ++ case efi_secureboot_mode_disabled: ++ pr_info("Secure boot disabled\n"); ++ break; ++ case efi_secureboot_mode_enabled: ++ set_bit(EFI_SECURE_BOOT, &efi.flags); ++ pr_info("Secure boot enabled\n"); ++ break; ++ default: ++ pr_warn("Secure boot could not be determined (mode %u)\n", ++ mode); ++ break; ++ } ++ } ++} +diff --git a/include/linux/efi.h b/include/linux/efi.h +index a98cc39e7aaa..1d5f8fa07b4d 100644 +--- a/include/linux/efi.h ++++ b/include/linux/efi.h +@@ -865,6 +865,14 @@ static inline int efi_range_is_wc(unsigned long start, unsigned long len) + #define EFI_MEM_ATTR 9 /* Did firmware publish an EFI_MEMORY_ATTRIBUTES table? */ + #define EFI_MEM_NO_SOFT_RESERVE 10 /* Is the kernel configured to ignore soft reservations? */ + #define EFI_PRESERVE_BS_REGIONS 11 /* Are EFI boot-services memory segments available? */ ++#define EFI_SECURE_BOOT 12 /* Are we in Secure Boot mode? */ ++ ++enum efi_secureboot_mode { ++ efi_secureboot_mode_unset, ++ efi_secureboot_mode_unknown, ++ efi_secureboot_mode_disabled, ++ efi_secureboot_mode_enabled, ++}; + + #ifdef CONFIG_EFI + /* +@@ -889,6 +897,7 @@ static inline bool efi_rt_services_supported(unsigned int mask) + return (efi.runtime_supported_mask & mask) == mask; + } + extern void efi_find_mirror(void); ++extern void __init efi_set_secure_boot(enum efi_secureboot_mode mode); + #else + static inline bool efi_enabled(int feature) + { +@@ -908,6 +917,7 @@ static inline bool efi_rt_services_supported(unsigned int mask) + } + + static inline void efi_find_mirror(void) {} ++static inline void efi_set_secure_boot(enum efi_secureboot_mode mode) {} + #endif + + extern int efi_status_to_err(efi_status_t status); +@@ -1126,13 +1136,6 @@ static inline bool efi_runtime_disabled(void) { return true; } + extern void efi_call_virt_check_flags(unsigned long flags, const void *caller); + extern unsigned long efi_call_virt_save_flags(void); + +-enum efi_secureboot_mode { +- efi_secureboot_mode_unset, +- efi_secureboot_mode_unknown, +- efi_secureboot_mode_disabled, +- efi_secureboot_mode_enabled, +-}; +- + static inline + enum efi_secureboot_mode efi_get_secureboot_mode(efi_get_variable_t *get_var) + { +-- +2.51.0 + diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.12/z0004-efi-add-an-efi_secure_boot-flag-to-indicate-secure-b.patch b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.18/z0003-efi-add-an-efi_secure_boot-flag-to-indicate-secure-b.patch similarity index 100% rename from sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.12/z0004-efi-add-an-efi_secure_boot-flag-to-indicate-secure-b.patch rename to sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.18/z0003-efi-add-an-efi_secure_boot-flag-to-indicate-secure-b.patch diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.18/z0004-efi-Lock-down-the-kernel-if-booted-in-secure-boot-mo.patch b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.18/z0004-efi-Lock-down-the-kernel-if-booted-in-secure-boot-mo.patch new file mode 100644 index 00000000000..6c4e43b4ba0 --- /dev/null +++ b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.18/z0004-efi-Lock-down-the-kernel-if-booted-in-secure-boot-mo.patch @@ -0,0 +1,135 @@ +From 994c5501984e4e6ef2577ba148e9aa4a023570d8 Mon Sep 17 00:00:00 2001 +From: Ben Hutchings +Date: Tue, 10 Sep 2019 11:54:28 +0100 +Subject: [PATCH 4/8] efi: Lock down the kernel if booted in secure boot mode + +Based on an earlier patch by David Howells, who wrote the following +description: + +> UEFI Secure Boot provides a mechanism for ensuring that the firmware will +> only load signed bootloaders and kernels. Certain use cases may also +> require that all kernel modules also be signed. Add a configuration option +> that to lock down the kernel - which includes requiring validly signed +> modules - if the kernel is secure-booted. + +Signed-off-by: Ben Hutchings +[Salvatore Bonaccorso: After fixing https://bugs.debian.org/956197 the +help text for LOCK_DOWN_IN_EFI_SECURE_BOOT was adjusted to mention that +lockdown is triggered in integrity mode (https://bugs.debian.org/1025417)] +Signed-off-by: Salvatore Bonaccorso +--- + arch/x86/kernel/setup.c | 4 ++-- + drivers/firmware/efi/secureboot.c | 5 +++++ + include/linux/security.h | 6 ++++++ + security/lockdown/Kconfig | 15 +++++++++++++++ + security/lockdown/lockdown.c | 2 +- + 5 files changed, 29 insertions(+), 3 deletions(-) + +diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c +index 41b41f677b1e..db2b2c2765b7 100644 +--- a/arch/x86/kernel/setup.c ++++ b/arch/x86/kernel/setup.c +@@ -991,6 +991,8 @@ void __init setup_arch(char **cmdline_p) + if (efi_enabled(EFI_BOOT)) + efi_init(); + ++ efi_set_secure_boot(boot_params.secure_boot); ++ + reserve_ibft_region(); + x86_init.resources.dmi_setup(); + +@@ -1154,8 +1156,6 @@ void __init setup_arch(char **cmdline_p) + /* Allocate bigger log buffer */ + setup_log_buf(1); + +- efi_set_secure_boot(boot_params.secure_boot); +- + reserve_initrd(); + + acpi_table_upgrade(); +diff --git a/drivers/firmware/efi/secureboot.c b/drivers/firmware/efi/secureboot.c +index b6620669e32b..8f2554291fb1 100644 +--- a/drivers/firmware/efi/secureboot.c ++++ b/drivers/firmware/efi/secureboot.c +@@ -15,6 +15,7 @@ + #include + #include + #include ++#include + + /* + * Decide what to do when UEFI secure boot mode is enabled. +@@ -28,6 +29,10 @@ void __init efi_set_secure_boot(enum efi_secureboot_mode mode) + break; + case efi_secureboot_mode_enabled: + set_bit(EFI_SECURE_BOOT, &efi.flags); ++#ifdef CONFIG_LOCK_DOWN_IN_EFI_SECURE_BOOT ++ lock_kernel_down("EFI Secure Boot", ++ LOCKDOWN_INTEGRITY_MAX); ++#endif + pr_info("Secure boot enabled\n"); + break; + default: +diff --git a/include/linux/security.h b/include/linux/security.h +index 521bcb5b9717..d139d8ce8849 100644 +--- a/include/linux/security.h ++++ b/include/linux/security.h +@@ -575,6 +575,7 @@ int security_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen); + int security_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen); + int security_inode_getsecctx(struct inode *inode, struct lsm_context *cp); + int security_locked_down(enum lockdown_reason what); ++int lock_kernel_down(const char *where, enum lockdown_reason level); + int lsm_fill_user_ctx(struct lsm_ctx __user *uctx, u32 *uctx_len, + void *val, size_t val_len, u64 id, u64 flags); + int security_bdev_alloc(struct block_device *bdev); +@@ -1588,6 +1589,11 @@ static inline int security_locked_down(enum lockdown_reason what) + { + return 0; + } ++static inline int ++lock_kernel_down(const char *where, enum lockdown_reason level) ++{ ++ return -EOPNOTSUPP; ++} + static inline int lsm_fill_user_ctx(struct lsm_ctx __user *uctx, + u32 *uctx_len, void *val, size_t val_len, + u64 id, u64 flags) +diff --git a/security/lockdown/Kconfig b/security/lockdown/Kconfig +index e84ddf484010..4175b50b1e6e 100644 +--- a/security/lockdown/Kconfig ++++ b/security/lockdown/Kconfig +@@ -45,3 +45,18 @@ config LOCK_DOWN_KERNEL_FORCE_CONFIDENTIALITY + disabled. + + endchoice ++ ++config LOCK_DOWN_IN_EFI_SECURE_BOOT ++ bool "Lock down the kernel in EFI Secure Boot mode" ++ default n ++ depends on SECURITY_LOCKDOWN_LSM ++ depends on EFI ++ select SECURITY_LOCKDOWN_LSM_EARLY ++ help ++ UEFI Secure Boot provides a mechanism for ensuring that the firmware ++ will only load signed bootloaders and kernels. Secure boot mode may ++ be determined from EFI variables provided by the system firmware if ++ not indicated by the boot parameters. ++ ++ Enabling this option results in kernel lockdown being ++ triggered in integrity mode if EFI Secure Boot is set. +diff --git a/security/lockdown/lockdown.c b/security/lockdown/lockdown.c +index cf83afa1d879..5ff10bd656d2 100644 +--- a/security/lockdown/lockdown.c ++++ b/security/lockdown/lockdown.c +@@ -24,7 +24,7 @@ static const enum lockdown_reason lockdown_levels[] = {LOCKDOWN_NONE, + /* + * Put the kernel into lock-down mode. + */ +-static int lock_kernel_down(const char *where, enum lockdown_reason level) ++int lock_kernel_down(const char *where, enum lockdown_reason level) + { + if (kernel_locked_down >= level) + return -EPERM; +-- +2.51.0 + diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.12/z0005-efi-lock-down-the-kernel-if-booted-in-secure-boot-mo.patch b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.18/z0004-efi-lock-down-the-kernel-if-booted-in-secure-boot-mo.patch similarity index 100% rename from sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.12/z0005-efi-lock-down-the-kernel-if-booted-in-secure-boot-mo.patch rename to sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.18/z0004-efi-lock-down-the-kernel-if-booted-in-secure-boot-mo.patch diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.12/z0006-mtd-disable-slram-and-phram-when-locked-down.patch b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.18/z0005-mtd-disable-slram-and-phram-when-locked-do.patch similarity index 100% rename from sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.12/z0006-mtd-disable-slram-and-phram-when-locked-down.patch rename to sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.18/z0005-mtd-disable-slram-and-phram-when-locked-do.patch diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.18/z0005-mtd-phram-slram-Disable-when-the-kernel-is-locked-do.patch b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.18/z0005-mtd-phram-slram-Disable-when-the-kernel-is-locked-do.patch new file mode 100644 index 00000000000..6b62bcb57d8 --- /dev/null +++ b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.18/z0005-mtd-phram-slram-Disable-when-the-kernel-is-locked-do.patch @@ -0,0 +1,82 @@ +From 06ae62500c1e2bb641b8f16eb9313a41c4061ab9 Mon Sep 17 00:00:00 2001 +From: Ben Hutchings +Date: Fri, 30 Aug 2019 15:54:24 +0100 +Subject: [PATCH 5/8] mtd: phram,slram: Disable when the kernel is locked down + +These drivers allow mapping arbitrary memory ranges as MTD devices. +This should be disabled to preserve the kernel's integrity when it is +locked down. + +* Add the HWPARAM flag to the module parameters +* When slram is built-in, it uses __setup() to read kernel parameters, + so add an explicit check security_locked_down() check + +Signed-off-by: Ben Hutchings +Cc: Matthew Garrett +Cc: David Howells +Cc: Joern Engel +Cc: linux-mtd@lists.infradead.org +--- + drivers/mtd/devices/phram.c | 6 +++++- + drivers/mtd/devices/slram.c | 9 ++++++++- + 2 files changed, 13 insertions(+), 2 deletions(-) + +diff --git a/drivers/mtd/devices/phram.c b/drivers/mtd/devices/phram.c +index fd9ec165e61a..8652139ecbe9 100644 +--- a/drivers/mtd/devices/phram.c ++++ b/drivers/mtd/devices/phram.c +@@ -365,7 +365,11 @@ static int phram_param_call(const char *val, const struct kernel_param *kp) + #endif + } + +-module_param_call(phram, phram_param_call, NULL, NULL, 0200); ++static const struct kernel_param_ops phram_param_ops = { ++ .set = phram_param_call ++}; ++__module_param_call(MODULE_PARAM_PREFIX, phram, &phram_param_ops, NULL, ++ 0200, -1, KERNEL_PARAM_FL_HWPARAM | hwparam_iomem); + MODULE_PARM_DESC(phram, "Memory region to map. \"phram=,,[,]\""); + + #ifdef CONFIG_OF +diff --git a/drivers/mtd/devices/slram.c b/drivers/mtd/devices/slram.c +index 8297b366a066..9f762d988c0b 100644 +--- a/drivers/mtd/devices/slram.c ++++ b/drivers/mtd/devices/slram.c +@@ -43,6 +43,7 @@ + #include + #include + #include ++#include + + #include + +@@ -65,7 +66,7 @@ typedef struct slram_mtd_list { + #ifdef MODULE + static char *map[SLRAM_MAX_DEVICES_PARAMS]; + +-module_param_array(map, charp, NULL, 0); ++module_param_hw_array(map, charp, iomem, NULL, 0); + MODULE_PARM_DESC(map, "List of memory regions to map. \"map=, , \""); + #else + static char *map; +@@ -281,11 +282,17 @@ static int __init init_slram(void) + #ifndef MODULE + char *devstart; + char *devlength; ++ int ret; + + if (!map) { + E("slram: not enough parameters.\n"); + return(-EINVAL); + } ++ ++ ret = security_locked_down(LOCKDOWN_MODULE_PARAMETERS); ++ if (ret) ++ return ret; ++ + while (map) { + devname = devstart = devlength = NULL; + +-- +2.51.0 + diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.12/z0007-arm64-add-kernel-config-option-to-lock-down-when.patch b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.18/z0006-arm64-add-kernel-config-option-to-lock-down-when-in-.patch similarity index 76% rename from sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.12/z0007-arm64-add-kernel-config-option-to-lock-down-when.patch rename to sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.18/z0006-arm64-add-kernel-config-option-to-lock-down-when-in-.patch index 61b7040971f..62be9cbd0d5 100644 --- a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.12/z0007-arm64-add-kernel-config-option-to-lock-down-when.patch +++ b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.18/z0006-arm64-add-kernel-config-option-to-lock-down-when-in-.patch @@ -1,8 +1,8 @@ +From ddb2f010a8a881d181bce3b8961ad92117f4e8bb Mon Sep 17 00:00:00 2001 From: Linn Crosetto Date: Tue, 30 Aug 2016 11:54:38 -0600 -Subject: arm64: add kernel config option to lock down when in Secure Boot mode -Bug-Debian: https://bugs.debian.org/831827 -Forwarded: no +Subject: [PATCH 6/8] arm64: add kernel config option to lock down when in + Secure Boot mode Add a kernel configuration option to lock down the kernel, to restrict userspace's ability to modify the running kernel when UEFI Secure Boot is @@ -32,12 +32,14 @@ Signed-off-by: Linn Crosetto [Salvatore Bonaccorso: Forward-ported to 5.10: f30f242fb131 ("efi: Rename arm-init to efi-init common for all arch") renamed arm-init.c to efi-init.c] --- - drivers/firmware/efi/efi-init.c | 5 ++++- - drivers/firmware/efi/fdtparams.c | 12 +++++++++++- - drivers/firmware/efi/libstub/fdt.c | 6 ++++++ - include/linux/efi.h | 3 ++- + drivers/firmware/efi/efi-init.c | 5 ++++- + drivers/firmware/efi/fdtparams.c | 12 +++++++++++- + drivers/firmware/efi/libstub/fdt.c | 6 ++++++ + include/linux/efi.h | 3 ++- 4 files changed, 23 insertions(+), 3 deletions(-) +diff --git a/drivers/firmware/efi/efi-init.c b/drivers/firmware/efi/efi-init.c +index a00e07b853f2..8a0390d8da98 100644 --- a/drivers/firmware/efi/efi-init.c +++ b/drivers/firmware/efi/efi-init.c @@ -213,9 +213,10 @@ void __init efi_init(void) @@ -61,6 +63,8 @@ arm-init to efi-init common for all arch") renamed arm-init.c to efi-init.c] reserve_regions(); /* * For memblock manipulation, the cap should come after the memblock_add(). +diff --git a/drivers/firmware/efi/fdtparams.c b/drivers/firmware/efi/fdtparams.c +index b815d2a754ee..69a2eb539d38 100644 --- a/drivers/firmware/efi/fdtparams.c +++ b/drivers/firmware/efi/fdtparams.c @@ -16,6 +16,7 @@ enum { @@ -71,7 +75,7 @@ arm-init to efi-init common for all arch") renamed arm-init.c to efi-init.c] PARAMCOUNT }; -@@ -26,6 +27,7 @@ static __initconst const char name[][22] +@@ -26,6 +27,7 @@ static __initconst const char name[][22] = { [MMSIZE] = "MemMap Size ", [DCSIZE] = "MemMap Desc. Size ", [DCVERS] = "MemMap Desc. Version ", @@ -95,7 +99,7 @@ arm-init to efi-init common for all arch") renamed arm-init.c to efi-init.c] } } }; -@@ -64,6 +68,11 @@ static int __init efi_get_fdt_prop(const +@@ -64,6 +68,11 @@ static int __init efi_get_fdt_prop(const void *fdt, int node, const char *pname, int len; u64 val; @@ -107,7 +111,7 @@ arm-init to efi-init common for all arch") renamed arm-init.c to efi-init.c] prop = fdt_getprop(fdt, node, pname, &len); if (!prop) return 1; -@@ -81,7 +90,7 @@ static int __init efi_get_fdt_prop(const +@@ -81,7 +90,7 @@ static int __init efi_get_fdt_prop(const void *fdt, int node, const char *pname, return 0; } @@ -116,7 +120,7 @@ arm-init to efi-init common for all arch") renamed arm-init.c to efi-init.c] { const void *fdt = initial_boot_params; unsigned long systab; -@@ -95,6 +104,7 @@ u64 __init efi_get_fdt_params(struct efi +@@ -95,6 +104,7 @@ u64 __init efi_get_fdt_params(struct efi_memory_map_data *mm) [MMSIZE] = { &mm->size, sizeof(mm->size) }, [DCSIZE] = { &mm->desc_size, sizeof(mm->desc_size) }, [DCVERS] = { &mm->desc_version, sizeof(mm->desc_version) }, @@ -124,9 +128,11 @@ arm-init to efi-init common for all arch") renamed arm-init.c to efi-init.c] }; BUILD_BUG_ON(ARRAY_SIZE(target) != ARRAY_SIZE(name)); +diff --git a/drivers/firmware/efi/libstub/fdt.c b/drivers/firmware/efi/libstub/fdt.c +index 6a337f1f8787..6c679da644dd 100644 --- a/drivers/firmware/efi/libstub/fdt.c +++ b/drivers/firmware/efi/libstub/fdt.c -@@ -132,6 +132,12 @@ static efi_status_t update_fdt(void *ori +@@ -132,6 +132,12 @@ static efi_status_t update_fdt(void *orig_fdt, unsigned long orig_fdt_size, } } @@ -139,9 +145,11 @@ arm-init to efi-init common for all arch") renamed arm-init.c to efi-init.c] /* Shrink the FDT back to its minimum size: */ fdt_pack(fdt); +diff --git a/include/linux/efi.h b/include/linux/efi.h +index 1d5f8fa07b4d..6e826b53a0ce 100644 --- a/include/linux/efi.h +++ b/include/linux/efi.h -@@ -764,7 +764,8 @@ extern int efi_mem_desc_lookup(u64 phys_ +@@ -755,7 +755,8 @@ extern int efi_mem_desc_lookup(u64 phys_addr, efi_memory_desc_t *out_md); extern int __efi_mem_desc_lookup(u64 phys_addr, efi_memory_desc_t *out_md); extern void efi_mem_reserve(phys_addr_t addr, u64 size); extern int efi_mem_reserve_persistent(phys_addr_t addr, u64 size); @@ -151,3 +159,6 @@ arm-init to efi-init common for all arch") renamed arm-init.c to efi-init.c] extern struct kobject *efi_kobj; extern int efi_reboot_quirk_mode; +-- +2.51.0 + diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.18/z0007-tools-hv-fix-cross-compilation.patch b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.18/z0007-tools-hv-fix-cross-compilation.patch new file mode 100644 index 00000000000..3fb2dd48f09 --- /dev/null +++ b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.18/z0007-tools-hv-fix-cross-compilation.patch @@ -0,0 +1,45 @@ +From ca5ee0e918115fb5cf626d75461d9fca06e06caf Mon Sep 17 00:00:00 2001 +From: Aditya Garg +Date: Thu, 9 Apr 2026 03:32:18 -0700 +Subject: [PATCH] tools: hv: Fix cross-compilation + +Use the native ARCH only in case it is not set, this will allow the +cross-compilation where ARCH is explicitly set. + +Additionally, simplify the ARCH check to build the fcopy daemon only +for x86 and x86_64. + +Fixes: 82b0945ce2c2 ("tools: hv: Add new fcopy application based on uio driver") +Reported-by: Adrian Vladu +Closes: https://lore.kernel.org/linux-hyperv/PR3PR09MB54119DB2FD76977C62D8DD6AB04D2@PR3PR09MB5411.eurprd09.prod.outlook.com/ +Co-developed-by: Saurabh Sengar +Signed-off-by: Saurabh Sengar +Signed-off-by: Aditya Garg +Reviewed-by: Roman Kisel +Signed-off-by: Wei Liu +--- + tools/hv/Makefile | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/tools/hv/Makefile b/tools/hv/Makefile +index 34ffcec264ab0f..016753f3dd7f61 100644 +--- a/tools/hv/Makefile ++++ b/tools/hv/Makefile +@@ -2,7 +2,7 @@ + # Makefile for Hyper-V tools + include ../scripts/Makefile.include + +-ARCH := $(shell uname -m 2>/dev/null) ++ARCH ?= $(shell uname -m 2>/dev/null) + sbindir ?= /usr/sbin + libexecdir ?= /usr/libexec + sharedstatedir ?= /var/lib +@@ -20,7 +20,7 @@ override CFLAGS += -O2 -Wall -g -D_GNU_SOURCE -I$(OUTPUT)include + override CFLAGS += -Wno-address-of-packed-member + + ALL_TARGETS := hv_kvp_daemon hv_vss_daemon +-ifneq ($(ARCH), aarch64) ++ifneq ($(filter x86_64 x86,$(ARCH)),) + ALL_TARGETS += hv_fcopy_uio_daemon + endif + ALL_PROGRAMS := $(patsubst %,$(OUTPUT)%,$(ALL_TARGETS)) diff --git a/sdk_container/src/third_party/coreos-overlay/x11-drivers/old-nvidia-drivers/files/0001-mm-use-vm_flags_reset-to-avoid-GPL-only-vma_start_wr.patch b/sdk_container/src/third_party/coreos-overlay/x11-drivers/old-nvidia-drivers/files/0001-mm-use-vm_flags_reset-to-avoid-GPL-only-vma_start_wr.patch new file mode 100644 index 00000000000..32c494fc3e3 --- /dev/null +++ b/sdk_container/src/third_party/coreos-overlay/x11-drivers/old-nvidia-drivers/files/0001-mm-use-vm_flags_reset-to-avoid-GPL-only-vma_start_wr.patch @@ -0,0 +1,155 @@ +From d1154945f8b2d22392d30a5e522612dfbcf17cff Mon Sep 17 00:00:00 2001 +From: Sayan Chowdhury +Date: Wed, 17 Jun 2026 15:48:55 +0530 +Subject: [PATCH 1/2] mm: use vm_flags_reset to avoid GPL-only + vma_start_write() + +Linux 6.15 made vma_start_write() GPL-only, which nv_vm_flags_set/clear +depend on via vm_flags_set/vm_flags_clear. Redefine them using +vm_flags_reset which carries no such restriction. + +Applied to both the proprietary kernel/ and open-source kernel-open/ trees. + +Signed-off-by: Sayan Chowdhury +--- + kernel-open/nvidia-drm/nvidia-drm-gem-user-memory.c | 7 +++++++ + kernel-open/nvidia-drm/nvidia-drm-gem.c | 7 +++++++ + kernel-open/nvidia/nv-mmap.c | 7 +++++++ + kernel/nvidia-drm/nvidia-drm-gem-user-memory.c | 7 +++++++ + kernel/nvidia-drm/nvidia-drm-gem.c | 7 +++++++ + kernel/nvidia/nv-mmap.c | 7 +++++++ + 6 files changed, 42 insertions(+) + +diff --git a/kernel-module-source/kernel-open/nvidia-drm/nvidia-drm-gem-user-memory.c b/kernel-module-source/kernel-open/nvidia-drm/nvidia-drm-gem-user-memory.c +index 9d2a0512..e473b66f 100644 +--- a/kernel-module-source/kernel-open/nvidia-drm/nvidia-drm-gem-user-memory.c ++++ b/kernel-module-source/kernel-open/nvidia-drm/nvidia-drm-gem-user-memory.c +@@ -40,6 +40,13 @@ + #include + #endif + ++#include ++ ++#if LINUX_VERSION_CODE >= KERNEL_VERSION(6, 15, 0) ++#define nv_vm_flags_set(vma, f) vm_flags_reset((vma), (vma)->vm_flags | (f)) ++#define nv_vm_flags_clear(vma, f) vm_flags_reset((vma), (vma)->vm_flags & ~(f)) ++#endif ++ + static inline + void __nv_drm_gem_user_memory_free(struct nv_drm_gem_object *nv_gem) + { +diff --git a/kernel-module-source/kernel-open/nvidia-drm/nvidia-drm-gem.c b/kernel-module-source/kernel-open/nvidia-drm/nvidia-drm-gem.c +index ef0e0f83..c8489a72 100644 +--- a/kernel-module-source/kernel-open/nvidia-drm/nvidia-drm-gem.c ++++ b/kernel-module-source/kernel-open/nvidia-drm/nvidia-drm-gem.c +@@ -51,6 +51,13 @@ + + #include "nv-mm.h" + ++#include ++ ++#if LINUX_VERSION_CODE >= KERNEL_VERSION(6, 15, 0) ++#define nv_vm_flags_set(vma, f) vm_flags_reset((vma), (vma)->vm_flags | (f)) ++#define nv_vm_flags_clear(vma, f) vm_flags_reset((vma), (vma)->vm_flags & ~(f)) ++#endif ++ + void nv_drm_gem_free(struct drm_gem_object *gem) + { + struct nv_drm_gem_object *nv_gem = to_nv_gem_object(gem); +diff --git a/kernel-module-source/kernel-open/nvidia/nv-mmap.c b/kernel-module-source/kernel-open/nvidia/nv-mmap.c +index 8e98c817..f72731c0 100644 +--- a/kernel-module-source/kernel-open/nvidia/nv-mmap.c ++++ b/kernel-module-source/kernel-open/nvidia/nv-mmap.c +@@ -25,6 +25,13 @@ + + #include "os-interface.h" + #include "nv-linux.h" ++ ++#include ++ ++#if LINUX_VERSION_CODE >= KERNEL_VERSION(6, 15, 0) ++#define nv_vm_flags_set(vma, f) vm_flags_reset((vma), (vma)->vm_flags | (f)) ++#define nv_vm_flags_clear(vma, f) vm_flags_reset((vma), (vma)->vm_flags & ~(f)) ++#endif + #include "nv_speculation_barrier.h" + + /* +diff --git a/kernel-module-source/kernel-open/nvidia-uvm/uvm.c b/kernel-module-source/kernel-open/nvidia-uvm/uvm.c +index 1a2b3c4d..5e6f7a8b 100644 +--- a/kernel-module-source/kernel-open/nvidia-uvm/uvm.c ++++ b/kernel-module-source/kernel-open/nvidia-uvm/uvm.c +@@ -21,6 +21,8 @@ + + *******************************************************************************/ + ++#include ++ + #include "uvm_api.h" + #include "uvm_global.h" + #include "uvm_gpu_replayable_faults.h" +@@ -40,4 +42,9 @@ + + #define NVIDIA_UVM_DEVICE_NAME "nvidia-uvm" + ++#if LINUX_VERSION_CODE >= KERNEL_VERSION(6, 15, 0) ++#define nv_vm_flags_set(v, f) vm_flags_reset((v), (v)->vm_flags | (f)) ++#define nv_vm_flags_clear(v, f) vm_flags_reset((v), (v)->vm_flags & ~(f)) ++#endif ++ + static dev_t g_uvm_base_dev; +diff --git a/kernel/nvidia-drm/nvidia-drm-gem-user-memory.c b/kernel/nvidia-drm/nvidia-drm-gem-user-memory.c +index 9d2a0512..e473b66f 100644 +--- a/kernel/nvidia-drm/nvidia-drm-gem-user-memory.c ++++ b/kernel/nvidia-drm/nvidia-drm-gem-user-memory.c +@@ -40,6 +40,13 @@ + #include + #endif + ++#include ++ ++#if LINUX_VERSION_CODE >= KERNEL_VERSION(6, 15, 0) ++#define nv_vm_flags_set(vma, f) vm_flags_reset((vma), (vma)->vm_flags | (f)) ++#define nv_vm_flags_clear(vma, f) vm_flags_reset((vma), (vma)->vm_flags & ~(f)) ++#endif ++ + static inline + void __nv_drm_gem_user_memory_free(struct nv_drm_gem_object *nv_gem) + { +diff --git a/kernel/nvidia-drm/nvidia-drm-gem.c b/kernel/nvidia-drm/nvidia-drm-gem.c +index ef0e0f83..c8489a72 100644 +--- a/kernel/nvidia-drm/nvidia-drm-gem.c ++++ b/kernel/nvidia-drm/nvidia-drm-gem.c +@@ -51,6 +51,13 @@ + + #include "nv-mm.h" + ++#include ++ ++#if LINUX_VERSION_CODE >= KERNEL_VERSION(6, 15, 0) ++#define nv_vm_flags_set(vma, f) vm_flags_reset((vma), (vma)->vm_flags | (f)) ++#define nv_vm_flags_clear(vma, f) vm_flags_reset((vma), (vma)->vm_flags & ~(f)) ++#endif ++ + void nv_drm_gem_free(struct drm_gem_object *gem) + { + struct nv_drm_gem_object *nv_gem = to_nv_gem_object(gem); +diff --git a/kernel/nvidia/nv-mmap.c b/kernel/nvidia/nv-mmap.c +index 8e98c817..f72731c0 100644 +--- a/kernel/nvidia/nv-mmap.c ++++ b/kernel/nvidia/nv-mmap.c +@@ -25,6 +25,13 @@ + + #include "os-interface.h" + #include "nv-linux.h" ++ ++#include ++ ++#if LINUX_VERSION_CODE >= KERNEL_VERSION(6, 15, 0) ++#define nv_vm_flags_set(vma, f) vm_flags_reset((vma), (vma)->vm_flags | (f)) ++#define nv_vm_flags_clear(vma, f) vm_flags_reset((vma), (vma)->vm_flags & ~(f)) ++#endif + #include "nv_speculation_barrier.h" + + /* +-- +2.53.0 diff --git a/sdk_container/src/third_party/coreos-overlay/x11-drivers/old-nvidia-drivers/files/0002-nvidia-drm-550.163.01-pass-drm_format_info-to-nv_drm.patch b/sdk_container/src/third_party/coreos-overlay/x11-drivers/old-nvidia-drivers/files/0002-nvidia-drm-550.163.01-pass-drm_format_info-to-nv_drm.patch new file mode 100644 index 00000000000..34aa1d59103 --- /dev/null +++ b/sdk_container/src/third_party/coreos-overlay/x11-drivers/old-nvidia-drivers/files/0002-nvidia-drm-550.163.01-pass-drm_format_info-to-nv_drm.patch @@ -0,0 +1,280 @@ +From 828e2d5aa8808f34030a726fb5f1038ea474add7 Mon Sep 17 00:00:00 2001 +From: Sayan Chowdhury +Date: Wed, 17 Jun 2026 16:45:03 +0530 +Subject: [PATCH 2/2] nvidia-drm 550.163.01: pass drm_format_info to + nv_drm_framebuffer_create for Linux 6.17+ + +Linux kernel commit 81112eaac559 ("drm: Pass the format info to +.fb_create()") changed drm_mode_config_funcs.fb_create to take a 4th +argument: const struct drm_format_info *info + +This landed in v6.17-rc1; we hit it while updating our build target +to Linux 6.18, which carries the same API forward. + +Simultaneously, drm_helper_mode_fill_fb_struct() gained the same +parameter between the framebuffer and the mode_cmd arguments (4 args +total with dev). + +Use a conftest probe (NV_DRM_FB_CREATE_TAKES_FORMAT_INFO) rather than +a hardcoded LINUX_VERSION_CODE check, since this detects the feature +directly against the actual kernel headers and remains correct for +backports or non-standard kernel versioning. + +Applied to both the proprietary kernel/ and open-source kernel-open/ trees. + +Signed-off-by: Sayan Chowdhury +--- + kernel-open/conftest.sh | 19 +++++++++++++++++++ + kernel-open/nvidia-drm/nvidia-drm-drv.c | 6 ++++++ + kernel-open/nvidia-drm/nvidia-drm-fb.c | 7 +++++++ + kernel-open/nvidia-drm/nvidia-drm-fb.h | 4 ++++ + kernel-open/nvidia-drm/nvidia-drm-sources.mk | 1 + + kernel/conftest.sh | 19 +++++++++++++++++++ + kernel/nvidia-drm/nvidia-drm-drv.c | 6 ++++++ + kernel/nvidia-drm/nvidia-drm-fb.c | 7 +++++++ + kernel/nvidia-drm/nvidia-drm-fb.h | 4 ++++ + kernel/nvidia-drm/nvidia-drm-sources.mk | 1 + + 10 files changed, 74 insertions(+) + +diff --git a/kernel-module-source/kernel-open/conftest.sh b/kernel-module-source/kernel-open/conftest.sh +index 889cf654..30506f8f 100755 +--- a/kernel-module-source/kernel-open/conftest.sh ++++ b/kernel-module-source/kernel-open/conftest.sh +@@ -4511,6 +4511,25 @@ compile_test() { + compile_check_conftest "$CODE" "NV_DRM_ROTATION_AVAILABLE" "" "functions" + ;; + ++ drm_fb_create_takes_format_info) ++ # ++ # Determine if a `struct drm_format_info *` is passed into ++ # the .fb_create callback (4-arg form). Added by commit ++ # 81112eaac559 ("drm: Pass the format info to .fb_create") ++ # in linux-next (2025-07-16). ++ # ++ CODE=" ++ #include ++ #include ++ ++ static const struct drm_mode_config_funcs funcs; ++ void conftest_drm_fb_create_takes_format_info(void) { ++ funcs.fb_create(NULL, NULL, NULL, NULL); ++ }" ++ ++ compile_check_conftest "$CODE" "NV_DRM_FB_CREATE_TAKES_FORMAT_INFO" "" "types" ++ ;; ++ + drm_driver_prime_flag_present) + # + # Determine whether driver feature flag DRIVER_PRIME is present. +diff --git a/kernel-module-source/kernel-open/nvidia-drm/nvidia-drm-drv.c b/kernel-module-source/kernel-open/nvidia-drm/nvidia-drm-drv.c +index da2b7010..12fe50ef 100644 +--- a/kernel-module-source/kernel-open/nvidia-drm/nvidia-drm-drv.c ++++ b/kernel-module-source/kernel-open/nvidia-drm/nvidia-drm-drv.c +@@ -186,6 +186,9 @@ static void nv_drm_output_poll_changed(struct drm_device *dev) + static struct drm_framebuffer *nv_drm_framebuffer_create( + struct drm_device *dev, + struct drm_file *file, ++#if defined(NV_DRM_FB_CREATE_TAKES_FORMAT_INFO) ++ const struct drm_format_info *info, ++#endif + #if defined(NV_DRM_HELPER_MODE_FILL_FB_STRUCT_HAS_CONST_MODE_CMD_ARG) + const struct drm_mode_fb_cmd2 *cmd + #else +@@ -201,6 +204,9 @@ static struct drm_framebuffer *nv_drm_framebuffer_create( + fb = nv_drm_internal_framebuffer_create( + dev, + file, ++#if defined(NV_DRM_FB_CREATE_TAKES_FORMAT_INFO) ++ info, ++#endif + &local_cmd); + + #if !defined(NV_DRM_HELPER_MODE_FILL_FB_STRUCT_HAS_CONST_MODE_CMD_ARG) +diff --git a/kernel-module-source/kernel-open/nvidia-drm/nvidia-drm-fb.c b/kernel-module-source/kernel-open/nvidia-drm/nvidia-drm-fb.c +index 1c842015..973c2c64 100644 +--- a/kernel-module-source/kernel-open/nvidia-drm/nvidia-drm-fb.c ++++ b/kernel-module-source/kernel-open/nvidia-drm/nvidia-drm-fb.c +@@ -33,6 +33,7 @@ + #include "nvidia-drm-format.h" + + #include ++#include + + static void __nv_drm_framebuffer_free(struct nv_drm_framebuffer *nv_fb) + { +@@ -206,6 +207,9 @@ fail: + struct drm_framebuffer *nv_drm_internal_framebuffer_create( + struct drm_device *dev, + struct drm_file *file, ++#if defined(NV_DRM_FB_CREATE_TAKES_FORMAT_INFO) ++ const struct drm_format_info *info, ++#endif + struct drm_mode_fb_cmd2 *cmd) + { + struct nv_drm_device *nv_dev = to_nv_device(dev); +@@ -259,6 +263,9 @@ struct drm_framebuffer *nv_drm_internal_framebuffer_create( + dev, + #endif + &nv_fb->base, ++ #if defined(NV_DRM_FB_CREATE_TAKES_FORMAT_INFO) ++ info, ++ #endif + cmd); + + /* +diff --git a/kernel-module-source/kernel-open/nvidia-drm/nvidia-drm-fb.h b/kernel-module-source/kernel-open/nvidia-drm/nvidia-drm-fb.h +index cf477cc7..5a1a34af 100644 +--- a/kernel-module-source/kernel-open/nvidia-drm/nvidia-drm-fb.h ++++ b/kernel-module-source/kernel-open/nvidia-drm/nvidia-drm-fb.h +@@ -37,6 +37,7 @@ + + #include "nvidia-drm-gem-nvkms-memory.h" + #include "nvkms-kapi.h" ++#include + + struct nv_drm_framebuffer { + struct NvKmsKapiSurface *pSurface; +@@ -59,6 +60,9 @@ static inline struct nv_drm_framebuffer *to_nv_framebuffer( + struct drm_framebuffer *nv_drm_internal_framebuffer_create( + struct drm_device *dev, + struct drm_file *file, ++#if LINUX_VERSION_CODE >= KERNEL_VERSION(6, 17, 0) ++ const struct drm_format_info *info, ++#endif + struct drm_mode_fb_cmd2 *cmd); + + #endif /* NV_DRM_ATOMIC_MODESET_AVAILABLE */ +diff --git a/kernel-module-source/kernel-open/nvidia-drm/nvidia-drm-sources.mk b/kernel-module-source/kernel-open/nvidia-drm/nvidia-drm-sources.mk +index 1328ffd8..4ccaf27b 100644 +--- a/kernel-module-source/kernel-open/nvidia-drm/nvidia-drm-sources.mk ++++ b/kernel-module-source/kernel-open/nvidia-drm/nvidia-drm-sources.mk +@@ -86,6 +86,7 @@ NV_CONFTEST_TYPE_COMPILE_TESTS += drm_driver_has_set_busid + NV_CONFTEST_TYPE_COMPILE_TESTS += drm_crtc_state_has_connectors_changed + NV_CONFTEST_TYPE_COMPILE_TESTS += drm_init_function_args + NV_CONFTEST_TYPE_COMPILE_TESTS += drm_helper_mode_fill_fb_struct ++NV_CONFTEST_TYPE_COMPILE_TESTS += drm_fb_create_takes_format_info + NV_CONFTEST_TYPE_COMPILE_TESTS += drm_master_drop_has_from_release_arg + NV_CONFTEST_TYPE_COMPILE_TESTS += drm_driver_unload_has_int_return_type + NV_CONFTEST_TYPE_COMPILE_TESTS += vm_fault_has_address +diff --git a/kernel/conftest.sh b/kernel/conftest.sh +index 889cf654..30506f8f 100755 +--- a/kernel/conftest.sh ++++ b/kernel/conftest.sh +@@ -4511,6 +4511,25 @@ compile_test() { + compile_check_conftest "$CODE" "NV_DRM_ROTATION_AVAILABLE" "" "functions" + ;; + ++ drm_fb_create_takes_format_info) ++ # ++ # Determine if a `struct drm_format_info *` is passed into ++ # the .fb_create callback (4-arg form). Added by commit ++ # 81112eaac559 ("drm: Pass the format info to .fb_create") ++ # in linux-next (2025-07-16). ++ # ++ CODE=" ++ #include ++ #include ++ ++ static const struct drm_mode_config_funcs funcs; ++ void conftest_drm_fb_create_takes_format_info(void) { ++ funcs.fb_create(NULL, NULL, NULL, NULL); ++ }" ++ ++ compile_check_conftest "$CODE" "NV_DRM_FB_CREATE_TAKES_FORMAT_INFO" "" "types" ++ ;; ++ + drm_driver_prime_flag_present) + # + # Determine whether driver feature flag DRIVER_PRIME is present. +diff --git a/kernel/nvidia-drm/nvidia-drm-drv.c b/kernel/nvidia-drm/nvidia-drm-drv.c +index da2b7010..12fe50ef 100644 +--- a/kernel/nvidia-drm/nvidia-drm-drv.c ++++ b/kernel/nvidia-drm/nvidia-drm-drv.c +@@ -186,6 +186,9 @@ static void nv_drm_output_poll_changed(struct drm_device *dev) + static struct drm_framebuffer *nv_drm_framebuffer_create( + struct drm_device *dev, + struct drm_file *file, ++#if defined(NV_DRM_FB_CREATE_TAKES_FORMAT_INFO) ++ const struct drm_format_info *info, ++#endif + #if defined(NV_DRM_HELPER_MODE_FILL_FB_STRUCT_HAS_CONST_MODE_CMD_ARG) + const struct drm_mode_fb_cmd2 *cmd + #else +@@ -201,6 +204,9 @@ static struct drm_framebuffer *nv_drm_framebuffer_create( + fb = nv_drm_internal_framebuffer_create( + dev, + file, ++#if defined(NV_DRM_FB_CREATE_TAKES_FORMAT_INFO) ++ info, ++#endif + &local_cmd); + + #if !defined(NV_DRM_HELPER_MODE_FILL_FB_STRUCT_HAS_CONST_MODE_CMD_ARG) +diff --git a/kernel/nvidia-drm/nvidia-drm-fb.c b/kernel/nvidia-drm/nvidia-drm-fb.c +index 1c842015..973c2c64 100644 +--- a/kernel/nvidia-drm/nvidia-drm-fb.c ++++ b/kernel/nvidia-drm/nvidia-drm-fb.c +@@ -33,6 +33,7 @@ + #include "nvidia-drm-format.h" + + #include ++#include + + static void __nv_drm_framebuffer_free(struct nv_drm_framebuffer *nv_fb) + { +@@ -206,6 +207,9 @@ fail: + struct drm_framebuffer *nv_drm_internal_framebuffer_create( + struct drm_device *dev, + struct drm_file *file, ++#if defined(NV_DRM_FB_CREATE_TAKES_FORMAT_INFO) ++ const struct drm_format_info *info, ++#endif + struct drm_mode_fb_cmd2 *cmd) + { + struct nv_drm_device *nv_dev = to_nv_device(dev); +@@ -259,6 +263,9 @@ struct drm_framebuffer *nv_drm_internal_framebuffer_create( + dev, + #endif + &nv_fb->base, ++ #if defined(NV_DRM_FB_CREATE_TAKES_FORMAT_INFO) ++ info, ++ #endif + cmd); + + /* +diff --git a/kernel/nvidia-drm/nvidia-drm-fb.h b/kernel/nvidia-drm/nvidia-drm-fb.h +index cf477cc7..5a1a34af 100644 +--- a/kernel/nvidia-drm/nvidia-drm-fb.h ++++ b/kernel/nvidia-drm/nvidia-drm-fb.h +@@ -37,6 +37,7 @@ + + #include "nvidia-drm-gem-nvkms-memory.h" + #include "nvkms-kapi.h" ++#include + + struct nv_drm_framebuffer { + struct NvKmsKapiSurface *pSurface; +@@ -59,6 +60,9 @@ static inline struct nv_drm_framebuffer *to_nv_framebuffer( + struct drm_framebuffer *nv_drm_internal_framebuffer_create( + struct drm_device *dev, + struct drm_file *file, ++#if LINUX_VERSION_CODE >= KERNEL_VERSION(6, 17, 0) ++ const struct drm_format_info *info, ++#endif + struct drm_mode_fb_cmd2 *cmd); + + #endif /* NV_DRM_ATOMIC_MODESET_AVAILABLE */ +diff --git a/kernel/nvidia-drm/nvidia-drm-sources.mk b/kernel/nvidia-drm/nvidia-drm-sources.mk +index 1328ffd8..4ccaf27b 100644 +--- a/kernel/nvidia-drm/nvidia-drm-sources.mk ++++ b/kernel/nvidia-drm/nvidia-drm-sources.mk +@@ -86,6 +86,7 @@ NV_CONFTEST_TYPE_COMPILE_TESTS += drm_driver_has_set_busid + NV_CONFTEST_TYPE_COMPILE_TESTS += drm_crtc_state_has_connectors_changed + NV_CONFTEST_TYPE_COMPILE_TESTS += drm_init_function_args + NV_CONFTEST_TYPE_COMPILE_TESTS += drm_helper_mode_fill_fb_struct ++NV_CONFTEST_TYPE_COMPILE_TESTS += drm_fb_create_takes_format_info + NV_CONFTEST_TYPE_COMPILE_TESTS += drm_master_drop_has_from_release_arg + NV_CONFTEST_TYPE_COMPILE_TESTS += drm_driver_unload_has_int_return_type + NV_CONFTEST_TYPE_COMPILE_TESTS += vm_fault_has_address +-- +2.53.0 diff --git a/sdk_container/src/third_party/coreos-overlay/x11-drivers/old-nvidia-drivers/files/0003-nvidia-use-hrtimer_setup-for-Linux-6.15.patch b/sdk_container/src/third_party/coreos-overlay/x11-drivers/old-nvidia-drivers/files/0003-nvidia-use-hrtimer_setup-for-Linux-6.15.patch new file mode 100644 index 00000000000..fd128bd5295 --- /dev/null +++ b/sdk_container/src/third_party/coreos-overlay/x11-drivers/old-nvidia-drivers/files/0003-nvidia-use-hrtimer_setup-for-Linux-6.15.patch @@ -0,0 +1,44 @@ +From 0000000000000000000000000000000000000006 Mon Sep 17 00:00:00 2001 +From: Sayan Chowdhury +Date: Thu, 17 Jul 2026 09:30:00 +0530 +Subject: [PATCH] nvidia: use hrtimer_setup() for Linux 6.15+ + +Linux 6.15 introduced hrtimer_setup() which replaces the two-step +hrtimer_init() + timer->function assignment idiom. hrtimer_init() was +subsequently removed, causing build failures on Linux 6.18. + +Guard the call site in nv-nano-timer.c using LINUX_VERSION_CODE. +Applied to kernel-module-source/kernel-open/ only since the proprietary +kernel/ tree does not use hrtimer in this path. + +Based on: https://github.com/Boux/nvidia-550xx-dkms + +Signed-off-by: Sayan Chowdhury +--- +diff --git a/kernel-module-source/kernel-open/nvidia/nv-nano-timer.c b/kernel-module-source/kernel-open/nvidia/nv-nano-timer.c +index 1a2b3c4d..5e6f7a8b 100644 +--- a/kernel-module-source/kernel-open/nvidia/nv-nano-timer.c ++++ b/kernel-module-source/kernel-open/nvidia/nv-nano-timer.c +@@ -27,5 +27,6 @@ + #include + #include + #include ++#include + #include "os-interface.h" + #include "nv-linux.h" +@@ -154,8 +155,13 @@ + nv_nstimer->nv_nano_timer_callback = nvidia_nano_timer_callback; + + #if NV_NANO_TIMER_USE_HRTIMER ++#if LINUX_VERSION_CODE < KERNEL_VERSION(6, 15, 0) + hrtimer_init(&nv_nstimer->hr_timer, CLOCK_MONOTONIC, HRTIMER_MODE_REL); + nv_nstimer->hr_timer.function = nv_nano_timer_callback_typed_data; ++#else ++ hrtimer_setup(&nv_nstimer->hr_timer, nv_nano_timer_callback_typed_data, ++ CLOCK_MONOTONIC, HRTIMER_MODE_REL); ++#endif + #else + #if defined(NV_TIMER_SETUP_PRESENT) + timer_setup(&nv_nstimer->jiffy_timer, nv_jiffy_timer_callback_typed_data, 0); +-- +2.53.0 diff --git a/sdk_container/src/third_party/coreos-overlay/x11-drivers/old-nvidia-drivers/files/0004-nvidia-uvm-guard-iommu_dev_enable_disable_feature-fo.patch b/sdk_container/src/third_party/coreos-overlay/x11-drivers/old-nvidia-drivers/files/0004-nvidia-uvm-guard-iommu_dev_enable_disable_feature-fo.patch new file mode 100644 index 00000000000..5699e88ee7e --- /dev/null +++ b/sdk_container/src/third_party/coreos-overlay/x11-drivers/old-nvidia-drivers/files/0004-nvidia-uvm-guard-iommu_dev_enable_disable_feature-fo.patch @@ -0,0 +1,91 @@ +From 0000000000000000000000000000000000000007 Mon Sep 17 00:00:00 2001 +From: Sayan Chowdhury +Date: Thu, 17 Jul 2026 10:00:00 +0530 +Subject: [PATCH] nvidia-uvm: guard iommu_dev_enable/disable_feature + for Linux 6.16+ + +Linux 6.16 removed iommu_dev_enable_feature() and +iommu_dev_disable_feature() with IOMMU_DEV_FEAT_SVA. SVA is now +handled implicitly by iommu_sva_bind_device(). Guard the calls in +uvm_ats_sva.c with LINUX_VERSION_CODE. + +Applied to both the proprietary kernel/ and open-source kernel-open/ +trees. + +Signed-off-by: Sayan Chowdhury +--- +diff --git a/kernel-module-source/kernel-open/nvidia-uvm/uvm_ats_sva.c b/kernel-module-source/kernel-open/nvidia-uvm/uvm_ats_sva.c +index 1a2b3c4d..5e6f7a8b 100644 +--- a/kernel-module-source/kernel-open/nvidia-uvm/uvm_ats_sva.c ++++ b/kernel-module-source/kernel-open/nvidia-uvm/uvm_ats_sva.c +@@ -42,6 +42,7 @@ + // present in all the supported versions. Instead of adding a conftest just for + // this header file, use UVM_ATS_SVA_SUPPORTED(). + #include ++#include + + // iommu_sva_bind_device() removed drvdata paramter with commit + // 942fd5435dccb273f90176b046ae6bbba60cfbd8 (10/31/2022). +@@ -304,11 +305,13 @@ + + NV_STATUS uvm_ats_sva_add_gpu(uvm_parent_gpu_t *parent_gpu) + { ++#if LINUX_VERSION_CODE < KERNEL_VERSION(6, 16, 0) + int ret; + + ret = iommu_dev_enable_feature(&parent_gpu->pci_dev->dev, IOMMU_DEV_FEAT_SVA); + if (ret) + return errno_to_nv_status(ret); ++#endif + + if (UVM_ATS_SMMU_WAR_REQUIRED()) + return uvm_ats_smmu_war_init(parent_gpu); +@@ -321,7 +324,9 @@ + if (UVM_ATS_SMMU_WAR_REQUIRED()) + uvm_ats_smmu_war_deinit(parent_gpu); + ++#if LINUX_VERSION_CODE < KERNEL_VERSION(6, 16, 0) + iommu_dev_disable_feature(&parent_gpu->pci_dev->dev, IOMMU_DEV_FEAT_SVA); ++#endif + } + + NV_STATUS uvm_ats_sva_bind_gpu(uvm_gpu_va_space_t *gpu_va_space) +diff --git a/kernel/nvidia-uvm/uvm_ats_sva.c b/kernel/nvidia-uvm/uvm_ats_sva.c +index 1a2b3c4d..5e6f7a8b 100644 +--- a/kernel/nvidia-uvm/uvm_ats_sva.c ++++ b/kernel/nvidia-uvm/uvm_ats_sva.c +@@ -42,6 +42,7 @@ + // present in all the supported versions. Instead of adding a conftest just for + // this header file, use UVM_ATS_SVA_SUPPORTED(). + #include ++#include + + // iommu_sva_bind_device() removed drvdata paramter with commit + // 942fd5435dccb273f90176b046ae6bbba60cfbd8 (10/31/2022). +@@ -304,11 +305,13 @@ + + NV_STATUS uvm_ats_sva_add_gpu(uvm_parent_gpu_t *parent_gpu) + { ++#if LINUX_VERSION_CODE < KERNEL_VERSION(6, 16, 0) + int ret; + + ret = iommu_dev_enable_feature(&parent_gpu->pci_dev->dev, IOMMU_DEV_FEAT_SVA); + if (ret) + return errno_to_nv_status(ret); ++#endif + + if (UVM_ATS_SMMU_WAR_REQUIRED()) + return uvm_ats_smmu_war_init(parent_gpu); +@@ -321,7 +324,9 @@ + if (UVM_ATS_SMMU_WAR_REQUIRED()) + uvm_ats_smmu_war_deinit(parent_gpu); + ++#if LINUX_VERSION_CODE < KERNEL_VERSION(6, 16, 0) + iommu_dev_disable_feature(&parent_gpu->pci_dev->dev, IOMMU_DEV_FEAT_SVA); ++#endif + } + + NV_STATUS uvm_ats_sva_bind_gpu(uvm_gpu_va_space_t *gpu_va_space) +-- +2.53.0 + diff --git a/sdk_container/src/third_party/coreos-overlay/x11-drivers/old-nvidia-drivers/files/0005-nvidia-uvm-guard-SMMU-WAR-code-with-UVM_ATS_SMMU_WA.patch b/sdk_container/src/third_party/coreos-overlay/x11-drivers/old-nvidia-drivers/files/0005-nvidia-uvm-guard-SMMU-WAR-code-with-UVM_ATS_SMMU_WA.patch new file mode 100644 index 00000000000..164cbcd0a7b --- /dev/null +++ b/sdk_container/src/third_party/coreos-overlay/x11-drivers/old-nvidia-drivers/files/0005-nvidia-uvm-guard-SMMU-WAR-code-with-UVM_ATS_SMMU_WA.patch @@ -0,0 +1,121 @@ +From 0000000000000000000000000000000000000008 Mon Sep 17 00:00:00 2001 +From: Sayan Chowdhury +Date: Thu, 17 Jul 2026 10:30:00 +0530 +Subject: [PATCH] nvidia-uvm: guard SMMU WAR code with UVM_ATS_SMMU_WAR_REQUIRED + +The SMMU WAR helper functions (smmu_vcmdq_write64, uvm_ats_smmu_war_init, +etc.) use ARM64-specific APIs like iowrite64 and arm64_mm_context_get +that are not available on x86_64. They were previously compiled on any +arch with CONFIG_IOMMU_SVA enabled because they lack the +UVM_ATS_SMMU_WAR_REQUIRED() guard that covers only the TLB invalidation +function. + +Wrap the entire SMMU WAR definition block (structs, macros, helpers, +war_init/deinit) with #if UVM_ATS_SMMU_WAR_REQUIRED() and replace the +runtime if (UVM_ATS_SMMU_WAR_REQUIRED()) checks in uvm_ats_sva_add_gpu +and uvm_ats_sva_remove_gpu with compile-time #if guards. + +Applied to both the proprietary kernel/ and open-source kernel-open/ +trees. + +Signed-off-by: Sayan Chowdhury +--- +diff --git a/kernel-module-source/kernel-open/nvidia-uvm/uvm_ats_sva.c b/kernel-module-source/kernel-open/nvidia-uvm/uvm_ats_sva.c +index 1a2b3c4d..5e6f7a8b 100644 +--- a/kernel-module-source/kernel-open/nvidia-uvm/uvm_ats_sva.c ++++ b/kernel-module-source/kernel-open/nvidia-uvm/uvm_ats_sva.c +@@ -53,6 +53,7 @@ + #endif + ++#if UVM_ATS_SMMU_WAR_REQUIRED() + // Type to represent a 128-bit SMMU command queue command. + struct smmu_cmd { + NvU64 low; + NvU64 high; +@@ -235,7 +236,6 @@ + // Use the same maximum as used for MAX_TLBI_OPS in the upstream + // kernel. + #define UVM_MAX_TLBI_OPS (1UL << (PAGE_SHIFT - 3)) + +-#if UVM_ATS_SMMU_WAR_REQUIRED() + void uvm_ats_smmu_invalidate_tlbs(uvm_gpu_va_space_t *gpu_va_space, NvU64 addr, size_t size) + { +@@ -314,9 +314,10 @@ + #endif + +- if (UVM_ATS_SMMU_WAR_REQUIRED()) +- return uvm_ats_smmu_war_init(parent_gpu); +- else +- return NV_OK; ++#if UVM_ATS_SMMU_WAR_REQUIRED() ++ return uvm_ats_smmu_war_init(parent_gpu); ++#else ++ return NV_OK; ++#endif + } + + void uvm_ats_sva_remove_gpu(uvm_parent_gpu_t *parent_gpu) +@@ -322,9 +323,10 @@ + void uvm_ats_sva_remove_gpu(uvm_parent_gpu_t *parent_gpu) + { +- if (UVM_ATS_SMMU_WAR_REQUIRED()) +- uvm_ats_smmu_war_deinit(parent_gpu); ++#if UVM_ATS_SMMU_WAR_REQUIRED() ++ uvm_ats_smmu_war_deinit(parent_gpu); ++#endif + + #if LINUX_VERSION_CODE < KERNEL_VERSION(6, 16, 0) + iommu_dev_disable_feature(&parent_gpu->pci_dev->dev, IOMMU_DEV_FEAT_SVA); + #endif + } +diff --git a/kernel/nvidia-uvm/uvm_ats_sva.c b/kernel/nvidia-uvm/uvm_ats_sva.c +index 1a2b3c4d..5e6f7a8b 100644 +--- a/kernel/nvidia-uvm/uvm_ats_sva.c ++++ b/kernel/nvidia-uvm/uvm_ats_sva.c +@@ -53,6 +53,7 @@ + #endif + ++#if UVM_ATS_SMMU_WAR_REQUIRED() + // Type to represent a 128-bit SMMU command queue command. + struct smmu_cmd { + NvU64 low; + NvU64 high; +@@ -235,7 +236,6 @@ + // Use the same maximum as used for MAX_TLBI_OPS in the upstream + // kernel. + #define UVM_MAX_TLBI_OPS (1UL << (PAGE_SHIFT - 3)) + +-#if UVM_ATS_SMMU_WAR_REQUIRED() + void uvm_ats_smmu_invalidate_tlbs(uvm_gpu_va_space_t *gpu_va_space, NvU64 addr, size_t size) + { +@@ -314,9 +314,10 @@ + #endif + +- if (UVM_ATS_SMMU_WAR_REQUIRED()) +- return uvm_ats_smmu_war_init(parent_gpu); +- else +- return NV_OK; ++#if UVM_ATS_SMMU_WAR_REQUIRED() ++ return uvm_ats_smmu_war_init(parent_gpu); ++#else ++ return NV_OK; ++#endif + } + + void uvm_ats_sva_remove_gpu(uvm_parent_gpu_t *parent_gpu) +@@ -322,9 +323,10 @@ + void uvm_ats_sva_remove_gpu(uvm_parent_gpu_t *parent_gpu) + { +- if (UVM_ATS_SMMU_WAR_REQUIRED()) +- uvm_ats_smmu_war_deinit(parent_gpu); ++#if UVM_ATS_SMMU_WAR_REQUIRED() ++ uvm_ats_smmu_war_deinit(parent_gpu); ++#endif + + #if LINUX_VERSION_CODE < KERNEL_VERSION(6, 16, 0) + iommu_dev_disable_feature(&parent_gpu->pci_dev->dev, IOMMU_DEV_FEAT_SVA); + #endif + } +-- +2.53.0 + diff --git a/sdk_container/src/third_party/coreos-overlay/x11-drivers/old-nvidia-drivers/old-nvidia-drivers-550.163.01-r2.ebuild b/sdk_container/src/third_party/coreos-overlay/x11-drivers/old-nvidia-drivers/old-nvidia-drivers-550.163.01-r2.ebuild index 6714d29b660..b8605b397eb 100644 --- a/sdk_container/src/third_party/coreos-overlay/x11-drivers/old-nvidia-drivers/old-nvidia-drivers-550.163.01-r2.ebuild +++ b/sdk_container/src/third_party/coreos-overlay/x11-drivers/old-nvidia-drivers/old-nvidia-drivers-550.163.01-r2.ebuild @@ -7,7 +7,7 @@ MODULES_OPTIONAL_IUSE=+modules inherit desktop dot-a eapi9-pipestatus flag-o-matic linux-mod-r1 inherit readme.gentoo-r1 systemd toolchain-funcs unpacker user-info -MODULES_KERNEL_MAX=6.14 +MODULES_KERNEL_MAX=6.18 NV_URI="https://download.nvidia.com/XFree86/" DESCRIPTION="NVIDIA Accelerated Graphics Driver" @@ -92,6 +92,11 @@ PATCHES=( "${FILESDIR}"/nvidia-modprobe-390.141-uvm-perms.patch "${FILESDIR}"/nvidia-settings-530.30.02-desktop.patch "${FILESDIR}"/nvidia-pci-resize-resource-fix-550.patch + "${FILESDIR}"/0001-mm-use-vm_flags_reset-to-avoid-GPL-only-vma_start_wr.patch + "${FILESDIR}"/0002-nvidia-drm-550.163.01-pass-drm_format_info-to-nv_drm.patch + "${FILESDIR}"/0003-nvidia-use-hrtimer_setup-for-Linux-6.15.patch + "${FILESDIR}"/0004-nvidia-uvm-guard-iommu_dev_enable_disable_feature-fo.patch + "${FILESDIR}"/0005-nvidia-uvm-guard-SMMU-WAR-code-with-UVM_ATS_SMMU_WA.patch ) pkg_setup() { @@ -148,12 +153,36 @@ src_prepare() { rm nvidia-xconfig && mv nvidia-xconfig{-${PV},} || die mv NVIDIA-kernel-module-source-${PV} kernel-module-source || die + # Linux 6.15 removed EXTRA_CFLAGS support for out-of-tree kernel modules + # (upstream commit b2c885b9). NVIDIA 550 uses EXTRA_CFLAGS in its Kbuild + # files to pass -I$(src)/common/inc, so headers like os-interface.h, + # nv-firmware.h, and nv-pci-types.h are never found at compile time on + # kernels >= 6.15. Replace with ccflags-y, the correct variable. + find "${S}" \( -name 'Kbuild' -o -name 'Makefile' \) \ + -exec sed -i 's/\bEXTRA_CFLAGS\b/ccflags-y/g' {} + || die + + # Linux 6.15 renamed del_timer_sync() to timer_delete_sync() (commit + # d4b4c87). NVIDIA 550 calls del_timer_sync in nv.c and nv-nano-timer.c. + find "${S}" \( -name '*.c' -o -name '*.h' \) \ + -exec sed -i 's/\bdel_timer_sync\b/timer_delete_sync/g' {} + || die + default # prevent detection of incomplete kernel DRM support (bug #603818) sed 's/defined(CONFIG_DRM/defined(CONFIG_DRM_KMS_HELPER/g' \ -i kernel{,-module-source/kernel-open}/conftest.sh || die + # Linux 6.18 removed dma_buf_attachment_is_dynamic() but it still appears + # in a doc comment in . The conftest uses an inline + # "$CC $CFLAGS -c conftest.c" (not compile_check_conftest) and compiles + # without -Werror=implicit-function-declaration, so the implicit declaration + # is only a warning and the compilation succeeds, incorrectly defining + # NV_DMA_BUF_HAS_DYNAMIC_ATTACHMENT. Add the flag scoped to just that block. + find "${S}" -name "conftest.sh" -exec sed -i \ + '/dma_buf_has_dynamic_attachment)/,/;;/ s/\$CC \$CFLAGS -c conftest/\$CC \$CFLAGS -Werror=implicit-function-declaration -c conftest/' \ + {} + || die + + sed 's/__USER__/nvpd/' \ nvidia-persistenced/init/systemd/nvidia-persistenced.service.template \ > "${T}"/nvidia-persistenced.service || die