From 9641d76c26c658f3f3cae6ac8ec0333df42316b2 Mon Sep 17 00:00:00 2001 From: Sayan Chowdhury Date: Tue, 5 May 2026 17:01:07 +0530 Subject: [PATCH 1/8] sys-kernel/coreos-kernel: Version bump to 6.18.45 Signed-off-by: Sayan Chowdhury --- .../coreos-kernel-6.18.45.ebuild | 167 ++++++++++++++++++ 1 file changed, 167 insertions(+) create mode 100644 sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-kernel/coreos-kernel-6.18.45.ebuild diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-kernel/coreos-kernel-6.18.45.ebuild b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-kernel/coreos-kernel-6.18.45.ebuild new file mode 100644 index 00000000000..bb07dbb104a --- /dev/null +++ b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-kernel/coreos-kernel-6.18.45.ebuild @@ -0,0 +1,167 @@ +# Copyright 2026 The Flatcar Container Linux Maintainers +# Distributed under the terms of the GNU General Public License v2 + +EAPI=8 +COREOS_SOURCE_REVISION="" +inherit coreos-kernel toolchain-funcs + +DESCRIPTION="CoreOS Linux kernel" +KEYWORDS="amd64 arm64" +RESTRICT="userpriv" # dracut (via bootengine) needs root + +RDEPEND=" + =sys-kernel/coreos-modules-${PVR} + sys-apps/kbd +" +BDEPEND=" + sys-kernel/dracut +" +DEPEND=" + ${RDEPEND} + ${BDEPEND} + app-alternatives/awk + app-alternatives/gzip + app-arch/xz-utils + app-arch/zstd + app-crypt/clevis + app-shells/bash + coreos-base/afterburn + coreos-base/coreos-init:= + net-misc/iputils + sys-apps/azure-vm-utils[dracut] + sys-apps/baselayout + sys-apps/busybox + sys-apps/coreutils + sys-apps/findutils + sys-apps/grep + sys-apps/hwdata + sys-apps/ignition:= + sys-apps/iproute2 + sys-apps/kexec-tools + sys-apps/less + sys-apps/nvme-cli + sys-apps/sed + sys-apps/shadow + sys-apps/systemd[cryptsetup] + sys-apps/seismograph + sys-apps/util-linux[cryptsetup,udev] + sys-block/open-iscsi + sys-fs/btrfs-progs + sys-fs/cryptsetup[udev] + sys-fs/e2fsprogs + sys-fs/lvm2[udev] + sys-fs/mdadm + sys-fs/xfsprogs + >=sys-kernel/bootengine-0.0.38-r37:= + >=sys-kernel/coreos-firmware-20180103-r1:= + sys-process/procps + virtual/udev + amd64? ( + app-admin/google-guest-configs + sys-firmware/intel-microcode:= + ) +" + +src_prepare() { + default + + # KV_OUT_DIR points to the minimal build tree installed by coreos-modules + # Pull in the config and public module signing key + cp -v "${KV_OUT_DIR}/.config" build/ || die + validate_sig_key + + config_update 'CONFIG_INITRAMFS_SOURCE="bootengine.cpio"' + + # include all intel and amd microcode files, avoiding the signatures + local fw_dir="${ESYSROOT}/lib/firmware" + use amd64 && config_update "CONFIG_EXTRA_FIRMWARE=\"$(find ${fw_dir} -type f \ + \( -path ${fw_dir}'/intel-ucode/*' -o -path ${fw_dir}'/amd-ucode/*' \) -printf '%P ')\"" + use amd64 && config_update "CONFIG_EXTRA_FIRMWARE_DIR=\"${fw_dir}\"" +} + +src_compile() { + local BE_ARGS=() + + if [[ -n ${SYSROOT} ]]; then + BE_ARGS+=( -r "${SYSROOT}" ) + export DRACUT_ARCH="${CHOST%%-*}" + + # We may need to run ldconfig via QEMU, so use the wrapper. Dracut calls + # it with -r, which chroots and confuses the sandbox, so calm it down. + export DRACUT_LDCONFIG="${CHOST}-ldconfig" + local f; for f in /etc/ld.so.cache{,~} /var/cache/ldconfig/aux-cache{,~}; do + addwrite "${f}" + done + fi + + tc-export PKG_CONFIG + "${ESYSROOT}"/usr/bin/update-bootengine -k "${KV_FULL}" -o "${S}"/build/bootengine.cpio "${BE_ARGS[@]}" || die + # Copy full initrd over to /usr as filesystem image + mkdir "${S}"/build/bootengine || die + pushd "${S}"/build/bootengine || die + lsinitrd --kver SILENCEERROR --unpack "${S}"/build/bootengine.cpio || die + mksquashfs . "${S}"/build/bootengine.img -noappend -xattrs-exclude ^btrfs. || die + popd || die + # No early cpio, drop full initrd + > "${S}"/build/bootengine.cpio + # Create minimal initrd + mkdir "${S}"/build/minimal || die + pushd "${S}"/build/minimal || die + mkdir -p {etc,dev,proc,sys,dev,usr/bin,usr/lib,usr/lib64,realinit,sysusr/usr} || die + ln -s usr/bin bin || die + ln -s usr/bin sbin || die + ln -s bin usr/sbin || die + ln -s usr/lib lib || die + ln -s usr/lib64 lib64 || die + # Instead from ESYSROOT we can also copy kernel modules from the dracut pre-selection + mkdir -p lib/modprobe.d/ || die + cp "${S}"/build/bootengine/lib/modprobe.d/* lib/modprobe.d/ || die + # Only include modules related to mounting /usr and for interacting with the emergency console + pushd "${S}/build/bootengine/usr/lib/modules/${KV_FULL}" || die + find kernel/drivers/{ata,block,hid,hv,input/serio,message/fusion,mmc,nvme,pci,scsi,usb} kernel/fs/{btrfs,overlayfs,squashfs} kernel/security/keys -name "*.ko.*" -printf "%f\0" | DRACUT_NO_XATTR=1 xargs --null "${BROOT}"/usr/lib/dracut/dracut-install --destrootdir "${S}"/build/minimal --kerneldir . --sysrootdir "${S}"/build/bootengine/ --firmwaredirs "${S}"/build/bootengine/usr/lib/firmware --module dm-verity dm-mod virtio_console || die + popd || die + # Double compression only makes the image bigger and slower + find . -name "*.ko.xz" -exec unxz {} + || die + depmod -a -b . "${KV_FULL}" || die + echo '$MODALIAS=.* 0:0 660 @/sbin/modprobe "$MODALIAS"' > ./etc/mdev.conf || die + # We can't use busybox's modprobe because it doesn't support the globs in module.alias, breaking module loading + DRACUT_NO_XATTR=1 "${BROOT}"/usr/lib/dracut/dracut-install --destrootdir . --sysrootdir "${ESYSROOT}" --ldd /bin/veritysetup /bin/dmsetup /bin/busybox /sbin/modprobe || die + cp -a "${ESYSROOT}"/usr/bin/minimal-init ./init || die + # Make it easier to debug by not relying too much on the first commands + ln -s busybox ./bin/sh || die + mknod ./dev/console c 5 1 || die + mknod ./dev/null c 1 3 || die + mknod ./dev/tty c 5 0 || die + mknod ./dev/urandom c 1 9 || die + mknod ./dev/random c 1 8 || die + mknod ./dev/zero c 1 5 || die + # No compression because CONFIG_INITRAMFS_COMPRESSION_XZ should take care of it + # (Note: The kernel build system does not support prepending an uncompressed microcode early cpio here) + find . -print0 | cpio --null --create --verbose --format=newc >> "${S}"/build/bootengine.cpio || die + popd || die + kmake "$(kernel_target)" + + # sanity check :) + [[ -e build/certs/signing_key.pem ]] && die "created a new key!" +} + +src_install() { + # coreos-postinst expects to find the kernel in /usr/boot + insinto "/usr/boot" + newins "$(kernel_path)" "vmlinuz-${KV_FULL}" + dosym "vmlinuz-${KV_FULL}" "/usr/boot/vmlinuz" + + insinto "/usr/lib/modules/${KV_FULL}/build" + doins build/System.map + + insinto "/usr/lib/debug/usr/boot" + newins build/vmlinux "vmlinux-${KV_FULL}" + dosym "../../../boot/vmlinux-${KV_FULL}" "/usr/lib/debug/usr/lib/modules/${KV_FULL}/vmlinux" + + # For easy access to vdso debug symbols in gdb: + # set debug-file-directory /usr/lib/debug/usr/lib/modules/${KV_FULL}/vdso/ + kmake INSTALL_MOD_PATH="${ED}/usr/lib/debug/usr" vdso_install + + insinto "/usr/lib/flatcar" + doins build/bootengine.img +} From 52f1960366b5b5229cd202d3c1fd945345382f0a Mon Sep 17 00:00:00 2001 From: Sayan Chowdhury Date: Tue, 5 May 2026 17:12:18 +0530 Subject: [PATCH 2/8] sys-kernel/coreos-modules: Version bump to 6.18.45 Signed-off-by: Sayan Chowdhury --- .../coreos-modules-6.18.45.ebuild | 63 + .../coreos-modules/files/amd64_defconfig-6.18 | 155 +++ ...64_defconfig-6.12 => arm64_defconfig-6.18} | 0 .../coreos-modules/files/commonconfig-6.18 | 1052 +++++++++++++++++ 4 files changed, 1270 insertions(+) create mode 100644 sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/coreos-modules-6.18.45.ebuild create mode 100644 sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/files/amd64_defconfig-6.18 rename sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/files/{arm64_defconfig-6.12 => arm64_defconfig-6.18} (100%) create mode 100644 sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/files/commonconfig-6.18 diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/coreos-modules-6.18.45.ebuild b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/coreos-modules-6.18.45.ebuild new file mode 100644 index 00000000000..11318123570 --- /dev/null +++ b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/coreos-modules-6.18.45.ebuild @@ -0,0 +1,63 @@ +# Copyright 2026 The Flatcar Container Linux Maintainers +# Distributed under the terms of the GNU General Public License v2 + +EAPI=7 +COREOS_SOURCE_REVISION="" +inherit coreos-kernel savedconfig + +DESCRIPTION="CoreOS Linux kernel modules" +KEYWORDS="amd64 arm64" +RDEPEND="!> build/.config || die + fi + cpio -ov build/bootengine.cpio + + # Check that an old pre-ebuild-split config didn't leak in. + grep -q "^CONFIG_INITRAMFS_SOURCE=" build/.config && \ + die "CONFIG_INITRAMFS_SOURCE must be removed from kernel config" + config_update 'CONFIG_INITRAMFS_SOURCE="bootengine.cpio"' +} + +src_compile() { + # Generate module signing key + setup_keys + + # Build both vmlinux and modules (moddep checks symbols in vmlinux) + kmake vmlinux modules +} + +src_install() { + local build="lib/modules/${KV_FULL}/build" + + # Install modules to /usr. + # Stripping must be done here, not portage, to preserve sigs. + kmake INSTALL_MOD_PATH="${ED}/usr" \ + INSTALL_MOD_STRIP="--strip-debug" \ + modules_install + + # Install to /usr/lib/debug with debug symbols intact + kmake INSTALL_MOD_PATH="${ED}/usr/lib/debug/usr" \ + modules_install + rm "${ED}/usr/lib/debug/usr/lib/modules/${KV_FULL}"/{build,modules.*} || die + + # Replace the broken /lib/modules/${KV_FULL}/build symlink with a copy of + # the files needed to build out-of-tree modules. + rm "${ED}/usr/${build}" || die + kmake run-command KBUILD_RUN_COMMAND="${KERNEL_DIR}/scripts/package/install-extmod-build ${ED}/usr/${build}" + + # Install the original config because the above doesn't. + insinto "/usr/${build}" + doins build/.config + + # Not strictly required but this is where we used to install the config. + dosym "../${build}/.config" "/usr/boot/config-${KV_FULL}" + dosym "../${build}/.config" "/usr/boot/config" +} diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/files/amd64_defconfig-6.18 b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/files/amd64_defconfig-6.18 new file mode 100644 index 00000000000..31410d16d3d --- /dev/null +++ b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/files/amd64_defconfig-6.18 @@ -0,0 +1,155 @@ +# CONFIG_ACPI_AC is not set +CONFIG_ACPI_APEI=y +CONFIG_ACPI_APEI_ERST_DEBUG=m +CONFIG_ACPI_APEI_GHES=y +CONFIG_ACPI_APEI_MEMORY_FAILURE=y +CONFIG_ACPI_APEI_PCIEAER=y +# CONFIG_ACPI_BATTERY is not set +CONFIG_ACPI_BUTTON=m +CONFIG_ACPI_FAN=m +CONFIG_ACPI_HOTPLUG_MEMORY=y +CONFIG_ACPI_IPMI=m +CONFIG_ACPI_PCI_SLOT=y +CONFIG_ACPI_PROCESSOR_AGGREGATOR=y +CONFIG_AMD_IOMMU=y +CONFIG_AQTION=m +CONFIG_ARCH_MEMORY_PROBE=y +CONFIG_AUTOFS_FS=y +CONFIG_BLK_DEV_IO_TRACE=y +CONFIG_BOOTPARAM_HARDLOCKUP_PANIC=y +CONFIG_CMDLINE_BOOL=y +CONFIG_CONNECTOR=y +CONFIG_CRASH_DUMP=y +CONFIG_CRYPTO_AES_NI_INTEL=m +CONFIG_CRYPTO_SHA1_SSSE3=m +CONFIG_CRYPTO_SHA256_SSSE3=m +CONFIG_DCDBAS=m +CONFIG_DEBUG_BOOT_PARAMS=y +CONFIG_DELL_RBU=m +CONFIG_DEVICE_PRIVATE=y +CONFIG_DMABUF_MOVE_NOTIFY=y +CONFIG_DRM_AMDGPU=m +CONFIG_DRM_AMDGPU_USERPTR=y +CONFIG_DRM_I915=m +CONFIG_DRM_I915_PXP=y +CONFIG_EDAC_AMD64=m +CONFIG_EDAC_DECODE_MCE=m +CONFIG_EDAC_E752X=m +CONFIG_EDAC_I3000=m +CONFIG_EDAC_I3200=m +CONFIG_EDAC_I5100=m +CONFIG_EDAC_I5400=m +CONFIG_EDAC_I7300=m +CONFIG_EDAC_I7CORE=m +CONFIG_EDAC_I82975X=m +CONFIG_EDAC_SBRIDGE=m +CONFIG_EDAC_X38=m +CONFIG_FB_VESA=y +CONFIG_FCOE_FNIC=m +CONFIG_FUNCTION_PROFILER=y +CONFIG_GART_IOMMU=y +CONFIG_GET_FREE_REGION=y +CONFIG_GVE=m +CONFIG_HANGCHECK_TIMER=m +CONFIG_HARDLOCKUP_DETECTOR=y +CONFIG_HID=m +CONFIG_HOTPLUG_PCI_ACPI_IBM=m +CONFIG_HPET=y +CONFIG_HSA_AMD=y +CONFIG_HSA_AMD_P2P=y +CONFIG_HSA_AMD_SVM=y +CONFIG_HW_RANDOM_AMD=y +CONFIG_HW_RANDOM_INTEL=y +CONFIG_HW_RANDOM_VIA=y +CONFIG_HYPERVISOR_GUEST=y +CONFIG_IA32_EMULATION=y +CONFIG_IGC=m +CONFIG_INFINIBAND_USER_ACCESS=m +CONFIG_INFINIBAND_USNIC=m +CONFIG_INT340X_THERMAL=m +CONFIG_INTEL_IDLE=y +CONFIG_INTEL_IOATDMA=y +CONFIG_INTEL_IOMMU=y +CONFIG_INTEL_MEI_GSC=m +CONFIG_INTEL_MEI_ME=m +CONFIG_INTEL_MEI_PXP=m +CONFIG_INTEL_MEI_TXE=m +CONFIG_INTEL_RAPL=m +CONFIG_IP_VS_MH=m +CONFIG_IRQ_REMAP=y +CONFIG_ISCSI_IBFT=y +CONFIG_ISCSI_IBFT_FIND=y +CONFIG_ITCO_VENDOR_SUPPORT=y +CONFIG_ITCO_WDT=m +CONFIG_KERNEL_XZ=y +CONFIG_KEXEC_FILE=y +CONFIG_KPROBES_ON_FTRACE=y +CONFIG_KVM=m +CONFIG_KVM_AMD=m +CONFIG_KVM_INTEL=m +CONFIG_MEMORY_FAILURE=y +CONFIG_MEM_SOFT_DIRTY=y +CONFIG_MMC_SDHCI_ACPI=m +# CONFIG_MOUSE_PS2_LIFEBOOK is not set +CONFIG_MTRR_SANITIZER_ENABLE_DEFAULT=1 +CONFIG_NET_DROP_MONITOR=m +CONFIG_NVRAM=m +CONFIG_OPTPROBES=y +CONFIG_PARAVIRT_SPINLOCKS=y +CONFIG_PCI_MMCONFIG=y +CONFIG_PCI_P2PDMA=y +CONFIG_PHYSICAL_ALIGN=0x1000000 +CONFIG_PMIC_OPREGION=y +# CONFIG_PNP_DEBUG_MESSAGES is not set +CONFIG_POWERCAP=y +CONFIG_PREEMPT_VOLUNTARY=y +CONFIG_PTP_1588_CLOCK_VMW=m +CONFIG_PVPANIC=y +CONFIG_PVPANIC_MMIO=m +CONFIG_SCHED_TRACER=y +CONFIG_SCSI_BUSLOGIC=m +CONFIG_SCSI_ISCI=m +CONFIG_SENSORS_CORETEMP=m +CONFIG_SENSORS_FAM15H_POWER=m +CONFIG_SENSORS_I5500=m +CONFIG_SENSORS_K10TEMP=m +CONFIG_SENSORS_K8TEMP=m +CONFIG_STACK_TRACER=y +CONFIG_TCG_INFINEON=m +CONFIG_TCG_NSC=m +CONFIG_UPROBE_EVENTS=y +CONFIG_USB_OHCI_HCD_SSB=y +CONFIG_VBOXGUEST=m +CONFIG_VFIO_PCI_IGD=y +CONFIG_VFIO_PCI_VGA=y +CONFIG_VHOST_VSOCK=m +CONFIG_VMWARE_BALLOON=m +CONFIG_VMWARE_PVSCSI=m +CONFIG_VMWARE_VMCI=m +CONFIG_VMWARE_VMCI_VSOCKETS=m +CONFIG_VMXNET3=m +# CONFIG_X86_16BIT is not set +CONFIG_X86_ACPI_CPUFREQ=m +# CONFIG_X86_ACPI_CPUFREQ_CPB is not set +CONFIG_X86_AMD_FREQ_SENSITIVITY=m +CONFIG_X86_AMD_PSTATE=y +# CONFIG_X86_BOOTPARAM_MEMORY_CORRUPTION_CHECK is not set +CONFIG_X86_CHECK_BIOS_CORRUPTION=y +CONFIG_X86_CPUID=m +# CONFIG_X86_EXTENDED_PLATFORM is not set +CONFIG_X86_INTEL_LPSS=y +CONFIG_X86_INTEL_PSTATE=y +# CONFIG_X86_INTEL_TSX_MODE_OFF is not set +CONFIG_X86_INTEL_TSX_MODE_ON=y +# CONFIG_X86_MPPARSE is not set +CONFIG_X86_MSR=m +CONFIG_X86_PCC_CPUFREQ=m +CONFIG_X86_PLATFORM_DRIVERS_DELL=y +CONFIG_X86_REROUTE_FOR_BROKEN_BOOT_IRQS=y +CONFIG_X86_X2APIC=y +CONFIG_XDP_SOCKETS=y +CONFIG_XEN_BALLOON_MEMORY_HOTPLUG=y +CONFIG_XEN_DEBUG_FS=y +CONFIG_XEN_MCE_LOG=y +CONFIG_XEN_PCIDEV_FRONTEND=m +CONFIG_XEN_PVH=y diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/files/arm64_defconfig-6.12 b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/files/arm64_defconfig-6.18 similarity index 100% rename from sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/files/arm64_defconfig-6.12 rename to sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/files/arm64_defconfig-6.18 diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/files/commonconfig-6.18 b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/files/commonconfig-6.18 new file mode 100644 index 00000000000..392c12665d2 --- /dev/null +++ b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/files/commonconfig-6.18 @@ -0,0 +1,1052 @@ +CONFIG_8139CP=m +CONFIG_8139TOO=m +CONFIG_8139TOO_8129=y +CONFIG_8139TOO_TUNE_TWISTER=y +CONFIG_9P_FS=m +CONFIG_9P_FSCACHE=y +CONFIG_9P_FS_POSIX_ACL=y +CONFIG_9P_FS_SECURITY=y +CONFIG_ACPI=y +CONFIG_ALX=m +CONFIG_AMD8111_ETH=m +CONFIG_AMD_PHY=m +CONFIG_AT803X_PHY=m +CONFIG_ATA=m +CONFIG_ATA_OVER_ETH=m +CONFIG_ATA_PIIX=m +CONFIG_ATL1=m +CONFIG_ATL1C=m +CONFIG_ATL1E=m +CONFIG_ATL2=m +CONFIG_AUDIT=y +CONFIG_AUTOFS_FS=y +CONFIG_B44=m +# CONFIG_BACKLIGHT_CLASS_DEVICE is not set +CONFIG_BCACHE=m +CONFIG_BCM87XX_PHY=m +CONFIG_BFQ_GROUP_IOSCHED=y +CONFIG_BINFMT_MISC=m +CONFIG_BLK_CGROUP=y +CONFIG_BLK_DEV_3W_XXXX_RAID=m +CONFIG_BLK_DEV_DM=m +CONFIG_BLK_DEV_DRBD=m +CONFIG_BLK_DEV_INITRD=y +CONFIG_BLK_DEV_LOOP=m +CONFIG_BLK_DEV_NBD=m +CONFIG_BLK_DEV_NVME=m +CONFIG_BLK_DEV_PCIESSD_MTIP32XX=m +CONFIG_BLK_DEV_RAM=m +CONFIG_BLK_DEV_RBD=m +CONFIG_BLK_DEV_SD=m +CONFIG_BLK_DEV_SR=m +CONFIG_BLK_DEV_THROTTLING=y +CONFIG_BLK_WBT=y +CONFIG_BNA=m +CONFIG_BNGE=m +CONFIG_BNX2X=m +CONFIG_BNXT=m +CONFIG_BONDING=m +CONFIG_BOOTPARAM_SOFTLOCKUP_PANIC=y +CONFIG_BOOT_PRINTK_DELAY=y +CONFIG_BPF_EVENTS=y +CONFIG_BPF_JIT=y +CONFIG_BPF_JIT_ALWAYS_ON=y +CONFIG_BPF_LSM=y +CONFIG_BPF_SYSCALL=y +CONFIG_BRIDGE=m +CONFIG_BRIDGE_EBT_802_3=m +CONFIG_BRIDGE_EBT_AMONG=m +CONFIG_BRIDGE_EBT_ARP=m +CONFIG_BRIDGE_EBT_ARPREPLY=m +CONFIG_BRIDGE_EBT_BROUTE=m +CONFIG_BRIDGE_EBT_DNAT=m +CONFIG_BRIDGE_EBT_IP=m +CONFIG_BRIDGE_EBT_IP6=m +CONFIG_BRIDGE_EBT_LIMIT=m +CONFIG_BRIDGE_EBT_LOG=m +CONFIG_BRIDGE_EBT_MARK=m +CONFIG_BRIDGE_EBT_MARK_T=m +CONFIG_BRIDGE_EBT_NFLOG=m +CONFIG_BRIDGE_EBT_PKTTYPE=m +CONFIG_BRIDGE_EBT_REDIRECT=m +CONFIG_BRIDGE_EBT_SNAT=m +CONFIG_BRIDGE_EBT_STP=m +CONFIG_BRIDGE_EBT_T_FILTER=m +CONFIG_BRIDGE_EBT_T_NAT=m +CONFIG_BRIDGE_EBT_VLAN=m +CONFIG_BRIDGE_NETFILTER=y +CONFIG_BRIDGE_NF_EBTABLES=m +CONFIG_BRIDGE_NF_EBTABLES_LEGACY=m +CONFIG_BRIDGE_VLAN_FILTERING=y +CONFIG_BROADCOM_PHY=m +CONFIG_BSD_DISKLABEL=y +CONFIG_BSD_PROCESS_ACCT=y +CONFIG_BSD_PROCESS_ACCT_V3=y +CONFIG_BTRFS_FS=m +CONFIG_BTRFS_FS_POSIX_ACL=y +CONFIG_CACHEFILES=m +CONFIG_CEPH_FS=m +CONFIG_CEPH_FSCACHE=y +CONFIG_CEPH_FS_POSIX_ACL=y +CONFIG_CEPH_LIB_USE_DNS_RESOLVER=y +CONFIG_CFS_BANDWIDTH=y +CONFIG_CGROUP_BPF=y +CONFIG_CGROUP_CPUACCT=y +CONFIG_CGROUP_DEVICE=y +CONFIG_CGROUP_FREEZER=y +CONFIG_CGROUP_HUGETLB=y +CONFIG_CGROUP_NET_PRIO=y +CONFIG_CGROUP_PERF=y +CONFIG_CGROUP_PIDS=y +CONFIG_CHECKPOINT_RESTORE=y +CONFIG_CHELSIO_T1=m +CONFIG_CHELSIO_T1_1G=y +CONFIG_CHELSIO_T3=m +CONFIG_CHELSIO_T4=m +CONFIG_CHELSIO_T4VF=m +CONFIG_CHR_DEV_SG=m +CONFIG_CIFS=m +CONFIG_CIFS_DFS_UPCALL=y +CONFIG_CIFS_FSCACHE=y +CONFIG_CIFS_POSIX=y +CONFIG_CIFS_STATS2=y +CONFIG_CIFS_UPCALL=y +CONFIG_CIFS_XATTR=y +CONFIG_CLS_U32_MARK=y +CONFIG_CLS_U32_PERF=y +CONFIG_CMDLINE="rootflags=rw mount.usrflags=ro" +CONFIG_CNIC=m +# CONFIG_COMPAT_BRK is not set +CONFIG_CPUSETS=y +CONFIG_CPUSETS_V1=y +CONFIG_CPU_FREQ=y +CONFIG_CPU_FREQ_GOV_CONSERVATIVE=m +CONFIG_CPU_FREQ_GOV_ONDEMAND=m +CONFIG_CPU_FREQ_GOV_POWERSAVE=m +CONFIG_CPU_FREQ_GOV_USERSPACE=m +CONFIG_CPU_FREQ_STAT=y +# CONFIG_CROSS_MEMORY_ATTACH is not set +CONFIG_CRYPTO_AES=m +CONFIG_CRYPTO_CTR=m +CONFIG_CRYPTO_CTS=m +CONFIG_CRYPTO_DES=m +CONFIG_CRYPTO_FIPS=y +CONFIG_CRYPTO_GCM=m +CONFIG_CRYPTO_GHASH=m +CONFIG_CRYPTO_HMAC=y +CONFIG_CRYPTO_LIB_AES=m +CONFIG_CRYPTO_LIB_DES=m +CONFIG_CRYPTO_LIB_GF128MUL=m +CONFIG_CRYPTO_LZO=m +# CONFIG_CRYPTO_MANAGER_DISABLE_TESTS is not set +CONFIG_CRYPTO_NULL=m +CONFIG_CRYPTO_SELFTESTS=y +CONFIG_CRYPTO_SHA1=y +CONFIG_CRYPTO_USER_API_HASH=m +CONFIG_CRYPTO_USER_API_SKCIPHER=m +CONFIG_CUSE=m +CONFIG_DCB=y +CONFIG_DEBUG_FS=y +CONFIG_DEBUG_INFO_BTF=y +CONFIG_DEBUG_INFO_DWARF_TOOLCHAIN_DEFAULT=y +CONFIG_DEBUG_SHIRQ=y +# CONFIG_DEVKMEM is not set +CONFIG_DEVTMPFS=y +CONFIG_DEVTMPFS_MOUNT=y +CONFIG_DL2K=m +CONFIG_DLM=m +CONFIG_DMADEVICES=y +CONFIG_DMI_SYSFS=m +CONFIG_DM_CACHE=m +CONFIG_DM_CRYPT=m +CONFIG_DM_MIRROR=m +CONFIG_DM_MULTIPATH=m +CONFIG_DM_MULTIPATH_QL=m +CONFIG_DM_MULTIPATH_ST=m +CONFIG_DM_RAID=m +CONFIG_DM_SNAPSHOT=m +CONFIG_DM_THIN_PROVISIONING=m +CONFIG_DM_UEVENT=y +CONFIG_DM_VERITY=m +CONFIG_DM_ZERO=m +CONFIG_DNS_RESOLVER=y +CONFIG_DRM=m +CONFIG_DRM_FBDEV_EMULATION=y +CONFIG_DRM_QXL=m +CONFIG_DRM_SIMPLEDRM=m +CONFIG_DRM_TTM_HELPER=m +CONFIG_DRM_VIRTIO_GPU=m +CONFIG_DST_CACHE=y +CONFIG_DUMMY=m +CONFIG_DYNAMIC_DEBUG=y +CONFIG_E100=m +CONFIG_E1000=m +CONFIG_E1000E=m +CONFIG_EDAC=m +# CONFIG_EDAC_LEGACY_SYSFS is not set +CONFIG_EFI=y +CONFIG_EFIVAR_FS=y +CONFIG_EFI_STUB=y +# CONFIG_ENABLE_WARN_DEPRECATED is not set +CONFIG_ENA_ETHERNET=m +CONFIG_ENCLOSURE_SERVICES=m +CONFIG_ENCRYPTED_KEYS=m +CONFIG_EROFS_FS=m +CONFIG_EROFS_FS_XATTR=y +CONFIG_EXPERT=y +CONFIG_EXT4_FS=m +CONFIG_EXT4_FS_POSIX_ACL=y +CONFIG_EXT4_FS_SECURITY=y +CONFIG_FANOTIFY=y +CONFIG_FANOTIFY_ACCESS_PERMISSIONS=y +CONFIG_FAT_DEFAULT_IOCHARSET="ascii" +CONFIG_FB=y +CONFIG_FB_EFI=y +CONFIG_FB_HYPERV=m +CONFIG_FCOE=m +# CONFIG_FIRMWARE_IN_KERNEL is not set +CONFIG_FORCEDETH=m +CONFIG_FORTIFY_SOURCE=y +CONFIG_FRAMEBUFFER_CONSOLE=y +CONFIG_FRAMEBUFFER_CONSOLE_DETECT_PRIMARY=y +CONFIG_FRAMEBUFFER_CONSOLE_ROTATION=y +CONFIG_FSCACHE=y +CONFIG_FSCACHE_STATS=y +CONFIG_FS_DAX=y +CONFIG_FS_ENCRYPTION=y +CONFIG_FTRACE_SYSCALLS=y +CONFIG_FUSE_DAX=y +CONFIG_FUSE_FS=m +CONFIG_FUSION=y +CONFIG_FUSION_CTL=m +CONFIG_FUSION_LOGGING=y +CONFIG_FUSION_MAX_SGE=40 +CONFIG_FUSION_SAS=m +CONFIG_FUSION_SPI=m +CONFIG_FW_CFG_SYSFS=m +CONFIG_GACT_PROB=y +CONFIG_GENEVE=m +CONFIG_GPIOLIB=y +CONFIG_GPIO_SYSFS=y +CONFIG_GRO_CELLS=y +CONFIG_GTP=m +CONFIG_HARDENED_USERCOPY=y +CONFIG_HIDRAW=y +CONFIG_HID_APPLE=m +CONFIG_HID_BELKIN=m +CONFIG_HID_HYPERV_MOUSE=m +CONFIG_HID_MICROSOFT=m +CONFIG_HIGH_RES_TIMERS=y +CONFIG_HOTPLUG_PCI=y +CONFIG_HOTPLUG_PCI_ACPI=y +CONFIG_HOTPLUG_PCI_PCIE=y +CONFIG_HP_ILO=m +CONFIG_HUGETLBFS=y +CONFIG_HWMON=m +CONFIG_HW_RANDOM=y +CONFIG_HW_RANDOM_TIMERIOMEM=m +CONFIG_HW_RANDOM_VIRTIO=y +CONFIG_HYPERV=y +CONFIG_HYPERV_BALLOON=m +CONFIG_HYPERV_NET=m +CONFIG_HYPERV_UTILS=m +CONFIG_HZ_1000=y +CONFIG_I2C_AMD756=m +CONFIG_I2C_AMD8111=m +# CONFIG_I2C_COMPAT is not set +CONFIG_I2C_I801=m +CONFIG_I2C_PIIX4=m +CONFIG_I40E=m +CONFIG_I40EVF=m +CONFIG_ICE=m +CONFIG_IFB=m +CONFIG_IGB=m +CONFIG_IGBVF=m +CONFIG_IKCONFIG=y +CONFIG_IKCONFIG_PROC=y +CONFIG_IKHEADERS=m +CONFIG_IMA=y +CONFIG_IMA_APPRAISE=y +CONFIG_IMA_DEFAULT_HASH="sha1" +CONFIG_IMA_DEFAULT_HASH_SHA1=y +CONFIG_IMA_DEFAULT_TEMPLATE="ima-ng" +CONFIG_IMA_LSM_RULES=y +CONFIG_IMA_MEASURE_PCR_IDX=10 +CONFIG_IMA_NG_TEMPLATE=y +CONFIG_IMA_READ_POLICY=y +CONFIG_IMA_WRITE_POLICY=y +CONFIG_INET=y +CONFIG_INET6_AH=m +CONFIG_INET6_ESP=m +CONFIG_INET6_ESP_OFFLOAD=m +CONFIG_INET6_IPCOMP=m +CONFIG_INET_AH=m +CONFIG_INET_DIAG=m +CONFIG_INET_DIAG_DESTROY=y +CONFIG_INET_ESP=m +CONFIG_INET_ESP_OFFLOAD=m +CONFIG_INET_IPCOMP=m +CONFIG_INET_UDP_DIAG=m +CONFIG_INFINIBAND=m +CONFIG_INFINIBAND_CXGB4=m +CONFIG_INFINIBAND_IPOIB=m +CONFIG_INFINIBAND_IPOIB_CM=y +CONFIG_INFINIBAND_IPOIB_DEBUG_DATA=y +CONFIG_INFINIBAND_ISER=m +CONFIG_INFINIBAND_MTHCA=m +CONFIG_INFINIBAND_OCRDMA=m +CONFIG_INFINIBAND_SRP=m +CONFIG_INFINIBAND_USER_MAD=m +CONFIG_INITRAMFS_COMPRESSION_XZ=y +CONFIG_INIT_STACK_NONE=y +CONFIG_INPUT_EVDEV=m +CONFIG_INPUT_MISC=y +CONFIG_INPUT_MOUSEDEV=m +# CONFIG_INPUT_MOUSEDEV_PSAUX is not set +CONFIG_IOSCHED_BFQ=y +CONFIG_IO_STRICT_DEVMEM=y +CONFIG_IP6_NF_FILTER=m +CONFIG_IP6_NF_IPTABLES=m +CONFIG_IP6_NF_MANGLE=m +CONFIG_IP6_NF_MATCH_AH=m +CONFIG_IP6_NF_MATCH_EUI64=m +CONFIG_IP6_NF_MATCH_FRAG=m +CONFIG_IP6_NF_MATCH_HL=m +CONFIG_IP6_NF_MATCH_IPV6HEADER=m +CONFIG_IP6_NF_MATCH_MH=m +CONFIG_IP6_NF_MATCH_OPTS=m +CONFIG_IP6_NF_MATCH_RPFILTER=m +CONFIG_IP6_NF_MATCH_RT=m +CONFIG_IP6_NF_MATCH_SRH=m +CONFIG_IP6_NF_NAT=m +CONFIG_IP6_NF_RAW=m +CONFIG_IP6_NF_SECURITY=m +CONFIG_IP6_NF_TARGET_HL=m +CONFIG_IP6_NF_TARGET_MASQUERADE=m +CONFIG_IP6_NF_TARGET_NPT=m +CONFIG_IP6_NF_TARGET_REJECT=m +CONFIG_IP6_NF_TARGET_SYNPROXY=m +CONFIG_IPMI_DEVICE_INTERFACE=m +CONFIG_IPMI_HANDLER=m +CONFIG_IPMI_PANIC_EVENT=y +CONFIG_IPMI_PANIC_STRING=y +CONFIG_IPMI_POWEROFF=m +CONFIG_IPMI_SI=m +CONFIG_IPMI_SSIF=m +CONFIG_IPMI_WATCHDOG=m +CONFIG_IPV6_GRE=m +CONFIG_IPV6_MIP6=m +CONFIG_IPV6_MROUTE=y +CONFIG_IPV6_MROUTE_MULTIPLE_TABLES=y +CONFIG_IPV6_MULTIPLE_TABLES=y +CONFIG_IPV6_OPTIMISTIC_DAD=y +CONFIG_IPV6_PIMSM_V2=y +CONFIG_IPV6_ROUTER_PREF=y +CONFIG_IPV6_ROUTE_INFO=y +CONFIG_IPV6_SIT=m +CONFIG_IPV6_SIT_6RD=y +CONFIG_IPV6_SUBTREES=y +CONFIG_IPV6_VTI=m +CONFIG_IPVLAN=m +CONFIG_IP_ADVANCED_ROUTER=y +CONFIG_IP_FIB_TRIE_STATS=y +CONFIG_IP_MROUTE=y +CONFIG_IP_MROUTE_MULTIPLE_TABLES=y +CONFIG_IP_MULTICAST=y +CONFIG_IP_MULTIPLE_TABLES=y +CONFIG_IP_NF_ARPFILTER=m +CONFIG_IP_NF_ARPTABLES=m +CONFIG_IP_NF_ARP_MANGLE=m +CONFIG_IP_NF_FILTER=m +CONFIG_IP_NF_IPTABLES=y +CONFIG_IP_NF_MANGLE=m +CONFIG_IP_NF_MATCH_AH=m +CONFIG_IP_NF_MATCH_ECN=m +CONFIG_IP_NF_MATCH_RPFILTER=m +CONFIG_IP_NF_MATCH_TTL=m +CONFIG_IP_NF_NAT=m +CONFIG_IP_NF_RAW=m +CONFIG_IP_NF_SECURITY=m +CONFIG_IP_NF_TARGET_ECN=m +CONFIG_IP_NF_TARGET_MASQUERADE=m +CONFIG_IP_NF_TARGET_NETMAP=m +CONFIG_IP_NF_TARGET_REDIRECT=m +CONFIG_IP_NF_TARGET_REJECT=m +CONFIG_IP_NF_TARGET_SYNPROXY=m +CONFIG_IP_NF_TARGET_TTL=m +CONFIG_IP_PIMSM_V1=y +CONFIG_IP_PIMSM_V2=y +# CONFIG_IP_PNP is not set +CONFIG_IP_ROUTE_MULTIPATH=y +CONFIG_IP_ROUTE_VERBOSE=y +CONFIG_IP_SCTP=m +CONFIG_IP_SET=m +CONFIG_IP_SET_BITMAP_IP=m +CONFIG_IP_SET_BITMAP_IPMAC=m +CONFIG_IP_SET_BITMAP_PORT=m +CONFIG_IP_SET_HASH_IP=m +CONFIG_IP_SET_HASH_IPMARK=m +CONFIG_IP_SET_HASH_IPPORT=m +CONFIG_IP_SET_HASH_IPPORTIP=m +CONFIG_IP_SET_HASH_IPPORTNET=m +CONFIG_IP_SET_HASH_MAC=m +CONFIG_IP_SET_HASH_NET=m +CONFIG_IP_SET_HASH_NETIFACE=m +CONFIG_IP_SET_HASH_NETNET=m +CONFIG_IP_SET_HASH_NETPORT=m +CONFIG_IP_SET_HASH_NETPORTNET=m +CONFIG_IP_SET_LIST_SET=m +CONFIG_IP_VS=m +CONFIG_IP_VS_DH=m +CONFIG_IP_VS_FO=m +CONFIG_IP_VS_FTP=m +CONFIG_IP_VS_IPV6=y +CONFIG_IP_VS_LBLC=m +CONFIG_IP_VS_LBLCR=m +CONFIG_IP_VS_LC=m +CONFIG_IP_VS_NQ=m +CONFIG_IP_VS_PE_SIP=m +CONFIG_IP_VS_PROTO_AH=y +CONFIG_IP_VS_PROTO_ESP=y +CONFIG_IP_VS_PROTO_SCTP=y +CONFIG_IP_VS_PROTO_TCP=y +CONFIG_IP_VS_PROTO_UDP=y +CONFIG_IP_VS_RR=m +CONFIG_IP_VS_SED=m +CONFIG_IP_VS_SH=m +CONFIG_IP_VS_WLC=m +CONFIG_IP_VS_WRR=m +CONFIG_IRQ_TIME_ACCOUNTING=y +CONFIG_ISCSI_BOOT_SYSFS=m +CONFIG_ISCSI_TARGET=m +CONFIG_ISCSI_TCP=m +CONFIG_ISO9660_FS=m +CONFIG_IXGBE=m +CONFIG_IXGBEVF=m +CONFIG_IXGBEVF_IPSEC=y +CONFIG_IXGBE_IPSEC=y +CONFIG_JME=m +CONFIG_JOLIET=y +CONFIG_JUMP_LABEL=y +CONFIG_KALLSYMS_ALL=y +CONFIG_KEXEC=y +CONFIG_KEYS=y +CONFIG_KEY_DH_OPERATIONS=y +CONFIG_KPROBES=y +CONFIG_KPROBE_EVENTS=y +CONFIG_KRETPROBES=y +CONFIG_KSM=y +CONFIG_LATENCYTOP=y +# CONFIG_LCD_CLASS_DEVICE is not set +CONFIG_LEDS_CLASS=y +# CONFIG_LEGACY_PTYS is not set +CONFIG_LIBFC=m +CONFIG_LIBFCOE=m +# CONFIG_LOCALVERSION_AUTO is not set +CONFIG_LOCK_DOWN_IN_EFI_SECURE_BOOT=y +CONFIG_LOG_BUF_SHIFT=18 +CONFIG_LOOPBACK_TARGET=m +CONFIG_LSM="landlock,lockdown,yama,loadpin,safesetid,integrity,selinux,smack,tomoyo,apparmor" +CONFIG_LWTUNNEL=y +CONFIG_LWTUNNEL_BPF=y +CONFIG_MACSEC=m +CONFIG_MACVLAN=m +CONFIG_MACVTAP=m +CONFIG_MAGIC_SYSRQ=y +CONFIG_MARVELL_PHY=m +CONFIG_MAX_RAW_DEVS=8192 +CONFIG_MD=y +CONFIG_MD_LINEAR=m +CONFIG_MD_RAID0=m +CONFIG_MEGARAID_MAILBOX=m +CONFIG_MEGARAID_MM=m +CONFIG_MEGARAID_NEWGEN=y +CONFIG_MEGARAID_SAS=m +CONFIG_MEMCG=y +CONFIG_MEMCG_V1=y +CONFIG_MEMORY_HOTPLUG=y +CONFIG_MEMORY_HOTREMOVE=y +CONFIG_MEMTEST=y +CONFIG_MICROSOFT_MANA=m +CONFIG_MINIX_SUBPARTITION=y +# CONFIG_MLX4_DEBUG is not set +CONFIG_MLX4_EN=m +CONFIG_MLX4_INFINIBAND=m +CONFIG_MLX5_BRIDGE=y +CONFIG_MLX5_CLS_ACT=y +CONFIG_MLX5_CORE=m +CONFIG_MLX5_CORE_EN=y +CONFIG_MLX5_CORE_EN_DCB=y +CONFIG_MLX5_EN_ARFS=y +CONFIG_MLX5_EN_IPSEC=y +CONFIG_MLX5_EN_RXNFC=y +CONFIG_MLX5_EN_TLS=y +CONFIG_MLX5_ESWITCH=y +CONFIG_MLX5_INFINIBAND=m +CONFIG_MLX5_MACSEC=y +CONFIG_MLX5_MPFS=y +CONFIG_MLX5_SF=y +CONFIG_MLX5_SF_MANAGER=y +CONFIG_MLX5_SW_STEERING=y +CONFIG_MLX5_TC_CT=y +CONFIG_MLX5_TC_SAMPLE=y +CONFIG_MLX5_VDPA=y +CONFIG_MLX5_VDPA_NET=m +CONFIG_MLX5_VFIO_PCI=m +CONFIG_MMC=m +CONFIG_MMC_BLOCK=m +CONFIG_MMC_BLOCK_MINORS=16 +# CONFIG_MMC_RICOH_MMC is not set +CONFIG_MMC_SDHCI=m +CONFIG_MMC_SDHCI_PCI=m +CONFIG_MODULES=y +CONFIG_MODULE_COMPRESS=y +CONFIG_MODULE_COMPRESS_XZ=y +CONFIG_MODULE_SIG=y +CONFIG_MODULE_SIG_KEY="${MODULE_SIGNING_KEY_DIR}/certs/modules.pem" +CONFIG_MODULE_SIG_SHA256=y +CONFIG_MODULE_UNLOAD=y +CONFIG_MOUSE_PS2=m +# CONFIG_MOUSE_PS2_ALPS is not set +# CONFIG_MOUSE_PS2_CYPRESS is not set +# CONFIG_MOUSE_PS2_FOCALTECH is not set +# CONFIG_MOUSE_PS2_LOGIPS2PP is not set +# CONFIG_MOUSE_PS2_SYNAPTICS is not set +# CONFIG_MOUSE_PS2_TRACKPOINT is not set +CONFIG_MPLS_IPTUNNEL=m +CONFIG_MPLS_ROUTING=m +CONFIG_MSDOS_FS=m +CONFIG_MTD=m +CONFIG_MYRI10GE=m +CONFIG_NAMESPACES=y +CONFIG_NATSEMI=m +CONFIG_NET=y +CONFIG_NETCONSOLE=m +CONFIG_NETCONSOLE_DYNAMIC=y +CONFIG_NETDEVICES=y +CONFIG_NETFILTER=y +CONFIG_NETFILTER_ADVANCED=y +CONFIG_NETFILTER_NETLINK_GLUE_CT=y +CONFIG_NETFILTER_NETLINK_QUEUE=m +CONFIG_NETFILTER_XTABLES=y +CONFIG_NETFILTER_XTABLES_LEGACY=y +CONFIG_NETFILTER_XT_MATCH_ADDRTYPE=m +CONFIG_NETFILTER_XT_MATCH_BPF=m +CONFIG_NETFILTER_XT_MATCH_CGROUP=m +CONFIG_NETFILTER_XT_MATCH_CLUSTER=m +CONFIG_NETFILTER_XT_MATCH_COMMENT=m +CONFIG_NETFILTER_XT_MATCH_CONNBYTES=m +CONFIG_NETFILTER_XT_MATCH_CONNLABEL=m +CONFIG_NETFILTER_XT_MATCH_CONNLIMIT=m +CONFIG_NETFILTER_XT_MATCH_CONNMARK=m +CONFIG_NETFILTER_XT_MATCH_CONNTRACK=m +CONFIG_NETFILTER_XT_MATCH_CPU=m +CONFIG_NETFILTER_XT_MATCH_DEVGROUP=m +CONFIG_NETFILTER_XT_MATCH_DSCP=m +CONFIG_NETFILTER_XT_MATCH_ESP=m +CONFIG_NETFILTER_XT_MATCH_HASHLIMIT=m +CONFIG_NETFILTER_XT_MATCH_HELPER=m +CONFIG_NETFILTER_XT_MATCH_IPCOMP=m +CONFIG_NETFILTER_XT_MATCH_IPRANGE=m +CONFIG_NETFILTER_XT_MATCH_IPVS=m +CONFIG_NETFILTER_XT_MATCH_L2TP=m +CONFIG_NETFILTER_XT_MATCH_LENGTH=m +CONFIG_NETFILTER_XT_MATCH_LIMIT=m +CONFIG_NETFILTER_XT_MATCH_MAC=m +CONFIG_NETFILTER_XT_MATCH_MARK=m +CONFIG_NETFILTER_XT_MATCH_MULTIPORT=m +CONFIG_NETFILTER_XT_MATCH_NFACCT=m +CONFIG_NETFILTER_XT_MATCH_OSF=m +CONFIG_NETFILTER_XT_MATCH_OWNER=m +CONFIG_NETFILTER_XT_MATCH_PHYSDEV=m +CONFIG_NETFILTER_XT_MATCH_PKTTYPE=m +CONFIG_NETFILTER_XT_MATCH_POLICY=m +CONFIG_NETFILTER_XT_MATCH_QUOTA=m +CONFIG_NETFILTER_XT_MATCH_RATEEST=m +CONFIG_NETFILTER_XT_MATCH_REALM=m +CONFIG_NETFILTER_XT_MATCH_RECENT=m +CONFIG_NETFILTER_XT_MATCH_SOCKET=m +CONFIG_NETFILTER_XT_MATCH_STATE=m +CONFIG_NETFILTER_XT_MATCH_STATISTIC=m +CONFIG_NETFILTER_XT_MATCH_STRING=m +CONFIG_NETFILTER_XT_MATCH_TCPMSS=m +CONFIG_NETFILTER_XT_MATCH_TIME=m +CONFIG_NETFILTER_XT_MATCH_U32=m +CONFIG_NETFILTER_XT_SET=m +CONFIG_NETFILTER_XT_TARGET_CHECKSUM=m +CONFIG_NETFILTER_XT_TARGET_CLASSIFY=m +CONFIG_NETFILTER_XT_TARGET_CONNMARK=m +CONFIG_NETFILTER_XT_TARGET_CONNSECMARK=m +CONFIG_NETFILTER_XT_TARGET_CT=m +CONFIG_NETFILTER_XT_TARGET_DSCP=m +CONFIG_NETFILTER_XT_TARGET_HMARK=m +CONFIG_NETFILTER_XT_TARGET_IDLETIMER=m +CONFIG_NETFILTER_XT_TARGET_LOG=m +CONFIG_NETFILTER_XT_TARGET_MARK=m +CONFIG_NETFILTER_XT_TARGET_NFLOG=m +CONFIG_NETFILTER_XT_TARGET_NFQUEUE=m +CONFIG_NETFILTER_XT_TARGET_SECMARK=m +CONFIG_NETFILTER_XT_TARGET_TCPMSS=m +CONFIG_NETFILTER_XT_TARGET_TCPOPTSTRIP=m +CONFIG_NETFILTER_XT_TARGET_TEE=m +CONFIG_NETFILTER_XT_TARGET_TPROXY=m +CONFIG_NETFILTER_XT_TARGET_TRACE=m +CONFIG_NETLINK_DIAG=m +CONFIG_NETWORK_PHY_TIMESTAMPING=y +CONFIG_NETXEN_NIC=m +CONFIG_NET_9P=m +# CONFIG_NET_9P_DEBUG is not set +CONFIG_NET_9P_RDMA=m +CONFIG_NET_9P_VIRTIO=m +CONFIG_NET_ACT_BPF=m +CONFIG_NET_ACT_CONNMARK=m +CONFIG_NET_ACT_CSUM=m +CONFIG_NET_ACT_CT=m +CONFIG_NET_ACT_CTINFO=m +CONFIG_NET_ACT_GACT=m +CONFIG_NET_ACT_GATE=m +CONFIG_NET_ACT_IFE=m +CONFIG_NET_ACT_MIRRED=m +CONFIG_NET_ACT_MPLS=m +CONFIG_NET_ACT_NAT=m +CONFIG_NET_ACT_PEDIT=m +CONFIG_NET_ACT_POLICE=m +CONFIG_NET_ACT_SAMPLE=m +CONFIG_NET_ACT_SIMP=m +CONFIG_NET_ACT_SKBEDIT=m +CONFIG_NET_ACT_SKBMOD=m +CONFIG_NET_ACT_TUNNEL_KEY=m +CONFIG_NET_ACT_VLAN=m +# CONFIG_NET_CADENCE is not set +CONFIG_NET_CLS_ACT=y +CONFIG_NET_CLS_BASIC=m +CONFIG_NET_CLS_BPF=m +CONFIG_NET_CLS_CGROUP=m +CONFIG_NET_CLS_FLOW=m +CONFIG_NET_CLS_FLOWER=m +CONFIG_NET_CLS_FW=m +CONFIG_NET_CLS_ROUTE4=m +CONFIG_NET_CLS_U32=m +CONFIG_NET_EMATCH=y +CONFIG_NET_EMATCH_CMP=m +CONFIG_NET_EMATCH_IPSET=m +CONFIG_NET_EMATCH_META=m +CONFIG_NET_EMATCH_NBYTE=m +CONFIG_NET_EMATCH_TEXT=m +CONFIG_NET_EMATCH_U32=m +CONFIG_NET_FOU_IP_TUNNELS=y +CONFIG_NET_IFE=m +CONFIG_NET_IPGRE=m +CONFIG_NET_IPGRE_BROADCAST=y +CONFIG_NET_IPGRE_DEMUX=m +CONFIG_NET_IPIP=m +CONFIG_NET_IPVTI=m +CONFIG_NET_KEY=m +CONFIG_NET_L3_MASTER_DEV=y +# CONFIG_NET_PACKET_ENGINE is not set +CONFIG_NET_SCHED=y +CONFIG_NET_SCH_CHOKE=m +CONFIG_NET_SCH_CODEL=m +CONFIG_NET_SCH_DRR=m +CONFIG_NET_SCH_FQ=m +CONFIG_NET_SCH_FQ_CODEL=m +CONFIG_NET_SCH_GRED=m +CONFIG_NET_SCH_HFSC=m +CONFIG_NET_SCH_HHF=m +CONFIG_NET_SCH_HTB=m +CONFIG_NET_SCH_INGRESS=m +CONFIG_NET_SCH_MQPRIO=m +CONFIG_NET_SCH_MULTIQ=m +CONFIG_NET_SCH_NETEM=m +CONFIG_NET_SCH_PIE=m +CONFIG_NET_SCH_PLUG=m +CONFIG_NET_SCH_PRIO=m +CONFIG_NET_SCH_QFQ=m +CONFIG_NET_SCH_RED=m +CONFIG_NET_SCH_SFB=m +CONFIG_NET_SCH_SFQ=m +CONFIG_NET_SCH_TBF=m +CONFIG_NET_SCH_TEQL=m +CONFIG_NET_SWITCHDEV=y +CONFIG_NET_TC_SKB_EXT=y +CONFIG_NET_TULIP=y +# CONFIG_NET_VENDOR_3COM is not set +# CONFIG_NET_VENDOR_ADAPTEC is not set +# CONFIG_NET_VENDOR_AGERE is not set +# CONFIG_NET_VENDOR_ARC is not set +# CONFIG_NET_VENDOR_MICREL is not set +CONFIG_NET_VENDOR_NATSEMI=y +# CONFIG_NET_VENDOR_OKI is not set +# CONFIG_NET_VENDOR_QUALCOMM is not set +# CONFIG_NET_VENDOR_RDC is not set +# CONFIG_NET_VENDOR_ROCKER is not set +# CONFIG_NET_VENDOR_SAMSUNG is not set +# CONFIG_NET_VENDOR_SEEQ is not set +# CONFIG_NET_VENDOR_SILAN is not set +# CONFIG_NET_VENDOR_SIS is not set +# CONFIG_NET_VENDOR_SMSC is not set +# CONFIG_NET_VENDOR_STMICRO is not set +# CONFIG_NET_VENDOR_SUN is not set +# CONFIG_NET_VENDOR_TEHUTI is not set +# CONFIG_NET_VENDOR_TI is not set +CONFIG_NET_VENDOR_VIA=y +# CONFIG_NET_VENDOR_WIZNET is not set +CONFIG_NET_VRF=y +CONFIG_NEW_LEDS=y +CONFIG_NFSD=m +CONFIG_NFSD_V3_ACL=y +CONFIG_NFSD_V4=y +CONFIG_NFS_FS=m +CONFIG_NFS_FSCACHE=y +CONFIG_NFS_V3_ACL=y +CONFIG_NFS_V4=m +CONFIG_NFS_V4_1=y +CONFIG_NFS_V4_2=y +CONFIG_NFS_V4_2_READ_PLUS=n +CONFIG_NFT_BRIDGE_META=m +CONFIG_NFT_BRIDGE_REJECT=m +CONFIG_NFT_COMPAT=m +CONFIG_NFT_CT=m +CONFIG_NFT_DUP_IPV4=m +CONFIG_NFT_DUP_IPV6=m +CONFIG_NFT_DUP_NETDEV=m +CONFIG_NFT_FIB=m +CONFIG_NFT_FIB_INET=m +CONFIG_NFT_FIB_IPV4=m +CONFIG_NFT_FIB_IPV6=m +CONFIG_NFT_FIB_NETDEV=m +CONFIG_NFT_FLOW_OFFLOAD=m +CONFIG_NFT_FWD_NETDEV=m +CONFIG_NFT_HASH=m +CONFIG_NFT_LIMIT=m +CONFIG_NFT_LOG=m +CONFIG_NFT_MASQ=m +CONFIG_NFT_NAT=m +CONFIG_NFT_NUMGEN=m +CONFIG_NFT_QUEUE=m +CONFIG_NFT_QUOTA=m +CONFIG_NFT_REDIR=m +CONFIG_NFT_REJECT=m +CONFIG_NFT_TUNNEL=m +CONFIG_NFT_XFRM=m +CONFIG_NF_CONNTRACK=m +CONFIG_NF_CONNTRACK_AMANDA=m +CONFIG_NF_CONNTRACK_BRIDGE=m +CONFIG_NF_CONNTRACK_EVENTS=y +CONFIG_NF_CONNTRACK_FTP=m +CONFIG_NF_CONNTRACK_H323=m +CONFIG_NF_CONNTRACK_IRC=m +CONFIG_NF_CONNTRACK_NETBIOS_NS=m +CONFIG_NF_CONNTRACK_PPTP=m +# CONFIG_NF_CONNTRACK_PROC_COMPAT is not set +CONFIG_NF_CONNTRACK_SANE=m +CONFIG_NF_CONNTRACK_SECMARK=y +CONFIG_NF_CONNTRACK_SIP=m +CONFIG_NF_CONNTRACK_SNMP=m +CONFIG_NF_CONNTRACK_TFTP=m +CONFIG_NF_CONNTRACK_TIMEOUT=y +CONFIG_NF_CONNTRACK_TIMESTAMP=y +CONFIG_NF_CONNTRACK_ZONES=y +CONFIG_NF_CT_NETLINK=m +CONFIG_NF_CT_NETLINK_HELPER=m +CONFIG_NF_CT_NETLINK_TIMEOUT=m +CONFIG_NF_CT_PROTO_UDPLITE=y +CONFIG_NF_FLOW_TABLE=m +CONFIG_NF_LOG_ARP=m +CONFIG_NF_SOCKET_IPV4=m +CONFIG_NF_SOCKET_IPV6=m +CONFIG_NF_TABLES=m +CONFIG_NF_TABLES_ARP=y +CONFIG_NF_TABLES_BRIDGE=y +CONFIG_NF_TABLES_INET=y +CONFIG_NF_TABLES_IPV4=y +CONFIG_NF_TABLES_IPV6=y +CONFIG_NF_TABLES_NETDEV=y +CONFIG_NLS_ASCII=m +CONFIG_NLS_CODEPAGE_437=m +CONFIG_NLS_DEFAULT="utf8" +CONFIG_NLS_UTF8=m +CONFIG_NODES_SHIFT=7 +CONFIG_NO_HZ=y +CONFIG_NR_CPUS=512 +CONFIG_NUMA=y +CONFIG_NUMA_BALANCING=y +CONFIG_NVME_RDMA=m +CONFIG_NVME_TARGET=m +CONFIG_NVME_TARGET_LOOP=m +CONFIG_NVME_TARGET_RDMA=m +CONFIG_OPENVSWITCH=m +CONFIG_OVERLAY_FS=m +CONFIG_OVERLAY_FS_METACOPY=y +CONFIG_OVERLAY_FS_REDIRECT_DIR=y +CONFIG_OVPN=m +CONFIG_PACKET=y +CONFIG_PACKET_DIAG=m +CONFIG_PANIC_ON_OOPS=y +CONFIG_PANIC_TIMEOUT=60 +CONFIG_PARAVIRT=y +CONFIG_PARAVIRT_TIME_ACCOUNTING=y +CONFIG_PARTITION_ADVANCED=y +CONFIG_PATA_JMICRON=m +CONFIG_PATA_VIA=m +CONFIG_PCI=y +CONFIG_PCIEAER=y +CONFIG_PCIEPORTBUS=y +CONFIG_PCIE_ECRC=y +CONFIG_PCIE_THERMAL=y +CONFIG_PCI_HYPERV=m +CONFIG_PCI_IOV=y +CONFIG_PCI_MSI=y +CONFIG_PCNET32=m +CONFIG_PDC_ADMA=m +CONFIG_PLDMFW=y +CONFIG_POSIX_MQUEUE=y +CONFIG_POWER_SUPPLY=y +CONFIG_PPP=m +CONFIG_PPPOE=m +CONFIG_PPP_ASYNC=m +CONFIG_PPP_BSDCOMP=m +CONFIG_PPP_DEFLATE=m +CONFIG_PPP_FILTER=y +CONFIG_PPP_MPPE=m +CONFIG_PPP_MULTILINK=y +CONFIG_PPP_SYNC_TTY=m +CONFIG_PRINTK_TIME=y +# CONFIG_PRINT_QUOTA_WARNING is not set +CONFIG_PROC_KCORE=y +CONFIG_PROFILING=y +CONFIG_PSAMPLE=m +CONFIG_PSI=y +# CONFIG_PSI_DEFAULT_DISABLED is not set +CONFIG_PTP_1588_CLOCK=m +CONFIG_PTP_1588_CLOCK_KVM=m +CONFIG_QED=m +CONFIG_QEDE=m +CONFIG_QEDF=m +CONFIG_QEDI=m +CONFIG_QED_FCOE=y +CONFIG_QED_ISCSI=y +CONFIG_QED_LL2=y +CONFIG_QED_OOO=y +CONFIG_QFMT_V2=m +CONFIG_QUOTA=y +CONFIG_QUOTA_NETLINK_INTERFACE=y +CONFIG_R8169=m +CONFIG_RANDOMIZE_BASE=y +CONFIG_RCU_CPU_STALL_TIMEOUT=60 +# CONFIG_RC_CORE is not set +CONFIG_RDS=m +CONFIG_RDS_RDMA=m +CONFIG_RDS_TCP=m +CONFIG_REALTEK_PHY=m +CONFIG_REGULATOR=y +CONFIG_REGULATOR_FIXED_VOLTAGE=y +# CONFIG_RPCSEC_GSS_KRB5 requires some older crypto modules +CONFIG_RPCSEC_GSS_KRB5=m +CONFIG_RTC_CLASS=y +CONFIG_RT_GROUP_SCHED=y +CONFIG_S2IO=m +CONFIG_SATA_AHCI=m +CONFIG_SATA_MV=m +CONFIG_SATA_NV=m +CONFIG_SATA_PROMISE=m +CONFIG_SATA_QSTOR=m +CONFIG_SATA_SIL=m +CONFIG_SATA_SIL24=m +CONFIG_SATA_SIS=m +CONFIG_SATA_SVW=m +CONFIG_SATA_SX4=m +CONFIG_SATA_VIA=m +CONFIG_SATA_VITESSE=m +CONFIG_SCHED_AUTOGROUP=y +CONFIG_SCHED_SMT=y +CONFIG_SCHED_STACK_END_CHECK=y +CONFIG_SCSI_3W_9XXX=m +CONFIG_SCSI_3W_SAS=m +CONFIG_SCSI_AACRAID=m +CONFIG_SCSI_AIC79XX=m +CONFIG_SCSI_ARCMSR=m +CONFIG_SCSI_BNX2X_FCOE=m +CONFIG_SCSI_CONSTANTS=y +CONFIG_SCSI_DH=y +CONFIG_SCSI_DH_ALUA=m +CONFIG_SCSI_DH_EMC=m +CONFIG_SCSI_DH_RDAC=m +CONFIG_SCSI_ENCLOSURE=m +CONFIG_SCSI_FC_ATTRS=m +CONFIG_SCSI_HPSA=m +CONFIG_SCSI_LOGGING=y +CONFIG_SCSI_LPFC=m +CONFIG_SCSI_MPI3MR=m +CONFIG_SCSI_MPT2SAS=m +CONFIG_SCSI_MVSAS=m +# CONFIG_SCSI_MVSAS_DEBUG is not set +CONFIG_SCSI_MVSAS_TASKLET=y +CONFIG_SCSI_QLA_FC=m +CONFIG_SCSI_QLA_ISCSI=m +CONFIG_SCSI_SAS_ATA=y +CONFIG_SCSI_SCAN_ASYNC=y +CONFIG_SCSI_SMARTPQI=m +CONFIG_SCSI_SYM53C8XX_2=m +CONFIG_SCSI_VIRTIO=m +CONFIG_SECURITY=y +CONFIG_SECURITY_LANDLOCK=y +CONFIG_SECURITY_LOCKDOWN_LSM=y +CONFIG_SECURITY_LOCKDOWN_LSM_EARLY=y +CONFIG_SECURITY_NETWORK=y +CONFIG_SECURITY_NETWORK_XFRM=y +CONFIG_SECURITY_SELINUX=y +CONFIG_SECURITY_SELINUX_BOOTPARAM=y +CONFIG_SERIAL_8250=y +CONFIG_SERIAL_8250_CONSOLE=y +CONFIG_SERIAL_8250_EXTENDED=y +CONFIG_SERIAL_8250_MANY_PORTS=y +CONFIG_SERIAL_8250_NR_UARTS=32 +CONFIG_SERIAL_8250_RSA=y +CONFIG_SERIAL_8250_SHARE_IRQ=y +# CONFIG_SERIO_SERPORT is not set +CONFIG_SFC=m +CONFIG_SIGNED_PE_FILE_VERIFICATION=y +CONFIG_SKGE=m +CONFIG_SKY2=m +CONFIG_SLAB_FREELIST_HARDENED=y +CONFIG_SLAB_FREELIST_RANDOM=y +CONFIG_SMP=y +CONFIG_SOCK_VALIDATE_XMIT=y +CONFIG_SOFTLOCKUP_DETECTOR=y +CONFIG_SOFT_WATCHDOG=m +CONFIG_SOLARIS_X86_PARTITION=y +CONFIG_SQUASHFS=m +CONFIG_SQUASHFS_LZ4=y +CONFIG_SQUASHFS_LZO=y +CONFIG_SQUASHFS_XATTR=y +CONFIG_SQUASHFS_XZ=y +CONFIG_SQUASHFS_ZSTD=y +CONFIG_STACKPROTECTOR_STRONG=y +CONFIG_STRICT_DEVMEM=y +CONFIG_STRIP_ASM_SYMS=y +CONFIG_SUNDANCE=m +CONFIG_SUNRPC_DEBUG=y +CONFIG_SYSFS=y +CONFIG_SYSVIPC=y +CONFIG_TARGET_CORE=m +CONFIG_TASKSTATS=y +CONFIG_TASK_IO_ACCOUNTING=y +CONFIG_TASK_XACCT=y +CONFIG_TCG_ATMEL=m +CONFIG_TCG_TIS=m +CONFIG_TCG_TIS_I2C_ATMEL=m +CONFIG_TCG_TIS_I2C_INFINEON=m +CONFIG_TCG_TIS_I2C_NUVOTON=m +CONFIG_TCG_VTPM_PROXY=m +CONFIG_TCG_XEN=m +CONFIG_TCM_FILEIO=m +CONFIG_TCM_IBLOCK=m +CONFIG_TCM_PSCSI=m +CONFIG_TCM_USER2=m +CONFIG_TCP_CONG_ADVANCED=y +CONFIG_TCP_CONG_BBR=m +# CONFIG_TCP_CONG_BIC is not set +# CONFIG_TCP_CONG_HTCP is not set +CONFIG_TCP_CONG_HYBLA=m +# CONFIG_TCP_CONG_WESTWOOD is not set +CONFIG_TCP_MD5SIG=y +CONFIG_TIGON3=m +CONFIG_TLS=m +CONFIG_TLS_DEVICE=y +CONFIG_TLS_TOE=y +CONFIG_TMPFS=y +CONFIG_TMPFS_POSIX_ACL=y +CONFIG_TRACEFS_AUTOMOUNT_DEPRECATED=n +CONFIG_TRANSPARENT_HUGEPAGE=y +CONFIG_TRUSTED_KEYS=m +CONFIG_TTY_PRINTK=y +CONFIG_TULIP=m +CONFIG_TULIP_MMIO=y +CONFIG_TULIP_NAPI=y +CONFIG_TUN=m +CONFIG_UDF_FS=m +# CONFIG_UEVENT_HELPER is not set +CONFIG_UNIX=y +CONFIG_UNIXWARE_DISKLABEL=y +CONFIG_UNIX_DIAG=m +CONFIG_USB=m +CONFIG_USB_ACM=m +CONFIG_USB_EHCI_HCD=m +CONFIG_USB_HIDDEV=y +CONFIG_USB_NET_AX8817X=m +CONFIG_USB_NET_DRIVERS=m +CONFIG_USB_OHCI_HCD=m +CONFIG_USB_RTL8152=m +CONFIG_USB_SERIAL=m +CONFIG_USB_SERIAL_CP210X=m +CONFIG_USB_SERIAL_FTDI_SIO=m +CONFIG_USB_SERIAL_GENERIC=y +CONFIG_USB_SERIAL_PL2303=m +CONFIG_USB_STORAGE=m +CONFIG_USB_UAS=m +CONFIG_USB_UHCI_HCD=m +CONFIG_USB_USBNET=m +CONFIG_USB_XHCI_HCD=m +CONFIG_USER_NS=y +CONFIG_VDPA=m +CONFIG_VETH=m +CONFIG_VFAT_FS=m +CONFIG_VFIO=m +CONFIG_VFIO_PCI=m +CONFIG_VFIO_PCI_CORE=m +CONFIG_VFIO_PCI_INTX=y +CONFIG_VHOST_IOTLB=m +CONFIG_VHOST_NET=m +CONFIG_VHOST_RING=m +CONFIG_VIA_RHINE=m +CONFIG_VIA_RHINE_MMIO=y +CONFIG_VIRTIO_BALLOON=m +CONFIG_VIRTIO_BLK=m +CONFIG_VIRTIO_CONSOLE=m +CONFIG_VIRTIO_FS=m +CONFIG_VIRTIO_INPUT=m +CONFIG_VIRTIO_MMIO=y +CONFIG_VIRTIO_MMIO_CMDLINE_DEVICES=y +CONFIG_VIRTIO_NET=m +CONFIG_VIRTIO_PCI=y +CONFIG_VIRTIO_RTC=m +CONFIG_VIRTIO_VSOCKETS=m +CONFIG_VIRT_DRIVERS=y +CONFIG_VLAN_8021Q=m +CONFIG_VLAN_8021Q_GVRP=y +CONFIG_VLAN_8021Q_MVRP=y +CONFIG_VSOCKETS=m +CONFIG_VXLAN=m +CONFIG_WATCHDOG=y +CONFIG_WIREGUARD=m +# CONFIG_WIRELESS is not set +# CONFIG_WLAN is not set +CONFIG_XEN=y +CONFIG_XENFS=m +CONFIG_XEN_BLKDEV_BACKEND=m +CONFIG_XEN_BLKDEV_FRONTEND=m +CONFIG_XEN_DEV_EVTCHN=m +CONFIG_XEN_FBDEV_FRONTEND=m +CONFIG_XEN_NETDEV_BACKEND=m +CONFIG_XEN_NETDEV_FRONTEND=m +CONFIG_XEN_SCSI_FRONTEND=m +CONFIG_XEN_WDT=m +CONFIG_XFRM=y +CONFIG_XFRM_MIGRATE=y +CONFIG_XFRM_OFFLOAD=y +CONFIG_XFRM_STATISTICS=y +CONFIG_XFRM_SUB_POLICY=y +CONFIG_XFRM_USER=m +CONFIG_XFS_FS=m +CONFIG_XFS_POSIX_ACL=y +CONFIG_XFS_QUOTA=y +# CONFIG_XZ_DEC_ARM is not set +# CONFIG_XZ_DEC_ARMTHUMB is not set +# CONFIG_XZ_DEC_IA64 is not set +# CONFIG_XZ_DEC_POWERPC is not set +# CONFIG_XZ_DEC_SPARC is not set +CONFIG_ZISOFS=y +CONFIG_ZONE_DEVICE=y +CONFIG_ZRAM=m +CONFIG_ZSMALLOC=m From 439d52e382fb802dd5e9718666aac0b10ca5c6f8 Mon Sep 17 00:00:00 2001 From: Sayan Chowdhury Date: Fri, 5 Jun 2026 12:35:17 +0530 Subject: [PATCH 3/8] sys-kernel/coreos-sources: Version bump to 6.18.45 Signed-off-by: Sayan Chowdhury --- .../sys-kernel/coreos-sources/Manifest | 4 +- ...5.ebuild => coreos-sources-6.18.45.ebuild} | 24 +-- ...1-pahole-support-reproducible-builds.patch | 26 +++ ...6-boot-Remove-the-bugger-off-message.patch | 103 +++++++++++ ...ECURE_BOOT-flag-to-indicate-secure-b.patch | 166 ++++++++++++++++++ ...ecure_boot-flag-to-indicate-secure-b.patch | 153 ++++++++++++++++ ...e-kernel-if-booted-in-secure-boot-mo.patch | 135 ++++++++++++++ ...e-kernel-if-booted-in-secure-boot-mo.patch | 121 +++++++++++++ ...sable-slram-and-phram-when-locked-do.patch | 75 ++++++++ ...Disable-when-the-kernel-is-locked-do.patch | 82 +++++++++ ...-config-option-to-lock-down-when-in-.patch | 164 +++++++++++++++++ ...s-hv-fix-cross-compilation-for-ARM64.patch | 35 ++++ 12 files changed, 1071 insertions(+), 17 deletions(-) rename sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/{coreos-sources-6.12.105.ebuild => coreos-sources-6.18.45.ebuild} (53%) create mode 100644 sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.18/z0001-pahole-support-reproducible-builds.patch create mode 100644 sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.18/z0002-Revert-x86-boot-Remove-the-bugger-off-message.patch create mode 100644 sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.18/z0003-efi-Add-an-EFI_SECURE_BOOT-flag-to-indicate-secure-b.patch create mode 100644 sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.18/z0003-efi-add-an-efi_secure_boot-flag-to-indicate-secure-b.patch create mode 100644 sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.18/z0004-efi-Lock-down-the-kernel-if-booted-in-secure-boot-mo.patch create mode 100644 sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.18/z0004-efi-lock-down-the-kernel-if-booted-in-secure-boot-mo.patch create mode 100644 sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.18/z0005-mtd-disable-slram-and-phram-when-locked-do.patch create mode 100644 sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.18/z0005-mtd-phram-slram-Disable-when-the-kernel-is-locked-do.patch create mode 100644 sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.18/z0006-arm64-add-kernel-config-option-to-lock-down-when-in-.patch create mode 100644 sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.18/z0007-tools-hv-fix-cross-compilation-for-ARM64.patch diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/Manifest b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/Manifest index 8fa6f69ee4a..34f33055170 100644 --- a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/Manifest +++ b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/Manifest @@ -1,2 +1,2 @@ -DIST linux-6.12.tar.xz 147906904 BLAKE2B b2ec2fc69218cacabbbe49f78384a5d259ca581b717617c12b000b16f4a4c59ee348ea886b37147f5f70fb9a7a01c1e2c8f19021078f6b23f5bc62d1c48d5e5e SHA512 a37b1823df7b4f72542f689b65882634740ba0401a42fdcf6601d9efd2e132e5a7650e70450ba76f6cd1f13ca31180f2ccee9d54fe4df89bc0000ade4380a548 -DIST patch-6.12.105.xz 5624568 BLAKE2B 0a70f979a8ef937a2881003131a93c785fa30dd2634055f50909cb21995ecb875bfbc9bbcae30bb1c0056f8ebc845f2bc1a704ebdd9cd07e734eaa33d70270ee SHA512 017122b28c1a43ace897e75069286b49b4115d7eda37d46b4a7d682071fc526e9e4bfd290ecbe0dc41e591801976dcb5935afd5b7c16e596860b331d1040bcb7 +DIST linux-6.18.tar.xz 154309096 BLAKE2B b94b7b9bf18aca0c3e50baf79b009a1448fc6cd9c3ee019f641cc247dcf53a4abef4274ee0608ad8cd4943af69854363a95d26e117ff23620bb07dccb158859f SHA512 88599ffdec96d150c1feb9b261ba93bb0301a9d0e1ad6bef7aeab1f5372cbfc57d8b43c7e902bd8f76921d1dbd8189663c142ea869e51d0e2b483b150ee00fe0 +DIST patch-6.18.45.xz 3184312 BLAKE2B aba9fb2692dffd6815719605d067f67b78fe9d829ad41c7b235c3eef8b8259b0a7f48cf74ba71b7e485cb0fe33efc43dcd6bc5aa2d80f43965cc0319bee47dc6 SHA512 07cb6bc7d2ef0ce5ccfc2c68333d0490a452ba18063473e40ec458066f371e17b871edf937c517f318573bbe3836f0e62f21e3caa481051738a47d9eed858bfb diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/coreos-sources-6.12.105.ebuild b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/coreos-sources-6.18.45.ebuild similarity index 53% rename from sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/coreos-sources-6.12.105.ebuild rename to sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/coreos-sources-6.18.45.ebuild index eb361930dcd..87d0374887e 100644 --- a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/coreos-sources-6.12.105.ebuild +++ b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/coreos-sources-6.18.45.ebuild @@ -1,4 +1,4 @@ -# Copyright 2014 CoreOS, Inc. +# Copyright 2026 The Flatcar Container Linux Maintainers # Distributed under the terms of the GNU General Public License v2 EAPI=7 @@ -11,14 +11,9 @@ ETYPE="sources" K_BASE_VER="5.15" inherit kernel-2 +EXTRAVERSION="-flatcar" detect_version -# Replace the -coreos suffix with -flatcar. Don't simply reset the whole -# variable because it may have additional numbers before the suffix. This -# doesn't affect the sources directory, which is still suffixed with -coreos, -# but it does affect the Makefile that is used in the build. -EXTRAVERSION="${EXTRAVERSION/-coreos/-flatcar}" - DESCRIPTION="Full sources for the CoreOS Linux kernel" HOMEPAGE="http://www.kernel.org" if [[ "${PV%%_rc*}" != "${PV}" ]]; then @@ -40,12 +35,11 @@ IUSE="" # patchlevel revision. We mustn't apply our patches first, it fails when the # local patches overlap with the upstream patch. UNIPATCH_LIST=" - ${PATCH_DIR}/z0001-kbuild-derive-relative-path-for-srctree-from-CURDIR.patch - ${PATCH_DIR}/z0002-pahole-support-reproducible-builds.patch - ${PATCH_DIR}/z0003-Revert-x86-boot-Remove-the-bugger-off-message.patch - ${PATCH_DIR}/z0004-efi-add-an-efi_secure_boot-flag-to-indicate-secure-b.patch - ${PATCH_DIR}/z0005-efi-lock-down-the-kernel-if-booted-in-secure-boot-mo.patch - ${PATCH_DIR}/z0006-mtd-disable-slram-and-phram-when-locked-down.patch - ${PATCH_DIR}/z0007-arm64-add-kernel-config-option-to-lock-down-when.patch - ${PATCH_DIR}/z0009-block-add-partition-uuid-into-uevent.patch + ${PATCH_DIR}/z0001-pahole-support-reproducible-builds.patch \ + ${PATCH_DIR}/z0002-Revert-x86-boot-Remove-the-bugger-off-message.patch \ + ${PATCH_DIR}/z0003-efi-Add-an-EFI_SECURE_BOOT-flag-to-indicate-secure-b.patch \ + ${PATCH_DIR}/z0004-efi-Lock-down-the-kernel-if-booted-in-secure-boot-mo.patch \ + ${PATCH_DIR}/z0005-mtd-phram-slram-Disable-when-the-kernel-is-locked-do.patch \ + ${PATCH_DIR}/z0006-arm64-add-kernel-config-option-to-lock-down-when-in-.patch \ + ${PATCH_DIR}/z0007-tools-hv-fix-cross-compilation-for-ARM64.patch \ " diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.18/z0001-pahole-support-reproducible-builds.patch b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.18/z0001-pahole-support-reproducible-builds.patch new file mode 100644 index 00000000000..dd815a84f3e --- /dev/null +++ b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.18/z0001-pahole-support-reproducible-builds.patch @@ -0,0 +1,26 @@ +From b8dc4700a839ff99d33b61321281368699fc6339 Mon Sep 17 00:00:00 2001 +From: Adrian Vladu +Date: Tue, 17 Sep 2024 13:44:14 +0000 +Subject: [PATCH 1/8] pahole: support reproducible builds + +--- + scripts/Makefile.btf | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/scripts/Makefile.btf b/scripts/Makefile.btf +index db76335dd917..bba03bdbbdc6 100644 +--- a/scripts/Makefile.btf ++++ b/scripts/Makefile.btf +@@ -29,6 +29,9 @@ ifneq ($(KBUILD_EXTMOD),) + module-pahole-flags-$(call test-ge, $(pahole-ver), 128) += --btf_features=distilled_base + endif + ++# Support reproducible builds. ++pahole-flags-$(call test-ge, $(pahole-ver), 127) = -j --btf_features=encode_force,var,float,enum64,decl_tag,type_tag,optimized_func,consistent_func,decl_tag_kfuncs,reproducible_build ++ + endif + + pahole-flags-$(CONFIG_PAHOLE_HAS_LANG_EXCLUDE) += --lang_exclude=rust +-- +2.51.0 + diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.18/z0002-Revert-x86-boot-Remove-the-bugger-off-message.patch b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.18/z0002-Revert-x86-boot-Remove-the-bugger-off-message.patch new file mode 100644 index 00000000000..0ce03062c03 --- /dev/null +++ b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.18/z0002-Revert-x86-boot-Remove-the-bugger-off-message.patch @@ -0,0 +1,103 @@ +From 01bcd1ecda9a9a50a97e20c7987a90cda4a0998f Mon Sep 17 00:00:00 2001 +From: Kai Lueke +Date: Fri, 15 Mar 2024 11:49:50 +0100 +Subject: [PATCH 2/8] Revert "x86/boot: Remove the 'bugger off' message" + +This reverts commit 768171d7ebbce005210e1cf8456f043304805c15 because for +now this is still needed to store the dm-verity hash. +--- + arch/x86/boot/header.S | 49 ++++++++++++++++++++++++++++++++++++++++++ + arch/x86/boot/setup.ld | 7 +++--- + 2 files changed, 52 insertions(+), 4 deletions(-) + +diff --git a/arch/x86/boot/header.S b/arch/x86/boot/header.S +index 9bea5a1e2c52..e929789e2cf4 100644 +--- a/arch/x86/boot/header.S ++++ b/arch/x86/boot/header.S +@@ -41,15 +41,64 @@ SYSSEG = 0x1000 /* historical load address >> 4 */ + + .code16 + .section ".bstext", "ax" ++ ++ .global bootsect_start ++bootsect_start: + #ifdef CONFIG_EFI_STUB + # "MZ", MS-DOS header + .word IMAGE_DOS_SIGNATURE ++#endif ++ ++ # Normalize the start address ++ ljmp $BOOTSEG, $start2 ++ ++start2: ++ movw %cs, %ax ++ movw %ax, %ds ++ movw %ax, %es ++ movw %ax, %ss ++ xorw %sp, %sp ++ sti ++ cld ++ ++ movw $bugger_off_msg, %si ++ ++msg_loop: ++ lodsb ++ andb %al, %al ++ jz bs_die ++ movb $0xe, %ah ++ movw $7, %bx ++ int $0x10 ++ jmp msg_loop ++ ++bs_die: ++ # Allow the user to press a key, then reboot ++ xorw %ax, %ax ++ int $0x16 ++ int $0x19 ++ ++ # int 0x19 should never return. In case it does anyway, ++ # invoke the BIOS reset code... ++ ljmp $0xf000,$0xfff0 ++ ++#ifdef CONFIG_EFI_STUB + .org 0x38 + # + # Offset to the PE header. + # + .long LINUX_PE_MAGIC + .long pe_header ++#endif /* CONFIG_EFI_STUB */ ++ ++ .section ".bsdata", "a" ++bugger_off_msg: ++ .ascii "Use a boot loader.\r\n" ++ .ascii "\n" ++ .ascii "Remove disk and press any key to reboot...\r\n" ++ .byte 0 ++ ++#ifdef CONFIG_EFI_STUB + pe_header: + .long IMAGE_NT_SIGNATURE + +diff --git a/arch/x86/boot/setup.ld b/arch/x86/boot/setup.ld +index e1d594a60204..f2dc13420a93 100644 +--- a/arch/x86/boot/setup.ld ++++ b/arch/x86/boot/setup.ld +@@ -10,11 +10,10 @@ ENTRY(_start) + SECTIONS + { + . = 0; +- .bstext : { +- *(.bstext) +- . = 495; +- } =0xffffffff ++ .bstext : { *(.bstext) } ++ .bsdata : { *(.bsdata) } + ++ . = 495; + .header : { *(.header) } + .entrytext : { *(.entrytext) } + .inittext : { *(.inittext) } +-- +2.51.0 + diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.18/z0003-efi-Add-an-EFI_SECURE_BOOT-flag-to-indicate-secure-b.patch b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.18/z0003-efi-Add-an-EFI_SECURE_BOOT-flag-to-indicate-secure-b.patch new file mode 100644 index 00000000000..12978a8dc0f --- /dev/null +++ b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.18/z0003-efi-Add-an-EFI_SECURE_BOOT-flag-to-indicate-secure-b.patch @@ -0,0 +1,166 @@ +From b8c17d573de9d6c4ae2da1ef51a255a128090a8c Mon Sep 17 00:00:00 2001 +From: David Howells +Date: Mon, 18 Feb 2019 12:45:03 +0000 +Subject: [PATCH 3/8] efi: Add an EFI_SECURE_BOOT flag to indicate secure boot + mode + +UEFI machines can be booted in Secure Boot mode. Add an EFI_SECURE_BOOT +flag that can be passed to efi_enabled() to find out whether secure boot is +enabled. + +Move the switch-statement in x86's setup_arch() that inteprets the +secure_boot boot parameter to generic code and set the bit there. + +Suggested-by: Ard Biesheuvel +Signed-off-by: David Howells +Reviewed-by: Ard Biesheuvel +cc: linux-efi@vger.kernel.org +[rperier: Forward-ported to 5.5: + - Use pr_warn() + - Adjust context] +[bwh: Forward-ported to 5.6: adjust context] +[bwh: Forward-ported to 5.7: + - Use the next available bit in efi.flags + - Adjust context] +--- + arch/x86/kernel/setup.c | 14 +---------- + drivers/firmware/efi/Makefile | 1 + + drivers/firmware/efi/secureboot.c | 39 +++++++++++++++++++++++++++++++ + include/linux/efi.h | 17 ++++++++------ + 4 files changed, 51 insertions(+), 20 deletions(-) + create mode 100644 drivers/firmware/efi/secureboot.c + +diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c +index 1b2edd07a3e1..41b41f677b1e 100644 +--- a/arch/x86/kernel/setup.c ++++ b/arch/x86/kernel/setup.c +@@ -1154,19 +1154,7 @@ void __init setup_arch(char **cmdline_p) + /* Allocate bigger log buffer */ + setup_log_buf(1); + +- if (efi_enabled(EFI_BOOT)) { +- switch (boot_params.secure_boot) { +- case efi_secureboot_mode_disabled: +- pr_info("Secure boot disabled\n"); +- break; +- case efi_secureboot_mode_enabled: +- pr_info("Secure boot enabled\n"); +- break; +- default: +- pr_info("Secure boot could not be determined\n"); +- break; +- } +- } ++ efi_set_secure_boot(boot_params.secure_boot); + + reserve_initrd(); + +diff --git a/drivers/firmware/efi/Makefile b/drivers/firmware/efi/Makefile +index 8efbcf699e4f..96d5a1ca981d 100644 +--- a/drivers/firmware/efi/Makefile ++++ b/drivers/firmware/efi/Makefile +@@ -25,6 +25,7 @@ subdir-$(CONFIG_EFI_STUB) += libstub + obj-$(CONFIG_EFI_BOOTLOADER_CONTROL) += efibc.o + obj-$(CONFIG_EFI_TEST) += test/ + obj-$(CONFIG_EFI_DEV_PATH_PARSER) += dev-path-parser.o ++obj-$(CONFIG_EFI) += secureboot.o + obj-$(CONFIG_APPLE_PROPERTIES) += apple-properties.o + obj-$(CONFIG_EFI_RCI2_TABLE) += rci2-table.o + obj-$(CONFIG_EFI_EMBEDDED_FIRMWARE) += embedded-firmware.o +diff --git a/drivers/firmware/efi/secureboot.c b/drivers/firmware/efi/secureboot.c +new file mode 100644 +index 000000000000..b6620669e32b +--- /dev/null ++++ b/drivers/firmware/efi/secureboot.c +@@ -0,0 +1,39 @@ ++ ++/* Core kernel secure boot support. ++ * ++ * Copyright (C) 2017 Red Hat, Inc. All Rights Reserved. ++ * Written by David Howells (dhowells@redhat.com) ++ * ++ * This program is free software; you can redistribute it and/or ++ * modify it under the terms of the GNU General Public Licence ++ * as published by the Free Software Foundation; either version ++ * 2 of the Licence, or (at your option) any later version. ++ */ ++ ++#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt ++ ++#include ++#include ++#include ++ ++/* ++ * Decide what to do when UEFI secure boot mode is enabled. ++ */ ++void __init efi_set_secure_boot(enum efi_secureboot_mode mode) ++{ ++ if (efi_enabled(EFI_BOOT)) { ++ switch (mode) { ++ case efi_secureboot_mode_disabled: ++ pr_info("Secure boot disabled\n"); ++ break; ++ case efi_secureboot_mode_enabled: ++ set_bit(EFI_SECURE_BOOT, &efi.flags); ++ pr_info("Secure boot enabled\n"); ++ break; ++ default: ++ pr_warn("Secure boot could not be determined (mode %u)\n", ++ mode); ++ break; ++ } ++ } ++} +diff --git a/include/linux/efi.h b/include/linux/efi.h +index a98cc39e7aaa..1d5f8fa07b4d 100644 +--- a/include/linux/efi.h ++++ b/include/linux/efi.h +@@ -865,6 +865,14 @@ static inline int efi_range_is_wc(unsigned long start, unsigned long len) + #define EFI_MEM_ATTR 9 /* Did firmware publish an EFI_MEMORY_ATTRIBUTES table? */ + #define EFI_MEM_NO_SOFT_RESERVE 10 /* Is the kernel configured to ignore soft reservations? */ + #define EFI_PRESERVE_BS_REGIONS 11 /* Are EFI boot-services memory segments available? */ ++#define EFI_SECURE_BOOT 12 /* Are we in Secure Boot mode? */ ++ ++enum efi_secureboot_mode { ++ efi_secureboot_mode_unset, ++ efi_secureboot_mode_unknown, ++ efi_secureboot_mode_disabled, ++ efi_secureboot_mode_enabled, ++}; + + #ifdef CONFIG_EFI + /* +@@ -889,6 +897,7 @@ static inline bool efi_rt_services_supported(unsigned int mask) + return (efi.runtime_supported_mask & mask) == mask; + } + extern void efi_find_mirror(void); ++extern void __init efi_set_secure_boot(enum efi_secureboot_mode mode); + #else + static inline bool efi_enabled(int feature) + { +@@ -908,6 +917,7 @@ static inline bool efi_rt_services_supported(unsigned int mask) + } + + static inline void efi_find_mirror(void) {} ++static inline void efi_set_secure_boot(enum efi_secureboot_mode mode) {} + #endif + + extern int efi_status_to_err(efi_status_t status); +@@ -1126,13 +1136,6 @@ static inline bool efi_runtime_disabled(void) { return true; } + extern void efi_call_virt_check_flags(unsigned long flags, const void *caller); + extern unsigned long efi_call_virt_save_flags(void); + +-enum efi_secureboot_mode { +- efi_secureboot_mode_unset, +- efi_secureboot_mode_unknown, +- efi_secureboot_mode_disabled, +- efi_secureboot_mode_enabled, +-}; +- + static inline + enum efi_secureboot_mode efi_get_secureboot_mode(efi_get_variable_t *get_var) + { +-- +2.51.0 + diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.18/z0003-efi-add-an-efi_secure_boot-flag-to-indicate-secure-b.patch b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.18/z0003-efi-add-an-efi_secure_boot-flag-to-indicate-secure-b.patch new file mode 100644 index 00000000000..822beab21c1 --- /dev/null +++ b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.18/z0003-efi-add-an-efi_secure_boot-flag-to-indicate-secure-b.patch @@ -0,0 +1,153 @@ +From: David Howells +Date: Mon, 18 Feb 2019 12:45:03 +0000 +Subject: [28/30] efi: Add an EFI_SECURE_BOOT flag to indicate secure boot mode +Origin: https://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs.git/commit?id=a5d70c55c603233c192b375f72116a395909da28 + +UEFI machines can be booted in Secure Boot mode. Add an EFI_SECURE_BOOT +flag that can be passed to efi_enabled() to find out whether secure boot is +enabled. + +Move the switch-statement in x86's setup_arch() that inteprets the +secure_boot boot parameter to generic code and set the bit there. + +Suggested-by: Ard Biesheuvel +Signed-off-by: David Howells +Reviewed-by: Ard Biesheuvel +cc: linux-efi@vger.kernel.org +[rperier: Forward-ported to 5.5: + - Use pr_warn() + - Adjust context] +[bwh: Forward-ported to 5.6: adjust context] +[bwh: Forward-ported to 5.7: + - Use the next available bit in efi.flags + - Adjust context] +--- + arch/x86/kernel/setup.c | 14 +---------- + drivers/firmware/efi/Makefile | 1 + + drivers/firmware/efi/secureboot.c | 39 +++++++++++++++++++++++++++++++ + include/linux/efi.h | 16 ++++++++----- + 4 files changed, 51 insertions(+), 19 deletions(-) + create mode 100644 drivers/firmware/efi/secureboot.c + +--- a/arch/x86/kernel/setup.c ++++ b/arch/x86/kernel/setup.c +@@ -1193,19 +1193,7 @@ void __init setup_arch(char **cmdline_p) + /* Allocate bigger log buffer */ + setup_log_buf(1); + +- if (efi_enabled(EFI_BOOT)) { +- switch (boot_params.secure_boot) { +- case efi_secureboot_mode_disabled: +- pr_info("Secure boot disabled\n"); +- break; +- case efi_secureboot_mode_enabled: +- pr_info("Secure boot enabled\n"); +- break; +- default: +- pr_info("Secure boot could not be determined\n"); +- break; +- } +- } ++ efi_set_secure_boot(boot_params.secure_boot); + + reserve_initrd(); + +--- a/drivers/firmware/efi/Makefile ++++ b/drivers/firmware/efi/Makefile +@@ -25,6 +25,7 @@ obj-$(CONFIG_EFI_FAKE_MEMMAP) += fake_m + obj-$(CONFIG_EFI_BOOTLOADER_CONTROL) += efibc.o + obj-$(CONFIG_EFI_TEST) += test/ + obj-$(CONFIG_EFI_DEV_PATH_PARSER) += dev-path-parser.o ++obj-$(CONFIG_EFI) += secureboot.o + obj-$(CONFIG_APPLE_PROPERTIES) += apple-properties.o + obj-$(CONFIG_EFI_RCI2_TABLE) += rci2-table.o + obj-$(CONFIG_EFI_EMBEDDED_FIRMWARE) += embedded-firmware.o +--- /dev/null ++++ b/drivers/firmware/efi/secureboot.c +@@ -0,0 +1,39 @@ ++ ++/* Core kernel secure boot support. ++ * ++ * Copyright (C) 2017 Red Hat, Inc. All Rights Reserved. ++ * Written by David Howells (dhowells@redhat.com) ++ * ++ * This program is free software; you can redistribute it and/or ++ * modify it under the terms of the GNU General Public Licence ++ * as published by the Free Software Foundation; either version ++ * 2 of the Licence, or (at your option) any later version. ++ */ ++ ++#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt ++ ++#include ++#include ++#include ++ ++/* ++ * Decide what to do when UEFI secure boot mode is enabled. ++ */ ++void __init efi_set_secure_boot(enum efi_secureboot_mode mode) ++{ ++ if (efi_enabled(EFI_BOOT)) { ++ switch (mode) { ++ case efi_secureboot_mode_disabled: ++ pr_info("Secure boot disabled\n"); ++ break; ++ case efi_secureboot_mode_enabled: ++ set_bit(EFI_SECURE_BOOT, &efi.flags); ++ pr_info("Secure boot enabled\n"); ++ break; ++ default: ++ pr_warn("Secure boot could not be determined (mode %u)\n", ++ mode); ++ break; ++ } ++ } ++} +--- a/include/linux/efi.h ++++ b/include/linux/efi.h +@@ -871,6 +871,14 @@ extern int __init efi_setup_pcdp_console + #define EFI_MEM_ATTR 10 /* Did firmware publish an EFI_MEMORY_ATTRIBUTES table? */ + #define EFI_MEM_NO_SOFT_RESERVE 11 /* Is the kernel configured to ignore soft reservations? */ + #define EFI_PRESERVE_BS_REGIONS 12 /* Are EFI boot-services memory segments available? */ ++#define EFI_SECURE_BOOT 13 /* Are we in Secure Boot mode? */ ++ ++enum efi_secureboot_mode { ++ efi_secureboot_mode_unset, ++ efi_secureboot_mode_unknown, ++ efi_secureboot_mode_disabled, ++ efi_secureboot_mode_enabled, ++}; + + #ifdef CONFIG_EFI + /* +@@ -895,6 +903,7 @@ static inline bool efi_rt_services_suppo + return (efi.runtime_supported_mask & mask) == mask; + } + extern void efi_find_mirror(void); ++extern void __init efi_set_secure_boot(enum efi_secureboot_mode mode); + #else + static inline bool efi_enabled(int feature) + { +@@ -914,6 +923,7 @@ static inline bool efi_rt_services_suppo + } + + static inline void efi_find_mirror(void) {} ++static inline void efi_set_secure_boot(enum efi_secureboot_mode mode) {} + #endif + + extern int efi_status_to_err(efi_status_t status); +@@ -1133,13 +1143,6 @@ static inline bool efi_runtime_disabled( + extern void efi_call_virt_check_flags(unsigned long flags, const void *caller); + extern unsigned long efi_call_virt_save_flags(void); + +-enum efi_secureboot_mode { +- efi_secureboot_mode_unset, +- efi_secureboot_mode_unknown, +- efi_secureboot_mode_disabled, +- efi_secureboot_mode_enabled, +-}; +- + static inline + enum efi_secureboot_mode efi_get_secureboot_mode(efi_get_variable_t *get_var) + { diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.18/z0004-efi-Lock-down-the-kernel-if-booted-in-secure-boot-mo.patch b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.18/z0004-efi-Lock-down-the-kernel-if-booted-in-secure-boot-mo.patch new file mode 100644 index 00000000000..6c4e43b4ba0 --- /dev/null +++ b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.18/z0004-efi-Lock-down-the-kernel-if-booted-in-secure-boot-mo.patch @@ -0,0 +1,135 @@ +From 994c5501984e4e6ef2577ba148e9aa4a023570d8 Mon Sep 17 00:00:00 2001 +From: Ben Hutchings +Date: Tue, 10 Sep 2019 11:54:28 +0100 +Subject: [PATCH 4/8] efi: Lock down the kernel if booted in secure boot mode + +Based on an earlier patch by David Howells, who wrote the following +description: + +> UEFI Secure Boot provides a mechanism for ensuring that the firmware will +> only load signed bootloaders and kernels. Certain use cases may also +> require that all kernel modules also be signed. Add a configuration option +> that to lock down the kernel - which includes requiring validly signed +> modules - if the kernel is secure-booted. + +Signed-off-by: Ben Hutchings +[Salvatore Bonaccorso: After fixing https://bugs.debian.org/956197 the +help text for LOCK_DOWN_IN_EFI_SECURE_BOOT was adjusted to mention that +lockdown is triggered in integrity mode (https://bugs.debian.org/1025417)] +Signed-off-by: Salvatore Bonaccorso +--- + arch/x86/kernel/setup.c | 4 ++-- + drivers/firmware/efi/secureboot.c | 5 +++++ + include/linux/security.h | 6 ++++++ + security/lockdown/Kconfig | 15 +++++++++++++++ + security/lockdown/lockdown.c | 2 +- + 5 files changed, 29 insertions(+), 3 deletions(-) + +diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c +index 41b41f677b1e..db2b2c2765b7 100644 +--- a/arch/x86/kernel/setup.c ++++ b/arch/x86/kernel/setup.c +@@ -991,6 +991,8 @@ void __init setup_arch(char **cmdline_p) + if (efi_enabled(EFI_BOOT)) + efi_init(); + ++ efi_set_secure_boot(boot_params.secure_boot); ++ + reserve_ibft_region(); + x86_init.resources.dmi_setup(); + +@@ -1154,8 +1156,6 @@ void __init setup_arch(char **cmdline_p) + /* Allocate bigger log buffer */ + setup_log_buf(1); + +- efi_set_secure_boot(boot_params.secure_boot); +- + reserve_initrd(); + + acpi_table_upgrade(); +diff --git a/drivers/firmware/efi/secureboot.c b/drivers/firmware/efi/secureboot.c +index b6620669e32b..8f2554291fb1 100644 +--- a/drivers/firmware/efi/secureboot.c ++++ b/drivers/firmware/efi/secureboot.c +@@ -15,6 +15,7 @@ + #include + #include + #include ++#include + + /* + * Decide what to do when UEFI secure boot mode is enabled. +@@ -28,6 +29,10 @@ void __init efi_set_secure_boot(enum efi_secureboot_mode mode) + break; + case efi_secureboot_mode_enabled: + set_bit(EFI_SECURE_BOOT, &efi.flags); ++#ifdef CONFIG_LOCK_DOWN_IN_EFI_SECURE_BOOT ++ lock_kernel_down("EFI Secure Boot", ++ LOCKDOWN_INTEGRITY_MAX); ++#endif + pr_info("Secure boot enabled\n"); + break; + default: +diff --git a/include/linux/security.h b/include/linux/security.h +index 521bcb5b9717..d139d8ce8849 100644 +--- a/include/linux/security.h ++++ b/include/linux/security.h +@@ -575,6 +575,7 @@ int security_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen); + int security_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen); + int security_inode_getsecctx(struct inode *inode, struct lsm_context *cp); + int security_locked_down(enum lockdown_reason what); ++int lock_kernel_down(const char *where, enum lockdown_reason level); + int lsm_fill_user_ctx(struct lsm_ctx __user *uctx, u32 *uctx_len, + void *val, size_t val_len, u64 id, u64 flags); + int security_bdev_alloc(struct block_device *bdev); +@@ -1588,6 +1589,11 @@ static inline int security_locked_down(enum lockdown_reason what) + { + return 0; + } ++static inline int ++lock_kernel_down(const char *where, enum lockdown_reason level) ++{ ++ return -EOPNOTSUPP; ++} + static inline int lsm_fill_user_ctx(struct lsm_ctx __user *uctx, + u32 *uctx_len, void *val, size_t val_len, + u64 id, u64 flags) +diff --git a/security/lockdown/Kconfig b/security/lockdown/Kconfig +index e84ddf484010..4175b50b1e6e 100644 +--- a/security/lockdown/Kconfig ++++ b/security/lockdown/Kconfig +@@ -45,3 +45,18 @@ config LOCK_DOWN_KERNEL_FORCE_CONFIDENTIALITY + disabled. + + endchoice ++ ++config LOCK_DOWN_IN_EFI_SECURE_BOOT ++ bool "Lock down the kernel in EFI Secure Boot mode" ++ default n ++ depends on SECURITY_LOCKDOWN_LSM ++ depends on EFI ++ select SECURITY_LOCKDOWN_LSM_EARLY ++ help ++ UEFI Secure Boot provides a mechanism for ensuring that the firmware ++ will only load signed bootloaders and kernels. Secure boot mode may ++ be determined from EFI variables provided by the system firmware if ++ not indicated by the boot parameters. ++ ++ Enabling this option results in kernel lockdown being ++ triggered in integrity mode if EFI Secure Boot is set. +diff --git a/security/lockdown/lockdown.c b/security/lockdown/lockdown.c +index cf83afa1d879..5ff10bd656d2 100644 +--- a/security/lockdown/lockdown.c ++++ b/security/lockdown/lockdown.c +@@ -24,7 +24,7 @@ static const enum lockdown_reason lockdown_levels[] = {LOCKDOWN_NONE, + /* + * Put the kernel into lock-down mode. + */ +-static int lock_kernel_down(const char *where, enum lockdown_reason level) ++int lock_kernel_down(const char *where, enum lockdown_reason level) + { + if (kernel_locked_down >= level) + return -EPERM; +-- +2.51.0 + diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.18/z0004-efi-lock-down-the-kernel-if-booted-in-secure-boot-mo.patch b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.18/z0004-efi-lock-down-the-kernel-if-booted-in-secure-boot-mo.patch new file mode 100644 index 00000000000..6fff3f89675 --- /dev/null +++ b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.18/z0004-efi-lock-down-the-kernel-if-booted-in-secure-boot-mo.patch @@ -0,0 +1,121 @@ +From: Ben Hutchings +Date: Tue, 10 Sep 2019 11:54:28 +0100 +Subject: efi: Lock down the kernel if booted in secure boot mode + +Based on an earlier patch by David Howells, who wrote the following +description: + +> UEFI Secure Boot provides a mechanism for ensuring that the firmware will +> only load signed bootloaders and kernels. Certain use cases may also +> require that all kernel modules also be signed. Add a configuration option +> that to lock down the kernel - which includes requiring validly signed +> modules - if the kernel is secure-booted. + +Signed-off-by: Ben Hutchings +[Salvatore Bonaccorso: After fixing https://bugs.debian.org/956197 the +help text for LOCK_DOWN_IN_EFI_SECURE_BOOT was adjusted to mention that +lockdown is triggered in integrity mode (https://bugs.debian.org/1025417)] +Signed-off-by: Salvatore Bonaccorso +--- + arch/x86/kernel/setup.c | 4 ++-- + drivers/firmware/efi/secureboot.c | 3 +++ + include/linux/security.h | 6 ++++++ + security/lockdown/Kconfig | 15 +++++++++++++++ + security/lockdown/lockdown.c | 2 +- + 5 files changed, 27 insertions(+), 3 deletions(-) + +--- a/arch/x86/kernel/setup.c ++++ b/arch/x86/kernel/setup.c +@@ -904,6 +904,8 @@ void __init setup_arch(char **cmdline_p) + if (efi_enabled(EFI_BOOT)) + efi_init(); + ++ efi_set_secure_boot(boot_params.secure_boot); ++ + reserve_ibft_region(); + x86_init.resources.dmi_setup(); + +@@ -1070,8 +1072,6 @@ void __init setup_arch(char **cmdline_p) + /* Allocate bigger log buffer */ + setup_log_buf(1); + +- efi_set_secure_boot(boot_params.secure_boot); +- + reserve_initrd(); + + acpi_table_upgrade(); +--- a/drivers/firmware/efi/secureboot.c ++++ b/drivers/firmware/efi/secureboot.c +@@ -15,6 +15,7 @@ + #include + #include + #include ++#include + + /* + * Decide what to do when UEFI secure boot mode is enabled. +@@ -28,6 +29,10 @@ void __init efi_set_secure_boot(enum efi + break; + case efi_secureboot_mode_enabled: + set_bit(EFI_SECURE_BOOT, &efi.flags); ++#ifdef CONFIG_LOCK_DOWN_IN_EFI_SECURE_BOOT ++ lock_kernel_down("EFI Secure Boot", ++ LOCKDOWN_INTEGRITY_MAX); ++#endif + pr_info("Secure boot enabled\n"); + break; + default: +--- a/include/linux/security.h ++++ b/include/linux/security.h +@@ -522,6 +522,7 @@ int security_inode_notifysecctx(struct i + int security_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen); + int security_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen); + int security_locked_down(enum lockdown_reason what); ++int lock_kernel_down(const char *where, enum lockdown_reason level); + int lsm_fill_user_ctx(struct lsm_ctx __user *uctx, u32 *uctx_len, + void *val, size_t val_len, u64 id, u64 flags); + int security_bdev_alloc(struct block_device *bdev); +@@ -1504,6 +1505,11 @@ static inline int security_locked_down(e + { + return 0; + } ++static inline int ++lock_kernel_down(const char *where, enum lockdown_reason level) ++{ ++ return -EOPNOTSUPP; ++} + static inline int lsm_fill_user_ctx(struct lsm_ctx __user *uctx, + u32 *uctx_len, void *val, size_t val_len, + u64 id, u64 flags) +--- a/security/lockdown/Kconfig ++++ b/security/lockdown/Kconfig +@@ -45,3 +45,18 @@ config LOCK_DOWN_KERNEL_FORCE_CONFIDENTI + disabled. + + endchoice ++ ++config LOCK_DOWN_IN_EFI_SECURE_BOOT ++ bool "Lock down the kernel in EFI Secure Boot mode" ++ default n ++ depends on SECURITY_LOCKDOWN_LSM ++ depends on EFI ++ select SECURITY_LOCKDOWN_LSM_EARLY ++ help ++ UEFI Secure Boot provides a mechanism for ensuring that the firmware ++ will only load signed bootloaders and kernels. Secure boot mode may ++ be determined from EFI variables provided by the system firmware if ++ not indicated by the boot parameters. ++ ++ Enabling this option results in kernel lockdown being ++ triggered in integrity mode if EFI Secure Boot is set. +--- a/security/lockdown/lockdown.c ++++ b/security/lockdown/lockdown.c +@@ -24,7 +24,7 @@ static const enum lockdown_reason lockdo + /* + * Put the kernel into lock-down mode. + */ +-static int lock_kernel_down(const char *where, enum lockdown_reason level) ++int lock_kernel_down(const char *where, enum lockdown_reason level) + { + if (kernel_locked_down >= level) + return -EPERM; diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.18/z0005-mtd-disable-slram-and-phram-when-locked-do.patch b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.18/z0005-mtd-disable-slram-and-phram-when-locked-do.patch new file mode 100644 index 00000000000..c718e7e2f02 --- /dev/null +++ b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.18/z0005-mtd-disable-slram-and-phram-when-locked-do.patch @@ -0,0 +1,75 @@ +From: Ben Hutchings +Date: Fri, 30 Aug 2019 15:54:24 +0100 +Subject: mtd: phram,slram: Disable when the kernel is locked down +Forwarded: https://lore.kernel.org/linux-security-module/20190830154720.eekfjt6c4jzvlbfz@decadent.org.uk/ + +These drivers allow mapping arbitrary memory ranges as MTD devices. +This should be disabled to preserve the kernel's integrity when it is +locked down. + +* Add the HWPARAM flag to the module parameters +* When slram is built-in, it uses __setup() to read kernel parameters, + so add an explicit check security_locked_down() check + +Signed-off-by: Ben Hutchings +Cc: Matthew Garrett +Cc: David Howells +Cc: Joern Engel +Cc: linux-mtd@lists.infradead.org +--- + drivers/mtd/devices/phram.c | 6 +++++- + drivers/mtd/devices/slram.c | 9 ++++++++- + 2 files changed, 13 insertions(+), 2 deletions(-) + +--- a/drivers/mtd/devices/phram.c ++++ b/drivers/mtd/devices/phram.c +@@ -364,7 +364,11 @@ static int phram_param_call(const char * + #endif + } + +-module_param_call(phram, phram_param_call, NULL, NULL, 0200); ++static const struct kernel_param_ops phram_param_ops = { ++ .set = phram_param_call ++}; ++__module_param_call(MODULE_PARAM_PREFIX, phram, &phram_param_ops, NULL, ++ 0200, -1, KERNEL_PARAM_FL_HWPARAM | hwparam_iomem); + MODULE_PARM_DESC(phram, "Memory region to map. \"phram=,,[,]\""); + + #ifdef CONFIG_OF +--- a/drivers/mtd/devices/slram.c ++++ b/drivers/mtd/devices/slram.c +@@ -43,6 +43,7 @@ + #include + #include + #include ++#include + + #include + +@@ -65,7 +66,7 @@ typedef struct slram_mtd_list { + #ifdef MODULE + static char *map[SLRAM_MAX_DEVICES_PARAMS]; + +-module_param_array(map, charp, NULL, 0); ++module_param_hw_array(map, charp, iomem, NULL, 0); + MODULE_PARM_DESC(map, "List of memory regions to map. \"map=, , \""); + #else + static char *map; +@@ -281,11 +282,17 @@ static int __init init_slram(void) + #ifndef MODULE + char *devstart; + char *devlength; ++ int ret; + + if (!map) { + E("slram: not enough parameters.\n"); + return(-EINVAL); + } ++ ++ ret = security_locked_down(LOCKDOWN_MODULE_PARAMETERS); ++ if (ret) ++ return ret; ++ + while (map) { + devname = devstart = devlength = NULL; + diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.18/z0005-mtd-phram-slram-Disable-when-the-kernel-is-locked-do.patch b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.18/z0005-mtd-phram-slram-Disable-when-the-kernel-is-locked-do.patch new file mode 100644 index 00000000000..6b62bcb57d8 --- /dev/null +++ b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.18/z0005-mtd-phram-slram-Disable-when-the-kernel-is-locked-do.patch @@ -0,0 +1,82 @@ +From 06ae62500c1e2bb641b8f16eb9313a41c4061ab9 Mon Sep 17 00:00:00 2001 +From: Ben Hutchings +Date: Fri, 30 Aug 2019 15:54:24 +0100 +Subject: [PATCH 5/8] mtd: phram,slram: Disable when the kernel is locked down + +These drivers allow mapping arbitrary memory ranges as MTD devices. +This should be disabled to preserve the kernel's integrity when it is +locked down. + +* Add the HWPARAM flag to the module parameters +* When slram is built-in, it uses __setup() to read kernel parameters, + so add an explicit check security_locked_down() check + +Signed-off-by: Ben Hutchings +Cc: Matthew Garrett +Cc: David Howells +Cc: Joern Engel +Cc: linux-mtd@lists.infradead.org +--- + drivers/mtd/devices/phram.c | 6 +++++- + drivers/mtd/devices/slram.c | 9 ++++++++- + 2 files changed, 13 insertions(+), 2 deletions(-) + +diff --git a/drivers/mtd/devices/phram.c b/drivers/mtd/devices/phram.c +index fd9ec165e61a..8652139ecbe9 100644 +--- a/drivers/mtd/devices/phram.c ++++ b/drivers/mtd/devices/phram.c +@@ -365,7 +365,11 @@ static int phram_param_call(const char *val, const struct kernel_param *kp) + #endif + } + +-module_param_call(phram, phram_param_call, NULL, NULL, 0200); ++static const struct kernel_param_ops phram_param_ops = { ++ .set = phram_param_call ++}; ++__module_param_call(MODULE_PARAM_PREFIX, phram, &phram_param_ops, NULL, ++ 0200, -1, KERNEL_PARAM_FL_HWPARAM | hwparam_iomem); + MODULE_PARM_DESC(phram, "Memory region to map. \"phram=,,[,]\""); + + #ifdef CONFIG_OF +diff --git a/drivers/mtd/devices/slram.c b/drivers/mtd/devices/slram.c +index 8297b366a066..9f762d988c0b 100644 +--- a/drivers/mtd/devices/slram.c ++++ b/drivers/mtd/devices/slram.c +@@ -43,6 +43,7 @@ + #include + #include + #include ++#include + + #include + +@@ -65,7 +66,7 @@ typedef struct slram_mtd_list { + #ifdef MODULE + static char *map[SLRAM_MAX_DEVICES_PARAMS]; + +-module_param_array(map, charp, NULL, 0); ++module_param_hw_array(map, charp, iomem, NULL, 0); + MODULE_PARM_DESC(map, "List of memory regions to map. \"map=, , \""); + #else + static char *map; +@@ -281,11 +282,17 @@ static int __init init_slram(void) + #ifndef MODULE + char *devstart; + char *devlength; ++ int ret; + + if (!map) { + E("slram: not enough parameters.\n"); + return(-EINVAL); + } ++ ++ ret = security_locked_down(LOCKDOWN_MODULE_PARAMETERS); ++ if (ret) ++ return ret; ++ + while (map) { + devname = devstart = devlength = NULL; + +-- +2.51.0 + diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.18/z0006-arm64-add-kernel-config-option-to-lock-down-when-in-.patch b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.18/z0006-arm64-add-kernel-config-option-to-lock-down-when-in-.patch new file mode 100644 index 00000000000..62be9cbd0d5 --- /dev/null +++ b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.18/z0006-arm64-add-kernel-config-option-to-lock-down-when-in-.patch @@ -0,0 +1,164 @@ +From ddb2f010a8a881d181bce3b8961ad92117f4e8bb Mon Sep 17 00:00:00 2001 +From: Linn Crosetto +Date: Tue, 30 Aug 2016 11:54:38 -0600 +Subject: [PATCH 6/8] arm64: add kernel config option to lock down when in + Secure Boot mode + +Add a kernel configuration option to lock down the kernel, to restrict +userspace's ability to modify the running kernel when UEFI Secure Boot is +enabled. Based on the x86 patch by Matthew Garrett. + +Determine the state of Secure Boot in the EFI stub and pass this to the +kernel using the FDT. + +Signed-off-by: Linn Crosetto +[bwh: Forward-ported to 4.10: adjust context] +[Lukas Wunner: Forward-ported to 4.11: drop parts applied upstream] +[bwh: Forward-ported to 4.15 and lockdown patch set: + - Pass result of efi_get_secureboot() in stub through to + efi_set_secure_boot() in main kernel + - Use lockdown API and naming] +[bwh: Forward-ported to 4.19.3: adjust context in update_fdt()] +[dannf: Moved init_lockdown() call after uefi_init(), fixing SB detection] +[bwh: Drop call to init_lockdown(), as efi_set_secure_boot() now calls this] +[bwh: Forward-ported to 5.6: efi_get_secureboot() no longer takes a + sys_table parameter] +[bwh: Forward-ported to 5.7: EFI initialisation from FDT was rewritten, so: + - Add Secure Boot mode to the parameter enumeration in fdtparams.c + - Add a parameter to efi_get_fdt_params() to return the Secure Boot mode + - Since Xen does not have a property name defined for Secure Boot mode, + change efi_get_fdt_prop() to handle a missing property name by clearing + the output variable] +[Salvatore Bonaccorso: Forward-ported to 5.10: f30f242fb131 ("efi: Rename +arm-init to efi-init common for all arch") renamed arm-init.c to efi-init.c] +--- + drivers/firmware/efi/efi-init.c | 5 ++++- + drivers/firmware/efi/fdtparams.c | 12 +++++++++++- + drivers/firmware/efi/libstub/fdt.c | 6 ++++++ + include/linux/efi.h | 3 ++- + 4 files changed, 23 insertions(+), 3 deletions(-) + +diff --git a/drivers/firmware/efi/efi-init.c b/drivers/firmware/efi/efi-init.c +index a00e07b853f2..8a0390d8da98 100644 +--- a/drivers/firmware/efi/efi-init.c ++++ b/drivers/firmware/efi/efi-init.c +@@ -213,9 +213,10 @@ void __init efi_init(void) + { + struct efi_memory_map_data data; + u64 efi_system_table; ++ u32 secure_boot; + + /* Grab UEFI information placed in FDT by stub */ +- efi_system_table = efi_get_fdt_params(&data); ++ efi_system_table = efi_get_fdt_params(&data, &secure_boot); + if (!efi_system_table) + return; + +@@ -237,6 +238,8 @@ void __init efi_init(void) + return; + } + ++ efi_set_secure_boot(secure_boot); ++ + reserve_regions(); + /* + * For memblock manipulation, the cap should come after the memblock_add(). +diff --git a/drivers/firmware/efi/fdtparams.c b/drivers/firmware/efi/fdtparams.c +index b815d2a754ee..69a2eb539d38 100644 +--- a/drivers/firmware/efi/fdtparams.c ++++ b/drivers/firmware/efi/fdtparams.c +@@ -16,6 +16,7 @@ enum { + MMSIZE, + DCSIZE, + DCVERS, ++ SBMODE, + + PARAMCOUNT + }; +@@ -26,6 +27,7 @@ static __initconst const char name[][22] = { + [MMSIZE] = "MemMap Size ", + [DCSIZE] = "MemMap Desc. Size ", + [DCVERS] = "MemMap Desc. Version ", ++ [SBMODE] = "Secure Boot Enabled ", + }; + + static __initconst const struct { +@@ -43,6 +45,7 @@ static __initconst const struct { + [MMSIZE] = "xen,uefi-mmap-size", + [DCSIZE] = "xen,uefi-mmap-desc-size", + [DCVERS] = "xen,uefi-mmap-desc-ver", ++ [SBMODE] = "", + } + }, { + #endif +@@ -53,6 +56,7 @@ static __initconst const struct { + [MMSIZE] = "linux,uefi-mmap-size", + [DCSIZE] = "linux,uefi-mmap-desc-size", + [DCVERS] = "linux,uefi-mmap-desc-ver", ++ [SBMODE] = "linux,uefi-secure-boot", + } + } + }; +@@ -64,6 +68,11 @@ static int __init efi_get_fdt_prop(const void *fdt, int node, const char *pname, + int len; + u64 val; + ++ if (!pname[0]) { ++ memset(var, 0, size); ++ return 0; ++ } ++ + prop = fdt_getprop(fdt, node, pname, &len); + if (!prop) + return 1; +@@ -81,7 +90,7 @@ static int __init efi_get_fdt_prop(const void *fdt, int node, const char *pname, + return 0; + } + +-u64 __init efi_get_fdt_params(struct efi_memory_map_data *mm) ++u64 __init efi_get_fdt_params(struct efi_memory_map_data *mm, u32 *secure_boot) + { + const void *fdt = initial_boot_params; + unsigned long systab; +@@ -95,6 +104,7 @@ u64 __init efi_get_fdt_params(struct efi_memory_map_data *mm) + [MMSIZE] = { &mm->size, sizeof(mm->size) }, + [DCSIZE] = { &mm->desc_size, sizeof(mm->desc_size) }, + [DCVERS] = { &mm->desc_version, sizeof(mm->desc_version) }, ++ [SBMODE] = { secure_boot, sizeof(*secure_boot) }, + }; + + BUILD_BUG_ON(ARRAY_SIZE(target) != ARRAY_SIZE(name)); +diff --git a/drivers/firmware/efi/libstub/fdt.c b/drivers/firmware/efi/libstub/fdt.c +index 6a337f1f8787..6c679da644dd 100644 +--- a/drivers/firmware/efi/libstub/fdt.c ++++ b/drivers/firmware/efi/libstub/fdt.c +@@ -132,6 +132,12 @@ static efi_status_t update_fdt(void *orig_fdt, unsigned long orig_fdt_size, + } + } + ++ fdt_val32 = cpu_to_fdt32(efi_get_secureboot()); ++ status = fdt_setprop(fdt, node, "linux,uefi-secure-boot", ++ &fdt_val32, sizeof(fdt_val32)); ++ if (status) ++ goto fdt_set_fail; ++ + /* Shrink the FDT back to its minimum size: */ + fdt_pack(fdt); + +diff --git a/include/linux/efi.h b/include/linux/efi.h +index 1d5f8fa07b4d..6e826b53a0ce 100644 +--- a/include/linux/efi.h ++++ b/include/linux/efi.h +@@ -755,7 +755,8 @@ extern int efi_mem_desc_lookup(u64 phys_addr, efi_memory_desc_t *out_md); + extern int __efi_mem_desc_lookup(u64 phys_addr, efi_memory_desc_t *out_md); + extern void efi_mem_reserve(phys_addr_t addr, u64 size); + extern int efi_mem_reserve_persistent(phys_addr_t addr, u64 size); +-extern u64 efi_get_fdt_params(struct efi_memory_map_data *data); ++extern u64 efi_get_fdt_params(struct efi_memory_map_data *data, ++ u32 *secure_boot); + extern struct kobject *efi_kobj; + + extern int efi_reboot_quirk_mode; +-- +2.51.0 + diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.18/z0007-tools-hv-fix-cross-compilation-for-ARM64.patch b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.18/z0007-tools-hv-fix-cross-compilation-for-ARM64.patch new file mode 100644 index 00000000000..eed99bf2f49 --- /dev/null +++ b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.18/z0007-tools-hv-fix-cross-compilation-for-ARM64.patch @@ -0,0 +1,35 @@ +From 52fe3ead528c899b7db29870c97d25cec0671625 Mon Sep 17 00:00:00 2001 +From: Adrian Vladu +Date: Thu, 19 Sep 2024 07:59:59 +0000 +Subject: [PATCH 7/8] tools: hv: fix cross-compilation for ARM64 + +--- + tools/hv/Makefile | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/tools/hv/Makefile b/tools/hv/Makefile +index 34ffcec264ab..7a7ece3cdf03 100644 +--- a/tools/hv/Makefile ++++ b/tools/hv/Makefile +@@ -2,7 +2,9 @@ + # Makefile for Hyper-V tools + include ../scripts/Makefile.include + ++ifeq ($(ARCH),) + ARCH := $(shell uname -m 2>/dev/null) ++endif + sbindir ?= /usr/sbin + libexecdir ?= /usr/libexec + sharedstatedir ?= /var/lib +@@ -20,7 +22,7 @@ override CFLAGS += -O2 -Wall -g -D_GNU_SOURCE -I$(OUTPUT)include + override CFLAGS += -Wno-address-of-packed-member + + ALL_TARGETS := hv_kvp_daemon hv_vss_daemon +-ifneq ($(ARCH), aarch64) ++ifeq ($(filter $(ARCH),aarch64 arm64),) + ALL_TARGETS += hv_fcopy_uio_daemon + endif + ALL_PROGRAMS := $(patsubst %,$(OUTPUT)%,$(ALL_TARGETS)) +-- +2.51.0 + From 31addffc27ce9cb76e1efda728d955617ae77f13 Mon Sep 17 00:00:00 2001 From: Sayan Chowdhury Date: Thu, 18 Jun 2026 13:47:28 +0530 Subject: [PATCH 4/8] x11-drivers/old-nvidia-drivers: Adjust the patches for 550 for Linux 6.18 Signed-off-by: Sayan Chowdhury --- .../coreos-modules/files/commonconfig-6.18 | 1 + ...reset-to-avoid-GPL-only-vma_start_wr.patch | 155 ++++++++++ ...63.01-pass-drm_format_info-to-nv_drm.patch | 280 ++++++++++++++++++ ...dia-use-hrtimer_setup-for-Linux-6.15.patch | 44 +++ ...-iommu_dev_enable_disable_feature-fo.patch | 91 ++++++ ...d-SMMU-WAR-code-with-UVM_ATS_SMMU_WA.patch | 121 ++++++++ .../old-nvidia-drivers-550.163.01-r2.ebuild | 31 +- 7 files changed, 722 insertions(+), 1 deletion(-) create mode 100644 sdk_container/src/third_party/coreos-overlay/x11-drivers/old-nvidia-drivers/files/0001-mm-use-vm_flags_reset-to-avoid-GPL-only-vma_start_wr.patch create mode 100644 sdk_container/src/third_party/coreos-overlay/x11-drivers/old-nvidia-drivers/files/0002-nvidia-drm-550.163.01-pass-drm_format_info-to-nv_drm.patch create mode 100644 sdk_container/src/third_party/coreos-overlay/x11-drivers/old-nvidia-drivers/files/0003-nvidia-use-hrtimer_setup-for-Linux-6.15.patch create mode 100644 sdk_container/src/third_party/coreos-overlay/x11-drivers/old-nvidia-drivers/files/0004-nvidia-uvm-guard-iommu_dev_enable_disable_feature-fo.patch create mode 100644 sdk_container/src/third_party/coreos-overlay/x11-drivers/old-nvidia-drivers/files/0005-nvidia-uvm-guard-SMMU-WAR-code-with-UVM_ATS_SMMU_WA.patch diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/files/commonconfig-6.18 b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/files/commonconfig-6.18 index 392c12665d2..7a618b68be7 100644 --- a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/files/commonconfig-6.18 +++ b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/files/commonconfig-6.18 @@ -127,6 +127,7 @@ CONFIG_CPU_FREQ_GOV_USERSPACE=m CONFIG_CPU_FREQ_STAT=y # CONFIG_CROSS_MEMORY_ATTACH is not set CONFIG_CRYPTO_AES=m +CONFIG_CRYPTO_CRC32C=y CONFIG_CRYPTO_CTR=m CONFIG_CRYPTO_CTS=m CONFIG_CRYPTO_DES=m diff --git a/sdk_container/src/third_party/coreos-overlay/x11-drivers/old-nvidia-drivers/files/0001-mm-use-vm_flags_reset-to-avoid-GPL-only-vma_start_wr.patch b/sdk_container/src/third_party/coreos-overlay/x11-drivers/old-nvidia-drivers/files/0001-mm-use-vm_flags_reset-to-avoid-GPL-only-vma_start_wr.patch new file mode 100644 index 00000000000..32c494fc3e3 --- /dev/null +++ b/sdk_container/src/third_party/coreos-overlay/x11-drivers/old-nvidia-drivers/files/0001-mm-use-vm_flags_reset-to-avoid-GPL-only-vma_start_wr.patch @@ -0,0 +1,155 @@ +From d1154945f8b2d22392d30a5e522612dfbcf17cff Mon Sep 17 00:00:00 2001 +From: Sayan Chowdhury +Date: Wed, 17 Jun 2026 15:48:55 +0530 +Subject: [PATCH 1/2] mm: use vm_flags_reset to avoid GPL-only + vma_start_write() + +Linux 6.15 made vma_start_write() GPL-only, which nv_vm_flags_set/clear +depend on via vm_flags_set/vm_flags_clear. Redefine them using +vm_flags_reset which carries no such restriction. + +Applied to both the proprietary kernel/ and open-source kernel-open/ trees. + +Signed-off-by: Sayan Chowdhury +--- + kernel-open/nvidia-drm/nvidia-drm-gem-user-memory.c | 7 +++++++ + kernel-open/nvidia-drm/nvidia-drm-gem.c | 7 +++++++ + kernel-open/nvidia/nv-mmap.c | 7 +++++++ + kernel/nvidia-drm/nvidia-drm-gem-user-memory.c | 7 +++++++ + kernel/nvidia-drm/nvidia-drm-gem.c | 7 +++++++ + kernel/nvidia/nv-mmap.c | 7 +++++++ + 6 files changed, 42 insertions(+) + +diff --git a/kernel-module-source/kernel-open/nvidia-drm/nvidia-drm-gem-user-memory.c b/kernel-module-source/kernel-open/nvidia-drm/nvidia-drm-gem-user-memory.c +index 9d2a0512..e473b66f 100644 +--- a/kernel-module-source/kernel-open/nvidia-drm/nvidia-drm-gem-user-memory.c ++++ b/kernel-module-source/kernel-open/nvidia-drm/nvidia-drm-gem-user-memory.c +@@ -40,6 +40,13 @@ + #include + #endif + ++#include ++ ++#if LINUX_VERSION_CODE >= KERNEL_VERSION(6, 15, 0) ++#define nv_vm_flags_set(vma, f) vm_flags_reset((vma), (vma)->vm_flags | (f)) ++#define nv_vm_flags_clear(vma, f) vm_flags_reset((vma), (vma)->vm_flags & ~(f)) ++#endif ++ + static inline + void __nv_drm_gem_user_memory_free(struct nv_drm_gem_object *nv_gem) + { +diff --git a/kernel-module-source/kernel-open/nvidia-drm/nvidia-drm-gem.c b/kernel-module-source/kernel-open/nvidia-drm/nvidia-drm-gem.c +index ef0e0f83..c8489a72 100644 +--- a/kernel-module-source/kernel-open/nvidia-drm/nvidia-drm-gem.c ++++ b/kernel-module-source/kernel-open/nvidia-drm/nvidia-drm-gem.c +@@ -51,6 +51,13 @@ + + #include "nv-mm.h" + ++#include ++ ++#if LINUX_VERSION_CODE >= KERNEL_VERSION(6, 15, 0) ++#define nv_vm_flags_set(vma, f) vm_flags_reset((vma), (vma)->vm_flags | (f)) ++#define nv_vm_flags_clear(vma, f) vm_flags_reset((vma), (vma)->vm_flags & ~(f)) ++#endif ++ + void nv_drm_gem_free(struct drm_gem_object *gem) + { + struct nv_drm_gem_object *nv_gem = to_nv_gem_object(gem); +diff --git a/kernel-module-source/kernel-open/nvidia/nv-mmap.c b/kernel-module-source/kernel-open/nvidia/nv-mmap.c +index 8e98c817..f72731c0 100644 +--- a/kernel-module-source/kernel-open/nvidia/nv-mmap.c ++++ b/kernel-module-source/kernel-open/nvidia/nv-mmap.c +@@ -25,6 +25,13 @@ + + #include "os-interface.h" + #include "nv-linux.h" ++ ++#include ++ ++#if LINUX_VERSION_CODE >= KERNEL_VERSION(6, 15, 0) ++#define nv_vm_flags_set(vma, f) vm_flags_reset((vma), (vma)->vm_flags | (f)) ++#define nv_vm_flags_clear(vma, f) vm_flags_reset((vma), (vma)->vm_flags & ~(f)) ++#endif + #include "nv_speculation_barrier.h" + + /* +diff --git a/kernel-module-source/kernel-open/nvidia-uvm/uvm.c b/kernel-module-source/kernel-open/nvidia-uvm/uvm.c +index 1a2b3c4d..5e6f7a8b 100644 +--- a/kernel-module-source/kernel-open/nvidia-uvm/uvm.c ++++ b/kernel-module-source/kernel-open/nvidia-uvm/uvm.c +@@ -21,6 +21,8 @@ + + *******************************************************************************/ + ++#include ++ + #include "uvm_api.h" + #include "uvm_global.h" + #include "uvm_gpu_replayable_faults.h" +@@ -40,4 +42,9 @@ + + #define NVIDIA_UVM_DEVICE_NAME "nvidia-uvm" + ++#if LINUX_VERSION_CODE >= KERNEL_VERSION(6, 15, 0) ++#define nv_vm_flags_set(v, f) vm_flags_reset((v), (v)->vm_flags | (f)) ++#define nv_vm_flags_clear(v, f) vm_flags_reset((v), (v)->vm_flags & ~(f)) ++#endif ++ + static dev_t g_uvm_base_dev; +diff --git a/kernel/nvidia-drm/nvidia-drm-gem-user-memory.c b/kernel/nvidia-drm/nvidia-drm-gem-user-memory.c +index 9d2a0512..e473b66f 100644 +--- a/kernel/nvidia-drm/nvidia-drm-gem-user-memory.c ++++ b/kernel/nvidia-drm/nvidia-drm-gem-user-memory.c +@@ -40,6 +40,13 @@ + #include + #endif + ++#include ++ ++#if LINUX_VERSION_CODE >= KERNEL_VERSION(6, 15, 0) ++#define nv_vm_flags_set(vma, f) vm_flags_reset((vma), (vma)->vm_flags | (f)) ++#define nv_vm_flags_clear(vma, f) vm_flags_reset((vma), (vma)->vm_flags & ~(f)) ++#endif ++ + static inline + void __nv_drm_gem_user_memory_free(struct nv_drm_gem_object *nv_gem) + { +diff --git a/kernel/nvidia-drm/nvidia-drm-gem.c b/kernel/nvidia-drm/nvidia-drm-gem.c +index ef0e0f83..c8489a72 100644 +--- a/kernel/nvidia-drm/nvidia-drm-gem.c ++++ b/kernel/nvidia-drm/nvidia-drm-gem.c +@@ -51,6 +51,13 @@ + + #include "nv-mm.h" + ++#include ++ ++#if LINUX_VERSION_CODE >= KERNEL_VERSION(6, 15, 0) ++#define nv_vm_flags_set(vma, f) vm_flags_reset((vma), (vma)->vm_flags | (f)) ++#define nv_vm_flags_clear(vma, f) vm_flags_reset((vma), (vma)->vm_flags & ~(f)) ++#endif ++ + void nv_drm_gem_free(struct drm_gem_object *gem) + { + struct nv_drm_gem_object *nv_gem = to_nv_gem_object(gem); +diff --git a/kernel/nvidia/nv-mmap.c b/kernel/nvidia/nv-mmap.c +index 8e98c817..f72731c0 100644 +--- a/kernel/nvidia/nv-mmap.c ++++ b/kernel/nvidia/nv-mmap.c +@@ -25,6 +25,13 @@ + + #include "os-interface.h" + #include "nv-linux.h" ++ ++#include ++ ++#if LINUX_VERSION_CODE >= KERNEL_VERSION(6, 15, 0) ++#define nv_vm_flags_set(vma, f) vm_flags_reset((vma), (vma)->vm_flags | (f)) ++#define nv_vm_flags_clear(vma, f) vm_flags_reset((vma), (vma)->vm_flags & ~(f)) ++#endif + #include "nv_speculation_barrier.h" + + /* +-- +2.53.0 diff --git a/sdk_container/src/third_party/coreos-overlay/x11-drivers/old-nvidia-drivers/files/0002-nvidia-drm-550.163.01-pass-drm_format_info-to-nv_drm.patch b/sdk_container/src/third_party/coreos-overlay/x11-drivers/old-nvidia-drivers/files/0002-nvidia-drm-550.163.01-pass-drm_format_info-to-nv_drm.patch new file mode 100644 index 00000000000..34aa1d59103 --- /dev/null +++ b/sdk_container/src/third_party/coreos-overlay/x11-drivers/old-nvidia-drivers/files/0002-nvidia-drm-550.163.01-pass-drm_format_info-to-nv_drm.patch @@ -0,0 +1,280 @@ +From 828e2d5aa8808f34030a726fb5f1038ea474add7 Mon Sep 17 00:00:00 2001 +From: Sayan Chowdhury +Date: Wed, 17 Jun 2026 16:45:03 +0530 +Subject: [PATCH 2/2] nvidia-drm 550.163.01: pass drm_format_info to + nv_drm_framebuffer_create for Linux 6.17+ + +Linux kernel commit 81112eaac559 ("drm: Pass the format info to +.fb_create()") changed drm_mode_config_funcs.fb_create to take a 4th +argument: const struct drm_format_info *info + +This landed in v6.17-rc1; we hit it while updating our build target +to Linux 6.18, which carries the same API forward. + +Simultaneously, drm_helper_mode_fill_fb_struct() gained the same +parameter between the framebuffer and the mode_cmd arguments (4 args +total with dev). + +Use a conftest probe (NV_DRM_FB_CREATE_TAKES_FORMAT_INFO) rather than +a hardcoded LINUX_VERSION_CODE check, since this detects the feature +directly against the actual kernel headers and remains correct for +backports or non-standard kernel versioning. + +Applied to both the proprietary kernel/ and open-source kernel-open/ trees. + +Signed-off-by: Sayan Chowdhury +--- + kernel-open/conftest.sh | 19 +++++++++++++++++++ + kernel-open/nvidia-drm/nvidia-drm-drv.c | 6 ++++++ + kernel-open/nvidia-drm/nvidia-drm-fb.c | 7 +++++++ + kernel-open/nvidia-drm/nvidia-drm-fb.h | 4 ++++ + kernel-open/nvidia-drm/nvidia-drm-sources.mk | 1 + + kernel/conftest.sh | 19 +++++++++++++++++++ + kernel/nvidia-drm/nvidia-drm-drv.c | 6 ++++++ + kernel/nvidia-drm/nvidia-drm-fb.c | 7 +++++++ + kernel/nvidia-drm/nvidia-drm-fb.h | 4 ++++ + kernel/nvidia-drm/nvidia-drm-sources.mk | 1 + + 10 files changed, 74 insertions(+) + +diff --git a/kernel-module-source/kernel-open/conftest.sh b/kernel-module-source/kernel-open/conftest.sh +index 889cf654..30506f8f 100755 +--- a/kernel-module-source/kernel-open/conftest.sh ++++ b/kernel-module-source/kernel-open/conftest.sh +@@ -4511,6 +4511,25 @@ compile_test() { + compile_check_conftest "$CODE" "NV_DRM_ROTATION_AVAILABLE" "" "functions" + ;; + ++ drm_fb_create_takes_format_info) ++ # ++ # Determine if a `struct drm_format_info *` is passed into ++ # the .fb_create callback (4-arg form). Added by commit ++ # 81112eaac559 ("drm: Pass the format info to .fb_create") ++ # in linux-next (2025-07-16). ++ # ++ CODE=" ++ #include ++ #include ++ ++ static const struct drm_mode_config_funcs funcs; ++ void conftest_drm_fb_create_takes_format_info(void) { ++ funcs.fb_create(NULL, NULL, NULL, NULL); ++ }" ++ ++ compile_check_conftest "$CODE" "NV_DRM_FB_CREATE_TAKES_FORMAT_INFO" "" "types" ++ ;; ++ + drm_driver_prime_flag_present) + # + # Determine whether driver feature flag DRIVER_PRIME is present. +diff --git a/kernel-module-source/kernel-open/nvidia-drm/nvidia-drm-drv.c b/kernel-module-source/kernel-open/nvidia-drm/nvidia-drm-drv.c +index da2b7010..12fe50ef 100644 +--- a/kernel-module-source/kernel-open/nvidia-drm/nvidia-drm-drv.c ++++ b/kernel-module-source/kernel-open/nvidia-drm/nvidia-drm-drv.c +@@ -186,6 +186,9 @@ static void nv_drm_output_poll_changed(struct drm_device *dev) + static struct drm_framebuffer *nv_drm_framebuffer_create( + struct drm_device *dev, + struct drm_file *file, ++#if defined(NV_DRM_FB_CREATE_TAKES_FORMAT_INFO) ++ const struct drm_format_info *info, ++#endif + #if defined(NV_DRM_HELPER_MODE_FILL_FB_STRUCT_HAS_CONST_MODE_CMD_ARG) + const struct drm_mode_fb_cmd2 *cmd + #else +@@ -201,6 +204,9 @@ static struct drm_framebuffer *nv_drm_framebuffer_create( + fb = nv_drm_internal_framebuffer_create( + dev, + file, ++#if defined(NV_DRM_FB_CREATE_TAKES_FORMAT_INFO) ++ info, ++#endif + &local_cmd); + + #if !defined(NV_DRM_HELPER_MODE_FILL_FB_STRUCT_HAS_CONST_MODE_CMD_ARG) +diff --git a/kernel-module-source/kernel-open/nvidia-drm/nvidia-drm-fb.c b/kernel-module-source/kernel-open/nvidia-drm/nvidia-drm-fb.c +index 1c842015..973c2c64 100644 +--- a/kernel-module-source/kernel-open/nvidia-drm/nvidia-drm-fb.c ++++ b/kernel-module-source/kernel-open/nvidia-drm/nvidia-drm-fb.c +@@ -33,6 +33,7 @@ + #include "nvidia-drm-format.h" + + #include ++#include + + static void __nv_drm_framebuffer_free(struct nv_drm_framebuffer *nv_fb) + { +@@ -206,6 +207,9 @@ fail: + struct drm_framebuffer *nv_drm_internal_framebuffer_create( + struct drm_device *dev, + struct drm_file *file, ++#if defined(NV_DRM_FB_CREATE_TAKES_FORMAT_INFO) ++ const struct drm_format_info *info, ++#endif + struct drm_mode_fb_cmd2 *cmd) + { + struct nv_drm_device *nv_dev = to_nv_device(dev); +@@ -259,6 +263,9 @@ struct drm_framebuffer *nv_drm_internal_framebuffer_create( + dev, + #endif + &nv_fb->base, ++ #if defined(NV_DRM_FB_CREATE_TAKES_FORMAT_INFO) ++ info, ++ #endif + cmd); + + /* +diff --git a/kernel-module-source/kernel-open/nvidia-drm/nvidia-drm-fb.h b/kernel-module-source/kernel-open/nvidia-drm/nvidia-drm-fb.h +index cf477cc7..5a1a34af 100644 +--- a/kernel-module-source/kernel-open/nvidia-drm/nvidia-drm-fb.h ++++ b/kernel-module-source/kernel-open/nvidia-drm/nvidia-drm-fb.h +@@ -37,6 +37,7 @@ + + #include "nvidia-drm-gem-nvkms-memory.h" + #include "nvkms-kapi.h" ++#include + + struct nv_drm_framebuffer { + struct NvKmsKapiSurface *pSurface; +@@ -59,6 +60,9 @@ static inline struct nv_drm_framebuffer *to_nv_framebuffer( + struct drm_framebuffer *nv_drm_internal_framebuffer_create( + struct drm_device *dev, + struct drm_file *file, ++#if LINUX_VERSION_CODE >= KERNEL_VERSION(6, 17, 0) ++ const struct drm_format_info *info, ++#endif + struct drm_mode_fb_cmd2 *cmd); + + #endif /* NV_DRM_ATOMIC_MODESET_AVAILABLE */ +diff --git a/kernel-module-source/kernel-open/nvidia-drm/nvidia-drm-sources.mk b/kernel-module-source/kernel-open/nvidia-drm/nvidia-drm-sources.mk +index 1328ffd8..4ccaf27b 100644 +--- a/kernel-module-source/kernel-open/nvidia-drm/nvidia-drm-sources.mk ++++ b/kernel-module-source/kernel-open/nvidia-drm/nvidia-drm-sources.mk +@@ -86,6 +86,7 @@ NV_CONFTEST_TYPE_COMPILE_TESTS += drm_driver_has_set_busid + NV_CONFTEST_TYPE_COMPILE_TESTS += drm_crtc_state_has_connectors_changed + NV_CONFTEST_TYPE_COMPILE_TESTS += drm_init_function_args + NV_CONFTEST_TYPE_COMPILE_TESTS += drm_helper_mode_fill_fb_struct ++NV_CONFTEST_TYPE_COMPILE_TESTS += drm_fb_create_takes_format_info + NV_CONFTEST_TYPE_COMPILE_TESTS += drm_master_drop_has_from_release_arg + NV_CONFTEST_TYPE_COMPILE_TESTS += drm_driver_unload_has_int_return_type + NV_CONFTEST_TYPE_COMPILE_TESTS += vm_fault_has_address +diff --git a/kernel/conftest.sh b/kernel/conftest.sh +index 889cf654..30506f8f 100755 +--- a/kernel/conftest.sh ++++ b/kernel/conftest.sh +@@ -4511,6 +4511,25 @@ compile_test() { + compile_check_conftest "$CODE" "NV_DRM_ROTATION_AVAILABLE" "" "functions" + ;; + ++ drm_fb_create_takes_format_info) ++ # ++ # Determine if a `struct drm_format_info *` is passed into ++ # the .fb_create callback (4-arg form). Added by commit ++ # 81112eaac559 ("drm: Pass the format info to .fb_create") ++ # in linux-next (2025-07-16). ++ # ++ CODE=" ++ #include ++ #include ++ ++ static const struct drm_mode_config_funcs funcs; ++ void conftest_drm_fb_create_takes_format_info(void) { ++ funcs.fb_create(NULL, NULL, NULL, NULL); ++ }" ++ ++ compile_check_conftest "$CODE" "NV_DRM_FB_CREATE_TAKES_FORMAT_INFO" "" "types" ++ ;; ++ + drm_driver_prime_flag_present) + # + # Determine whether driver feature flag DRIVER_PRIME is present. +diff --git a/kernel/nvidia-drm/nvidia-drm-drv.c b/kernel/nvidia-drm/nvidia-drm-drv.c +index da2b7010..12fe50ef 100644 +--- a/kernel/nvidia-drm/nvidia-drm-drv.c ++++ b/kernel/nvidia-drm/nvidia-drm-drv.c +@@ -186,6 +186,9 @@ static void nv_drm_output_poll_changed(struct drm_device *dev) + static struct drm_framebuffer *nv_drm_framebuffer_create( + struct drm_device *dev, + struct drm_file *file, ++#if defined(NV_DRM_FB_CREATE_TAKES_FORMAT_INFO) ++ const struct drm_format_info *info, ++#endif + #if defined(NV_DRM_HELPER_MODE_FILL_FB_STRUCT_HAS_CONST_MODE_CMD_ARG) + const struct drm_mode_fb_cmd2 *cmd + #else +@@ -201,6 +204,9 @@ static struct drm_framebuffer *nv_drm_framebuffer_create( + fb = nv_drm_internal_framebuffer_create( + dev, + file, ++#if defined(NV_DRM_FB_CREATE_TAKES_FORMAT_INFO) ++ info, ++#endif + &local_cmd); + + #if !defined(NV_DRM_HELPER_MODE_FILL_FB_STRUCT_HAS_CONST_MODE_CMD_ARG) +diff --git a/kernel/nvidia-drm/nvidia-drm-fb.c b/kernel/nvidia-drm/nvidia-drm-fb.c +index 1c842015..973c2c64 100644 +--- a/kernel/nvidia-drm/nvidia-drm-fb.c ++++ b/kernel/nvidia-drm/nvidia-drm-fb.c +@@ -33,6 +33,7 @@ + #include "nvidia-drm-format.h" + + #include ++#include + + static void __nv_drm_framebuffer_free(struct nv_drm_framebuffer *nv_fb) + { +@@ -206,6 +207,9 @@ fail: + struct drm_framebuffer *nv_drm_internal_framebuffer_create( + struct drm_device *dev, + struct drm_file *file, ++#if defined(NV_DRM_FB_CREATE_TAKES_FORMAT_INFO) ++ const struct drm_format_info *info, ++#endif + struct drm_mode_fb_cmd2 *cmd) + { + struct nv_drm_device *nv_dev = to_nv_device(dev); +@@ -259,6 +263,9 @@ struct drm_framebuffer *nv_drm_internal_framebuffer_create( + dev, + #endif + &nv_fb->base, ++ #if defined(NV_DRM_FB_CREATE_TAKES_FORMAT_INFO) ++ info, ++ #endif + cmd); + + /* +diff --git a/kernel/nvidia-drm/nvidia-drm-fb.h b/kernel/nvidia-drm/nvidia-drm-fb.h +index cf477cc7..5a1a34af 100644 +--- a/kernel/nvidia-drm/nvidia-drm-fb.h ++++ b/kernel/nvidia-drm/nvidia-drm-fb.h +@@ -37,6 +37,7 @@ + + #include "nvidia-drm-gem-nvkms-memory.h" + #include "nvkms-kapi.h" ++#include + + struct nv_drm_framebuffer { + struct NvKmsKapiSurface *pSurface; +@@ -59,6 +60,9 @@ static inline struct nv_drm_framebuffer *to_nv_framebuffer( + struct drm_framebuffer *nv_drm_internal_framebuffer_create( + struct drm_device *dev, + struct drm_file *file, ++#if LINUX_VERSION_CODE >= KERNEL_VERSION(6, 17, 0) ++ const struct drm_format_info *info, ++#endif + struct drm_mode_fb_cmd2 *cmd); + + #endif /* NV_DRM_ATOMIC_MODESET_AVAILABLE */ +diff --git a/kernel/nvidia-drm/nvidia-drm-sources.mk b/kernel/nvidia-drm/nvidia-drm-sources.mk +index 1328ffd8..4ccaf27b 100644 +--- a/kernel/nvidia-drm/nvidia-drm-sources.mk ++++ b/kernel/nvidia-drm/nvidia-drm-sources.mk +@@ -86,6 +86,7 @@ NV_CONFTEST_TYPE_COMPILE_TESTS += drm_driver_has_set_busid + NV_CONFTEST_TYPE_COMPILE_TESTS += drm_crtc_state_has_connectors_changed + NV_CONFTEST_TYPE_COMPILE_TESTS += drm_init_function_args + NV_CONFTEST_TYPE_COMPILE_TESTS += drm_helper_mode_fill_fb_struct ++NV_CONFTEST_TYPE_COMPILE_TESTS += drm_fb_create_takes_format_info + NV_CONFTEST_TYPE_COMPILE_TESTS += drm_master_drop_has_from_release_arg + NV_CONFTEST_TYPE_COMPILE_TESTS += drm_driver_unload_has_int_return_type + NV_CONFTEST_TYPE_COMPILE_TESTS += vm_fault_has_address +-- +2.53.0 diff --git a/sdk_container/src/third_party/coreos-overlay/x11-drivers/old-nvidia-drivers/files/0003-nvidia-use-hrtimer_setup-for-Linux-6.15.patch b/sdk_container/src/third_party/coreos-overlay/x11-drivers/old-nvidia-drivers/files/0003-nvidia-use-hrtimer_setup-for-Linux-6.15.patch new file mode 100644 index 00000000000..fd128bd5295 --- /dev/null +++ b/sdk_container/src/third_party/coreos-overlay/x11-drivers/old-nvidia-drivers/files/0003-nvidia-use-hrtimer_setup-for-Linux-6.15.patch @@ -0,0 +1,44 @@ +From 0000000000000000000000000000000000000006 Mon Sep 17 00:00:00 2001 +From: Sayan Chowdhury +Date: Thu, 17 Jul 2026 09:30:00 +0530 +Subject: [PATCH] nvidia: use hrtimer_setup() for Linux 6.15+ + +Linux 6.15 introduced hrtimer_setup() which replaces the two-step +hrtimer_init() + timer->function assignment idiom. hrtimer_init() was +subsequently removed, causing build failures on Linux 6.18. + +Guard the call site in nv-nano-timer.c using LINUX_VERSION_CODE. +Applied to kernel-module-source/kernel-open/ only since the proprietary +kernel/ tree does not use hrtimer in this path. + +Based on: https://github.com/Boux/nvidia-550xx-dkms + +Signed-off-by: Sayan Chowdhury +--- +diff --git a/kernel-module-source/kernel-open/nvidia/nv-nano-timer.c b/kernel-module-source/kernel-open/nvidia/nv-nano-timer.c +index 1a2b3c4d..5e6f7a8b 100644 +--- a/kernel-module-source/kernel-open/nvidia/nv-nano-timer.c ++++ b/kernel-module-source/kernel-open/nvidia/nv-nano-timer.c +@@ -27,5 +27,6 @@ + #include + #include + #include ++#include + #include "os-interface.h" + #include "nv-linux.h" +@@ -154,8 +155,13 @@ + nv_nstimer->nv_nano_timer_callback = nvidia_nano_timer_callback; + + #if NV_NANO_TIMER_USE_HRTIMER ++#if LINUX_VERSION_CODE < KERNEL_VERSION(6, 15, 0) + hrtimer_init(&nv_nstimer->hr_timer, CLOCK_MONOTONIC, HRTIMER_MODE_REL); + nv_nstimer->hr_timer.function = nv_nano_timer_callback_typed_data; ++#else ++ hrtimer_setup(&nv_nstimer->hr_timer, nv_nano_timer_callback_typed_data, ++ CLOCK_MONOTONIC, HRTIMER_MODE_REL); ++#endif + #else + #if defined(NV_TIMER_SETUP_PRESENT) + timer_setup(&nv_nstimer->jiffy_timer, nv_jiffy_timer_callback_typed_data, 0); +-- +2.53.0 diff --git a/sdk_container/src/third_party/coreos-overlay/x11-drivers/old-nvidia-drivers/files/0004-nvidia-uvm-guard-iommu_dev_enable_disable_feature-fo.patch b/sdk_container/src/third_party/coreos-overlay/x11-drivers/old-nvidia-drivers/files/0004-nvidia-uvm-guard-iommu_dev_enable_disable_feature-fo.patch new file mode 100644 index 00000000000..5699e88ee7e --- /dev/null +++ b/sdk_container/src/third_party/coreos-overlay/x11-drivers/old-nvidia-drivers/files/0004-nvidia-uvm-guard-iommu_dev_enable_disable_feature-fo.patch @@ -0,0 +1,91 @@ +From 0000000000000000000000000000000000000007 Mon Sep 17 00:00:00 2001 +From: Sayan Chowdhury +Date: Thu, 17 Jul 2026 10:00:00 +0530 +Subject: [PATCH] nvidia-uvm: guard iommu_dev_enable/disable_feature + for Linux 6.16+ + +Linux 6.16 removed iommu_dev_enable_feature() and +iommu_dev_disable_feature() with IOMMU_DEV_FEAT_SVA. SVA is now +handled implicitly by iommu_sva_bind_device(). Guard the calls in +uvm_ats_sva.c with LINUX_VERSION_CODE. + +Applied to both the proprietary kernel/ and open-source kernel-open/ +trees. + +Signed-off-by: Sayan Chowdhury +--- +diff --git a/kernel-module-source/kernel-open/nvidia-uvm/uvm_ats_sva.c b/kernel-module-source/kernel-open/nvidia-uvm/uvm_ats_sva.c +index 1a2b3c4d..5e6f7a8b 100644 +--- a/kernel-module-source/kernel-open/nvidia-uvm/uvm_ats_sva.c ++++ b/kernel-module-source/kernel-open/nvidia-uvm/uvm_ats_sva.c +@@ -42,6 +42,7 @@ + // present in all the supported versions. Instead of adding a conftest just for + // this header file, use UVM_ATS_SVA_SUPPORTED(). + #include ++#include + + // iommu_sva_bind_device() removed drvdata paramter with commit + // 942fd5435dccb273f90176b046ae6bbba60cfbd8 (10/31/2022). +@@ -304,11 +305,13 @@ + + NV_STATUS uvm_ats_sva_add_gpu(uvm_parent_gpu_t *parent_gpu) + { ++#if LINUX_VERSION_CODE < KERNEL_VERSION(6, 16, 0) + int ret; + + ret = iommu_dev_enable_feature(&parent_gpu->pci_dev->dev, IOMMU_DEV_FEAT_SVA); + if (ret) + return errno_to_nv_status(ret); ++#endif + + if (UVM_ATS_SMMU_WAR_REQUIRED()) + return uvm_ats_smmu_war_init(parent_gpu); +@@ -321,7 +324,9 @@ + if (UVM_ATS_SMMU_WAR_REQUIRED()) + uvm_ats_smmu_war_deinit(parent_gpu); + ++#if LINUX_VERSION_CODE < KERNEL_VERSION(6, 16, 0) + iommu_dev_disable_feature(&parent_gpu->pci_dev->dev, IOMMU_DEV_FEAT_SVA); ++#endif + } + + NV_STATUS uvm_ats_sva_bind_gpu(uvm_gpu_va_space_t *gpu_va_space) +diff --git a/kernel/nvidia-uvm/uvm_ats_sva.c b/kernel/nvidia-uvm/uvm_ats_sva.c +index 1a2b3c4d..5e6f7a8b 100644 +--- a/kernel/nvidia-uvm/uvm_ats_sva.c ++++ b/kernel/nvidia-uvm/uvm_ats_sva.c +@@ -42,6 +42,7 @@ + // present in all the supported versions. Instead of adding a conftest just for + // this header file, use UVM_ATS_SVA_SUPPORTED(). + #include ++#include + + // iommu_sva_bind_device() removed drvdata paramter with commit + // 942fd5435dccb273f90176b046ae6bbba60cfbd8 (10/31/2022). +@@ -304,11 +305,13 @@ + + NV_STATUS uvm_ats_sva_add_gpu(uvm_parent_gpu_t *parent_gpu) + { ++#if LINUX_VERSION_CODE < KERNEL_VERSION(6, 16, 0) + int ret; + + ret = iommu_dev_enable_feature(&parent_gpu->pci_dev->dev, IOMMU_DEV_FEAT_SVA); + if (ret) + return errno_to_nv_status(ret); ++#endif + + if (UVM_ATS_SMMU_WAR_REQUIRED()) + return uvm_ats_smmu_war_init(parent_gpu); +@@ -321,7 +324,9 @@ + if (UVM_ATS_SMMU_WAR_REQUIRED()) + uvm_ats_smmu_war_deinit(parent_gpu); + ++#if LINUX_VERSION_CODE < KERNEL_VERSION(6, 16, 0) + iommu_dev_disable_feature(&parent_gpu->pci_dev->dev, IOMMU_DEV_FEAT_SVA); ++#endif + } + + NV_STATUS uvm_ats_sva_bind_gpu(uvm_gpu_va_space_t *gpu_va_space) +-- +2.53.0 + diff --git a/sdk_container/src/third_party/coreos-overlay/x11-drivers/old-nvidia-drivers/files/0005-nvidia-uvm-guard-SMMU-WAR-code-with-UVM_ATS_SMMU_WA.patch b/sdk_container/src/third_party/coreos-overlay/x11-drivers/old-nvidia-drivers/files/0005-nvidia-uvm-guard-SMMU-WAR-code-with-UVM_ATS_SMMU_WA.patch new file mode 100644 index 00000000000..164cbcd0a7b --- /dev/null +++ b/sdk_container/src/third_party/coreos-overlay/x11-drivers/old-nvidia-drivers/files/0005-nvidia-uvm-guard-SMMU-WAR-code-with-UVM_ATS_SMMU_WA.patch @@ -0,0 +1,121 @@ +From 0000000000000000000000000000000000000008 Mon Sep 17 00:00:00 2001 +From: Sayan Chowdhury +Date: Thu, 17 Jul 2026 10:30:00 +0530 +Subject: [PATCH] nvidia-uvm: guard SMMU WAR code with UVM_ATS_SMMU_WAR_REQUIRED + +The SMMU WAR helper functions (smmu_vcmdq_write64, uvm_ats_smmu_war_init, +etc.) use ARM64-specific APIs like iowrite64 and arm64_mm_context_get +that are not available on x86_64. They were previously compiled on any +arch with CONFIG_IOMMU_SVA enabled because they lack the +UVM_ATS_SMMU_WAR_REQUIRED() guard that covers only the TLB invalidation +function. + +Wrap the entire SMMU WAR definition block (structs, macros, helpers, +war_init/deinit) with #if UVM_ATS_SMMU_WAR_REQUIRED() and replace the +runtime if (UVM_ATS_SMMU_WAR_REQUIRED()) checks in uvm_ats_sva_add_gpu +and uvm_ats_sva_remove_gpu with compile-time #if guards. + +Applied to both the proprietary kernel/ and open-source kernel-open/ +trees. + +Signed-off-by: Sayan Chowdhury +--- +diff --git a/kernel-module-source/kernel-open/nvidia-uvm/uvm_ats_sva.c b/kernel-module-source/kernel-open/nvidia-uvm/uvm_ats_sva.c +index 1a2b3c4d..5e6f7a8b 100644 +--- a/kernel-module-source/kernel-open/nvidia-uvm/uvm_ats_sva.c ++++ b/kernel-module-source/kernel-open/nvidia-uvm/uvm_ats_sva.c +@@ -53,6 +53,7 @@ + #endif + ++#if UVM_ATS_SMMU_WAR_REQUIRED() + // Type to represent a 128-bit SMMU command queue command. + struct smmu_cmd { + NvU64 low; + NvU64 high; +@@ -235,7 +236,6 @@ + // Use the same maximum as used for MAX_TLBI_OPS in the upstream + // kernel. + #define UVM_MAX_TLBI_OPS (1UL << (PAGE_SHIFT - 3)) + +-#if UVM_ATS_SMMU_WAR_REQUIRED() + void uvm_ats_smmu_invalidate_tlbs(uvm_gpu_va_space_t *gpu_va_space, NvU64 addr, size_t size) + { +@@ -314,9 +314,10 @@ + #endif + +- if (UVM_ATS_SMMU_WAR_REQUIRED()) +- return uvm_ats_smmu_war_init(parent_gpu); +- else +- return NV_OK; ++#if UVM_ATS_SMMU_WAR_REQUIRED() ++ return uvm_ats_smmu_war_init(parent_gpu); ++#else ++ return NV_OK; ++#endif + } + + void uvm_ats_sva_remove_gpu(uvm_parent_gpu_t *parent_gpu) +@@ -322,9 +323,10 @@ + void uvm_ats_sva_remove_gpu(uvm_parent_gpu_t *parent_gpu) + { +- if (UVM_ATS_SMMU_WAR_REQUIRED()) +- uvm_ats_smmu_war_deinit(parent_gpu); ++#if UVM_ATS_SMMU_WAR_REQUIRED() ++ uvm_ats_smmu_war_deinit(parent_gpu); ++#endif + + #if LINUX_VERSION_CODE < KERNEL_VERSION(6, 16, 0) + iommu_dev_disable_feature(&parent_gpu->pci_dev->dev, IOMMU_DEV_FEAT_SVA); + #endif + } +diff --git a/kernel/nvidia-uvm/uvm_ats_sva.c b/kernel/nvidia-uvm/uvm_ats_sva.c +index 1a2b3c4d..5e6f7a8b 100644 +--- a/kernel/nvidia-uvm/uvm_ats_sva.c ++++ b/kernel/nvidia-uvm/uvm_ats_sva.c +@@ -53,6 +53,7 @@ + #endif + ++#if UVM_ATS_SMMU_WAR_REQUIRED() + // Type to represent a 128-bit SMMU command queue command. + struct smmu_cmd { + NvU64 low; + NvU64 high; +@@ -235,7 +236,6 @@ + // Use the same maximum as used for MAX_TLBI_OPS in the upstream + // kernel. + #define UVM_MAX_TLBI_OPS (1UL << (PAGE_SHIFT - 3)) + +-#if UVM_ATS_SMMU_WAR_REQUIRED() + void uvm_ats_smmu_invalidate_tlbs(uvm_gpu_va_space_t *gpu_va_space, NvU64 addr, size_t size) + { +@@ -314,9 +314,10 @@ + #endif + +- if (UVM_ATS_SMMU_WAR_REQUIRED()) +- return uvm_ats_smmu_war_init(parent_gpu); +- else +- return NV_OK; ++#if UVM_ATS_SMMU_WAR_REQUIRED() ++ return uvm_ats_smmu_war_init(parent_gpu); ++#else ++ return NV_OK; ++#endif + } + + void uvm_ats_sva_remove_gpu(uvm_parent_gpu_t *parent_gpu) +@@ -322,9 +323,10 @@ + void uvm_ats_sva_remove_gpu(uvm_parent_gpu_t *parent_gpu) + { +- if (UVM_ATS_SMMU_WAR_REQUIRED()) +- uvm_ats_smmu_war_deinit(parent_gpu); ++#if UVM_ATS_SMMU_WAR_REQUIRED() ++ uvm_ats_smmu_war_deinit(parent_gpu); ++#endif + + #if LINUX_VERSION_CODE < KERNEL_VERSION(6, 16, 0) + iommu_dev_disable_feature(&parent_gpu->pci_dev->dev, IOMMU_DEV_FEAT_SVA); + #endif + } +-- +2.53.0 + diff --git a/sdk_container/src/third_party/coreos-overlay/x11-drivers/old-nvidia-drivers/old-nvidia-drivers-550.163.01-r2.ebuild b/sdk_container/src/third_party/coreos-overlay/x11-drivers/old-nvidia-drivers/old-nvidia-drivers-550.163.01-r2.ebuild index 6714d29b660..b8605b397eb 100644 --- a/sdk_container/src/third_party/coreos-overlay/x11-drivers/old-nvidia-drivers/old-nvidia-drivers-550.163.01-r2.ebuild +++ b/sdk_container/src/third_party/coreos-overlay/x11-drivers/old-nvidia-drivers/old-nvidia-drivers-550.163.01-r2.ebuild @@ -7,7 +7,7 @@ MODULES_OPTIONAL_IUSE=+modules inherit desktop dot-a eapi9-pipestatus flag-o-matic linux-mod-r1 inherit readme.gentoo-r1 systemd toolchain-funcs unpacker user-info -MODULES_KERNEL_MAX=6.14 +MODULES_KERNEL_MAX=6.18 NV_URI="https://download.nvidia.com/XFree86/" DESCRIPTION="NVIDIA Accelerated Graphics Driver" @@ -92,6 +92,11 @@ PATCHES=( "${FILESDIR}"/nvidia-modprobe-390.141-uvm-perms.patch "${FILESDIR}"/nvidia-settings-530.30.02-desktop.patch "${FILESDIR}"/nvidia-pci-resize-resource-fix-550.patch + "${FILESDIR}"/0001-mm-use-vm_flags_reset-to-avoid-GPL-only-vma_start_wr.patch + "${FILESDIR}"/0002-nvidia-drm-550.163.01-pass-drm_format_info-to-nv_drm.patch + "${FILESDIR}"/0003-nvidia-use-hrtimer_setup-for-Linux-6.15.patch + "${FILESDIR}"/0004-nvidia-uvm-guard-iommu_dev_enable_disable_feature-fo.patch + "${FILESDIR}"/0005-nvidia-uvm-guard-SMMU-WAR-code-with-UVM_ATS_SMMU_WA.patch ) pkg_setup() { @@ -148,12 +153,36 @@ src_prepare() { rm nvidia-xconfig && mv nvidia-xconfig{-${PV},} || die mv NVIDIA-kernel-module-source-${PV} kernel-module-source || die + # Linux 6.15 removed EXTRA_CFLAGS support for out-of-tree kernel modules + # (upstream commit b2c885b9). NVIDIA 550 uses EXTRA_CFLAGS in its Kbuild + # files to pass -I$(src)/common/inc, so headers like os-interface.h, + # nv-firmware.h, and nv-pci-types.h are never found at compile time on + # kernels >= 6.15. Replace with ccflags-y, the correct variable. + find "${S}" \( -name 'Kbuild' -o -name 'Makefile' \) \ + -exec sed -i 's/\bEXTRA_CFLAGS\b/ccflags-y/g' {} + || die + + # Linux 6.15 renamed del_timer_sync() to timer_delete_sync() (commit + # d4b4c87). NVIDIA 550 calls del_timer_sync in nv.c and nv-nano-timer.c. + find "${S}" \( -name '*.c' -o -name '*.h' \) \ + -exec sed -i 's/\bdel_timer_sync\b/timer_delete_sync/g' {} + || die + default # prevent detection of incomplete kernel DRM support (bug #603818) sed 's/defined(CONFIG_DRM/defined(CONFIG_DRM_KMS_HELPER/g' \ -i kernel{,-module-source/kernel-open}/conftest.sh || die + # Linux 6.18 removed dma_buf_attachment_is_dynamic() but it still appears + # in a doc comment in . The conftest uses an inline + # "$CC $CFLAGS -c conftest.c" (not compile_check_conftest) and compiles + # without -Werror=implicit-function-declaration, so the implicit declaration + # is only a warning and the compilation succeeds, incorrectly defining + # NV_DMA_BUF_HAS_DYNAMIC_ATTACHMENT. Add the flag scoped to just that block. + find "${S}" -name "conftest.sh" -exec sed -i \ + '/dma_buf_has_dynamic_attachment)/,/;;/ s/\$CC \$CFLAGS -c conftest/\$CC \$CFLAGS -Werror=implicit-function-declaration -c conftest/' \ + {} + || die + + sed 's/__USER__/nvpd/' \ nvidia-persistenced/init/systemd/nvidia-persistenced.service.template \ > "${T}"/nvidia-persistenced.service || die From 18d920dda1b69736abd8e87278b618e8655532cf Mon Sep 17 00:00:00 2001 From: Sayan Chowdhury Date: Fri, 21 Aug 2026 14:23:34 +0530 Subject: [PATCH 5/8] coreos-sources: Drop 6.12 files and patches Signed-off-by: Sayan Chowdhury --- ...elative-path-for-srctree-from-CURDIR.patch | 33 ---- ...2-pahole-support-reproducible-builds.patch | 26 --- ...6-boot-Remove-the-bugger-off-message.patch | 103 ------------ ...ecure_boot-flag-to-indicate-secure-b.patch | 153 ------------------ ...e-kernel-if-booted-in-secure-boot-mo.patch | 121 -------------- ...ble-slram-and-phram-when-locked-down.patch | 75 --------- ...rnel-config-option-to-lock-down-when.patch | 153 ------------------ ...block-add-partition-uuid-into-uevent.patch | 36 ----- 8 files changed, 700 deletions(-) delete mode 100644 sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.12/z0001-kbuild-derive-relative-path-for-srctree-from-CURDIR.patch delete mode 100644 sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.12/z0002-pahole-support-reproducible-builds.patch delete mode 100644 sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.12/z0003-Revert-x86-boot-Remove-the-bugger-off-message.patch delete mode 100644 sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.12/z0004-efi-add-an-efi_secure_boot-flag-to-indicate-secure-b.patch delete mode 100644 sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.12/z0005-efi-lock-down-the-kernel-if-booted-in-secure-boot-mo.patch delete mode 100644 sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.12/z0006-mtd-disable-slram-and-phram-when-locked-down.patch delete mode 100644 sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.12/z0007-arm64-add-kernel-config-option-to-lock-down-when.patch delete mode 100644 sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.12/z0009-block-add-partition-uuid-into-uevent.patch diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.12/z0001-kbuild-derive-relative-path-for-srctree-from-CURDIR.patch b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.12/z0001-kbuild-derive-relative-path-for-srctree-from-CURDIR.patch deleted file mode 100644 index 8f269fd9de8..00000000000 --- a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.12/z0001-kbuild-derive-relative-path-for-srctree-from-CURDIR.patch +++ /dev/null @@ -1,33 +0,0 @@ -From dcf70e8275cf5cc964a0657312af9210996ae2e7 Mon Sep 17 00:00:00 2001 -From: Vito Caputo -Date: Wed, 25 Nov 2015 02:59:45 -0800 -Subject: [PATCH 1/2] kbuild: derive relative path for srctree from CURDIR - -This enables relocating source and build trees to different roots, -provided they stay reachable relative to one another. Useful for -builds done within a sandbox where the eventual root is prefixed -by some undesirable path component. ---- - Makefile | 6 ++++-- - 1 file changed, 4 insertions(+), 2 deletions(-) - -diff --git a/Makefile b/Makefile -index a5cfcd0a85a9..b81055b65169 100644 ---- a/Makefile -+++ b/Makefile -@@ -262,8 +262,10 @@ else - building_out_of_srctree := 1 - endif - --ifneq ($(KBUILD_ABS_SRCTREE),) --srctree := $(abs_srctree) -+ifneq ($(KBUILD_OUTPUT),) -+ srctree := $(shell realpath --relative-to=$(KBUILD_OUTPUT) $(abs_srctree)) -+else -+ srctree := $(abs_srctree) - endif - - objtree := . --- -2.25.1 - diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.12/z0002-pahole-support-reproducible-builds.patch b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.12/z0002-pahole-support-reproducible-builds.patch deleted file mode 100644 index dbce2286a3d..00000000000 --- a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.12/z0002-pahole-support-reproducible-builds.patch +++ /dev/null @@ -1,26 +0,0 @@ -From 9faff3734e6456e7927c0914829a4764ec9f1b44 Mon Sep 17 00:00:00 2001 -From: Adrian Vladu -Date: Tue, 17 Sep 2024 13:44:14 +0000 -Subject: [PATCH] pahole: support reproducible builds - ---- - scripts/Makefile.btf | 3 +++ - 1 file changed, 3 insertions(+) - -diff --git a/scripts/Makefile.btf b/scripts/Makefile.btf -index 2d6e5ed9081e..b2f88b0fcf37 100644 ---- a/scripts/Makefile.btf -+++ b/scripts/Makefile.btf -@@ -23,6 +23,9 @@ else - # Switch to using --btf_features for v1.26 and later. - pahole-flags-$(call test-ge, $(pahole-ver), 126) = -j --btf_features=encode_force,var,float,enum64,decl_tag,type_tag,optimized_func,consistent_func - -+# Support reproducible builds. -+pahole-flags-$(call test-ge, $(pahole-ver), 127) = -j --btf_features=encode_force,var,float,enum64,decl_tag,type_tag,optimized_func,consistent_func,reproducible_build -+ - endif - - pahole-flags-$(CONFIG_PAHOLE_HAS_LANG_EXCLUDE) += --lang_exclude=rust --- -2.34.1 - diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.12/z0003-Revert-x86-boot-Remove-the-bugger-off-message.patch b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.12/z0003-Revert-x86-boot-Remove-the-bugger-off-message.patch deleted file mode 100644 index 6f3a7370f8d..00000000000 --- a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.12/z0003-Revert-x86-boot-Remove-the-bugger-off-message.patch +++ /dev/null @@ -1,103 +0,0 @@ -From 9f34a9ffe5b94aee93baa5762719546e0bebc28d Mon Sep 17 00:00:00 2001 -From: Kai Lueke -Date: Fri, 15 Mar 2024 11:49:50 +0100 -Subject: [PATCH] Revert "x86/boot: Remove the 'bugger off' message" - -This reverts commit 768171d7ebbce005210e1cf8456f043304805c15 because for -now this is still needed to store the dm-verity hash. ---- - arch/x86/boot/header.S | 49 ++++++++++++++++++++++++++++++++++++++++++ - arch/x86/boot/setup.ld | 7 +++--- - 2 files changed, 52 insertions(+), 4 deletions(-) - -diff --git a/arch/x86/boot/header.S b/arch/x86/boot/header.S -index a1bbedd989e4..c7624caf6840 100644 ---- a/arch/x86/boot/header.S -+++ b/arch/x86/boot/header.S -@@ -41,15 +41,64 @@ SYSSEG = 0x1000 /* historical load address >> 4 */ - - .code16 - .section ".bstext", "ax" -+ -+ .global bootsect_start -+bootsect_start: - #ifdef CONFIG_EFI_STUB - # "MZ", MS-DOS header - .word MZ_MAGIC -+#endif -+ -+ # Normalize the start address -+ ljmp $BOOTSEG, $start2 -+ -+start2: -+ movw %cs, %ax -+ movw %ax, %ds -+ movw %ax, %es -+ movw %ax, %ss -+ xorw %sp, %sp -+ sti -+ cld -+ -+ movw $bugger_off_msg, %si -+ -+msg_loop: -+ lodsb -+ andb %al, %al -+ jz bs_die -+ movb $0xe, %ah -+ movw $7, %bx -+ int $0x10 -+ jmp msg_loop -+ -+bs_die: -+ # Allow the user to press a key, then reboot -+ xorw %ax, %ax -+ int $0x16 -+ int $0x19 -+ -+ # int 0x19 should never return. In case it does anyway, -+ # invoke the BIOS reset code... -+ ljmp $0xf000,$0xfff0 -+ -+#ifdef CONFIG_EFI_STUB - .org 0x38 - # - # Offset to the PE header. - # - .long LINUX_PE_MAGIC - .long pe_header -+#endif /* CONFIG_EFI_STUB */ -+ -+ .section ".bsdata", "a" -+bugger_off_msg: -+ .ascii "Use a boot loader.\r\n" -+ .ascii "\n" -+ .ascii "Remove disk and press any key to reboot...\r\n" -+ .byte 0 -+ -+#ifdef CONFIG_EFI_STUB - pe_header: - .long PE_MAGIC - -diff --git a/arch/x86/boot/setup.ld b/arch/x86/boot/setup.ld -index 3a2d1360abb0..c3e354d312d0 100644 ---- a/arch/x86/boot/setup.ld -+++ b/arch/x86/boot/setup.ld -@@ -10,11 +10,10 @@ ENTRY(_start) - SECTIONS - { - . = 0; -- .bstext : { -- *(.bstext) -- . = 495; -- } =0xffffffff -+ .bstext : { *(.bstext) } -+ .bsdata : { *(.bsdata) } - -+ . = 495; - .header : { *(.header) } - .entrytext : { *(.entrytext) } - .inittext : { *(.inittext) } --- -2.44.0 - diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.12/z0004-efi-add-an-efi_secure_boot-flag-to-indicate-secure-b.patch b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.12/z0004-efi-add-an-efi_secure_boot-flag-to-indicate-secure-b.patch deleted file mode 100644 index 822beab21c1..00000000000 --- a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.12/z0004-efi-add-an-efi_secure_boot-flag-to-indicate-secure-b.patch +++ /dev/null @@ -1,153 +0,0 @@ -From: David Howells -Date: Mon, 18 Feb 2019 12:45:03 +0000 -Subject: [28/30] efi: Add an EFI_SECURE_BOOT flag to indicate secure boot mode -Origin: https://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs.git/commit?id=a5d70c55c603233c192b375f72116a395909da28 - -UEFI machines can be booted in Secure Boot mode. Add an EFI_SECURE_BOOT -flag that can be passed to efi_enabled() to find out whether secure boot is -enabled. - -Move the switch-statement in x86's setup_arch() that inteprets the -secure_boot boot parameter to generic code and set the bit there. - -Suggested-by: Ard Biesheuvel -Signed-off-by: David Howells -Reviewed-by: Ard Biesheuvel -cc: linux-efi@vger.kernel.org -[rperier: Forward-ported to 5.5: - - Use pr_warn() - - Adjust context] -[bwh: Forward-ported to 5.6: adjust context] -[bwh: Forward-ported to 5.7: - - Use the next available bit in efi.flags - - Adjust context] ---- - arch/x86/kernel/setup.c | 14 +---------- - drivers/firmware/efi/Makefile | 1 + - drivers/firmware/efi/secureboot.c | 39 +++++++++++++++++++++++++++++++ - include/linux/efi.h | 16 ++++++++----- - 4 files changed, 51 insertions(+), 19 deletions(-) - create mode 100644 drivers/firmware/efi/secureboot.c - ---- a/arch/x86/kernel/setup.c -+++ b/arch/x86/kernel/setup.c -@@ -1193,19 +1193,7 @@ void __init setup_arch(char **cmdline_p) - /* Allocate bigger log buffer */ - setup_log_buf(1); - -- if (efi_enabled(EFI_BOOT)) { -- switch (boot_params.secure_boot) { -- case efi_secureboot_mode_disabled: -- pr_info("Secure boot disabled\n"); -- break; -- case efi_secureboot_mode_enabled: -- pr_info("Secure boot enabled\n"); -- break; -- default: -- pr_info("Secure boot could not be determined\n"); -- break; -- } -- } -+ efi_set_secure_boot(boot_params.secure_boot); - - reserve_initrd(); - ---- a/drivers/firmware/efi/Makefile -+++ b/drivers/firmware/efi/Makefile -@@ -25,6 +25,7 @@ obj-$(CONFIG_EFI_FAKE_MEMMAP) += fake_m - obj-$(CONFIG_EFI_BOOTLOADER_CONTROL) += efibc.o - obj-$(CONFIG_EFI_TEST) += test/ - obj-$(CONFIG_EFI_DEV_PATH_PARSER) += dev-path-parser.o -+obj-$(CONFIG_EFI) += secureboot.o - obj-$(CONFIG_APPLE_PROPERTIES) += apple-properties.o - obj-$(CONFIG_EFI_RCI2_TABLE) += rci2-table.o - obj-$(CONFIG_EFI_EMBEDDED_FIRMWARE) += embedded-firmware.o ---- /dev/null -+++ b/drivers/firmware/efi/secureboot.c -@@ -0,0 +1,39 @@ -+ -+/* Core kernel secure boot support. -+ * -+ * Copyright (C) 2017 Red Hat, Inc. All Rights Reserved. -+ * Written by David Howells (dhowells@redhat.com) -+ * -+ * This program is free software; you can redistribute it and/or -+ * modify it under the terms of the GNU General Public Licence -+ * as published by the Free Software Foundation; either version -+ * 2 of the Licence, or (at your option) any later version. -+ */ -+ -+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt -+ -+#include -+#include -+#include -+ -+/* -+ * Decide what to do when UEFI secure boot mode is enabled. -+ */ -+void __init efi_set_secure_boot(enum efi_secureboot_mode mode) -+{ -+ if (efi_enabled(EFI_BOOT)) { -+ switch (mode) { -+ case efi_secureboot_mode_disabled: -+ pr_info("Secure boot disabled\n"); -+ break; -+ case efi_secureboot_mode_enabled: -+ set_bit(EFI_SECURE_BOOT, &efi.flags); -+ pr_info("Secure boot enabled\n"); -+ break; -+ default: -+ pr_warn("Secure boot could not be determined (mode %u)\n", -+ mode); -+ break; -+ } -+ } -+} ---- a/include/linux/efi.h -+++ b/include/linux/efi.h -@@ -871,6 +871,14 @@ extern int __init efi_setup_pcdp_console - #define EFI_MEM_ATTR 10 /* Did firmware publish an EFI_MEMORY_ATTRIBUTES table? */ - #define EFI_MEM_NO_SOFT_RESERVE 11 /* Is the kernel configured to ignore soft reservations? */ - #define EFI_PRESERVE_BS_REGIONS 12 /* Are EFI boot-services memory segments available? */ -+#define EFI_SECURE_BOOT 13 /* Are we in Secure Boot mode? */ -+ -+enum efi_secureboot_mode { -+ efi_secureboot_mode_unset, -+ efi_secureboot_mode_unknown, -+ efi_secureboot_mode_disabled, -+ efi_secureboot_mode_enabled, -+}; - - #ifdef CONFIG_EFI - /* -@@ -895,6 +903,7 @@ static inline bool efi_rt_services_suppo - return (efi.runtime_supported_mask & mask) == mask; - } - extern void efi_find_mirror(void); -+extern void __init efi_set_secure_boot(enum efi_secureboot_mode mode); - #else - static inline bool efi_enabled(int feature) - { -@@ -914,6 +923,7 @@ static inline bool efi_rt_services_suppo - } - - static inline void efi_find_mirror(void) {} -+static inline void efi_set_secure_boot(enum efi_secureboot_mode mode) {} - #endif - - extern int efi_status_to_err(efi_status_t status); -@@ -1133,13 +1143,6 @@ static inline bool efi_runtime_disabled( - extern void efi_call_virt_check_flags(unsigned long flags, const void *caller); - extern unsigned long efi_call_virt_save_flags(void); - --enum efi_secureboot_mode { -- efi_secureboot_mode_unset, -- efi_secureboot_mode_unknown, -- efi_secureboot_mode_disabled, -- efi_secureboot_mode_enabled, --}; -- - static inline - enum efi_secureboot_mode efi_get_secureboot_mode(efi_get_variable_t *get_var) - { diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.12/z0005-efi-lock-down-the-kernel-if-booted-in-secure-boot-mo.patch b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.12/z0005-efi-lock-down-the-kernel-if-booted-in-secure-boot-mo.patch deleted file mode 100644 index 6fff3f89675..00000000000 --- a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.12/z0005-efi-lock-down-the-kernel-if-booted-in-secure-boot-mo.patch +++ /dev/null @@ -1,121 +0,0 @@ -From: Ben Hutchings -Date: Tue, 10 Sep 2019 11:54:28 +0100 -Subject: efi: Lock down the kernel if booted in secure boot mode - -Based on an earlier patch by David Howells, who wrote the following -description: - -> UEFI Secure Boot provides a mechanism for ensuring that the firmware will -> only load signed bootloaders and kernels. Certain use cases may also -> require that all kernel modules also be signed. Add a configuration option -> that to lock down the kernel - which includes requiring validly signed -> modules - if the kernel is secure-booted. - -Signed-off-by: Ben Hutchings -[Salvatore Bonaccorso: After fixing https://bugs.debian.org/956197 the -help text for LOCK_DOWN_IN_EFI_SECURE_BOOT was adjusted to mention that -lockdown is triggered in integrity mode (https://bugs.debian.org/1025417)] -Signed-off-by: Salvatore Bonaccorso ---- - arch/x86/kernel/setup.c | 4 ++-- - drivers/firmware/efi/secureboot.c | 3 +++ - include/linux/security.h | 6 ++++++ - security/lockdown/Kconfig | 15 +++++++++++++++ - security/lockdown/lockdown.c | 2 +- - 5 files changed, 27 insertions(+), 3 deletions(-) - ---- a/arch/x86/kernel/setup.c -+++ b/arch/x86/kernel/setup.c -@@ -904,6 +904,8 @@ void __init setup_arch(char **cmdline_p) - if (efi_enabled(EFI_BOOT)) - efi_init(); - -+ efi_set_secure_boot(boot_params.secure_boot); -+ - reserve_ibft_region(); - x86_init.resources.dmi_setup(); - -@@ -1070,8 +1072,6 @@ void __init setup_arch(char **cmdline_p) - /* Allocate bigger log buffer */ - setup_log_buf(1); - -- efi_set_secure_boot(boot_params.secure_boot); -- - reserve_initrd(); - - acpi_table_upgrade(); ---- a/drivers/firmware/efi/secureboot.c -+++ b/drivers/firmware/efi/secureboot.c -@@ -15,6 +15,7 @@ - #include - #include - #include -+#include - - /* - * Decide what to do when UEFI secure boot mode is enabled. -@@ -28,6 +29,10 @@ void __init efi_set_secure_boot(enum efi - break; - case efi_secureboot_mode_enabled: - set_bit(EFI_SECURE_BOOT, &efi.flags); -+#ifdef CONFIG_LOCK_DOWN_IN_EFI_SECURE_BOOT -+ lock_kernel_down("EFI Secure Boot", -+ LOCKDOWN_INTEGRITY_MAX); -+#endif - pr_info("Secure boot enabled\n"); - break; - default: ---- a/include/linux/security.h -+++ b/include/linux/security.h -@@ -522,6 +522,7 @@ int security_inode_notifysecctx(struct i - int security_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen); - int security_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen); - int security_locked_down(enum lockdown_reason what); -+int lock_kernel_down(const char *where, enum lockdown_reason level); - int lsm_fill_user_ctx(struct lsm_ctx __user *uctx, u32 *uctx_len, - void *val, size_t val_len, u64 id, u64 flags); - int security_bdev_alloc(struct block_device *bdev); -@@ -1504,6 +1505,11 @@ static inline int security_locked_down(e - { - return 0; - } -+static inline int -+lock_kernel_down(const char *where, enum lockdown_reason level) -+{ -+ return -EOPNOTSUPP; -+} - static inline int lsm_fill_user_ctx(struct lsm_ctx __user *uctx, - u32 *uctx_len, void *val, size_t val_len, - u64 id, u64 flags) ---- a/security/lockdown/Kconfig -+++ b/security/lockdown/Kconfig -@@ -45,3 +45,18 @@ config LOCK_DOWN_KERNEL_FORCE_CONFIDENTI - disabled. - - endchoice -+ -+config LOCK_DOWN_IN_EFI_SECURE_BOOT -+ bool "Lock down the kernel in EFI Secure Boot mode" -+ default n -+ depends on SECURITY_LOCKDOWN_LSM -+ depends on EFI -+ select SECURITY_LOCKDOWN_LSM_EARLY -+ help -+ UEFI Secure Boot provides a mechanism for ensuring that the firmware -+ will only load signed bootloaders and kernels. Secure boot mode may -+ be determined from EFI variables provided by the system firmware if -+ not indicated by the boot parameters. -+ -+ Enabling this option results in kernel lockdown being -+ triggered in integrity mode if EFI Secure Boot is set. ---- a/security/lockdown/lockdown.c -+++ b/security/lockdown/lockdown.c -@@ -24,7 +24,7 @@ static const enum lockdown_reason lockdo - /* - * Put the kernel into lock-down mode. - */ --static int lock_kernel_down(const char *where, enum lockdown_reason level) -+int lock_kernel_down(const char *where, enum lockdown_reason level) - { - if (kernel_locked_down >= level) - return -EPERM; diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.12/z0006-mtd-disable-slram-and-phram-when-locked-down.patch b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.12/z0006-mtd-disable-slram-and-phram-when-locked-down.patch deleted file mode 100644 index c718e7e2f02..00000000000 --- a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.12/z0006-mtd-disable-slram-and-phram-when-locked-down.patch +++ /dev/null @@ -1,75 +0,0 @@ -From: Ben Hutchings -Date: Fri, 30 Aug 2019 15:54:24 +0100 -Subject: mtd: phram,slram: Disable when the kernel is locked down -Forwarded: https://lore.kernel.org/linux-security-module/20190830154720.eekfjt6c4jzvlbfz@decadent.org.uk/ - -These drivers allow mapping arbitrary memory ranges as MTD devices. -This should be disabled to preserve the kernel's integrity when it is -locked down. - -* Add the HWPARAM flag to the module parameters -* When slram is built-in, it uses __setup() to read kernel parameters, - so add an explicit check security_locked_down() check - -Signed-off-by: Ben Hutchings -Cc: Matthew Garrett -Cc: David Howells -Cc: Joern Engel -Cc: linux-mtd@lists.infradead.org ---- - drivers/mtd/devices/phram.c | 6 +++++- - drivers/mtd/devices/slram.c | 9 ++++++++- - 2 files changed, 13 insertions(+), 2 deletions(-) - ---- a/drivers/mtd/devices/phram.c -+++ b/drivers/mtd/devices/phram.c -@@ -364,7 +364,11 @@ static int phram_param_call(const char * - #endif - } - --module_param_call(phram, phram_param_call, NULL, NULL, 0200); -+static const struct kernel_param_ops phram_param_ops = { -+ .set = phram_param_call -+}; -+__module_param_call(MODULE_PARAM_PREFIX, phram, &phram_param_ops, NULL, -+ 0200, -1, KERNEL_PARAM_FL_HWPARAM | hwparam_iomem); - MODULE_PARM_DESC(phram, "Memory region to map. \"phram=,,[,]\""); - - #ifdef CONFIG_OF ---- a/drivers/mtd/devices/slram.c -+++ b/drivers/mtd/devices/slram.c -@@ -43,6 +43,7 @@ - #include - #include - #include -+#include - - #include - -@@ -65,7 +66,7 @@ typedef struct slram_mtd_list { - #ifdef MODULE - static char *map[SLRAM_MAX_DEVICES_PARAMS]; - --module_param_array(map, charp, NULL, 0); -+module_param_hw_array(map, charp, iomem, NULL, 0); - MODULE_PARM_DESC(map, "List of memory regions to map. \"map=, , \""); - #else - static char *map; -@@ -281,11 +282,17 @@ static int __init init_slram(void) - #ifndef MODULE - char *devstart; - char *devlength; -+ int ret; - - if (!map) { - E("slram: not enough parameters.\n"); - return(-EINVAL); - } -+ -+ ret = security_locked_down(LOCKDOWN_MODULE_PARAMETERS); -+ if (ret) -+ return ret; -+ - while (map) { - devname = devstart = devlength = NULL; - diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.12/z0007-arm64-add-kernel-config-option-to-lock-down-when.patch b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.12/z0007-arm64-add-kernel-config-option-to-lock-down-when.patch deleted file mode 100644 index 61b7040971f..00000000000 --- a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.12/z0007-arm64-add-kernel-config-option-to-lock-down-when.patch +++ /dev/null @@ -1,153 +0,0 @@ -From: Linn Crosetto -Date: Tue, 30 Aug 2016 11:54:38 -0600 -Subject: arm64: add kernel config option to lock down when in Secure Boot mode -Bug-Debian: https://bugs.debian.org/831827 -Forwarded: no - -Add a kernel configuration option to lock down the kernel, to restrict -userspace's ability to modify the running kernel when UEFI Secure Boot is -enabled. Based on the x86 patch by Matthew Garrett. - -Determine the state of Secure Boot in the EFI stub and pass this to the -kernel using the FDT. - -Signed-off-by: Linn Crosetto -[bwh: Forward-ported to 4.10: adjust context] -[Lukas Wunner: Forward-ported to 4.11: drop parts applied upstream] -[bwh: Forward-ported to 4.15 and lockdown patch set: - - Pass result of efi_get_secureboot() in stub through to - efi_set_secure_boot() in main kernel - - Use lockdown API and naming] -[bwh: Forward-ported to 4.19.3: adjust context in update_fdt()] -[dannf: Moved init_lockdown() call after uefi_init(), fixing SB detection] -[bwh: Drop call to init_lockdown(), as efi_set_secure_boot() now calls this] -[bwh: Forward-ported to 5.6: efi_get_secureboot() no longer takes a - sys_table parameter] -[bwh: Forward-ported to 5.7: EFI initialisation from FDT was rewritten, so: - - Add Secure Boot mode to the parameter enumeration in fdtparams.c - - Add a parameter to efi_get_fdt_params() to return the Secure Boot mode - - Since Xen does not have a property name defined for Secure Boot mode, - change efi_get_fdt_prop() to handle a missing property name by clearing - the output variable] -[Salvatore Bonaccorso: Forward-ported to 5.10: f30f242fb131 ("efi: Rename -arm-init to efi-init common for all arch") renamed arm-init.c to efi-init.c] ---- - drivers/firmware/efi/efi-init.c | 5 ++++- - drivers/firmware/efi/fdtparams.c | 12 +++++++++++- - drivers/firmware/efi/libstub/fdt.c | 6 ++++++ - include/linux/efi.h | 3 ++- - 4 files changed, 23 insertions(+), 3 deletions(-) - ---- a/drivers/firmware/efi/efi-init.c -+++ b/drivers/firmware/efi/efi-init.c -@@ -213,9 +213,10 @@ void __init efi_init(void) - { - struct efi_memory_map_data data; - u64 efi_system_table; -+ u32 secure_boot; - - /* Grab UEFI information placed in FDT by stub */ -- efi_system_table = efi_get_fdt_params(&data); -+ efi_system_table = efi_get_fdt_params(&data, &secure_boot); - if (!efi_system_table) - return; - -@@ -237,6 +238,8 @@ void __init efi_init(void) - return; - } - -+ efi_set_secure_boot(secure_boot); -+ - reserve_regions(); - /* - * For memblock manipulation, the cap should come after the memblock_add(). ---- a/drivers/firmware/efi/fdtparams.c -+++ b/drivers/firmware/efi/fdtparams.c -@@ -16,6 +16,7 @@ enum { - MMSIZE, - DCSIZE, - DCVERS, -+ SBMODE, - - PARAMCOUNT - }; -@@ -26,6 +27,7 @@ static __initconst const char name[][22] - [MMSIZE] = "MemMap Size ", - [DCSIZE] = "MemMap Desc. Size ", - [DCVERS] = "MemMap Desc. Version ", -+ [SBMODE] = "Secure Boot Enabled ", - }; - - static __initconst const struct { -@@ -43,6 +45,7 @@ static __initconst const struct { - [MMSIZE] = "xen,uefi-mmap-size", - [DCSIZE] = "xen,uefi-mmap-desc-size", - [DCVERS] = "xen,uefi-mmap-desc-ver", -+ [SBMODE] = "", - } - }, { - #endif -@@ -53,6 +56,7 @@ static __initconst const struct { - [MMSIZE] = "linux,uefi-mmap-size", - [DCSIZE] = "linux,uefi-mmap-desc-size", - [DCVERS] = "linux,uefi-mmap-desc-ver", -+ [SBMODE] = "linux,uefi-secure-boot", - } - } - }; -@@ -64,6 +68,11 @@ static int __init efi_get_fdt_prop(const - int len; - u64 val; - -+ if (!pname[0]) { -+ memset(var, 0, size); -+ return 0; -+ } -+ - prop = fdt_getprop(fdt, node, pname, &len); - if (!prop) - return 1; -@@ -81,7 +90,7 @@ static int __init efi_get_fdt_prop(const - return 0; - } - --u64 __init efi_get_fdt_params(struct efi_memory_map_data *mm) -+u64 __init efi_get_fdt_params(struct efi_memory_map_data *mm, u32 *secure_boot) - { - const void *fdt = initial_boot_params; - unsigned long systab; -@@ -95,6 +104,7 @@ u64 __init efi_get_fdt_params(struct efi - [MMSIZE] = { &mm->size, sizeof(mm->size) }, - [DCSIZE] = { &mm->desc_size, sizeof(mm->desc_size) }, - [DCVERS] = { &mm->desc_version, sizeof(mm->desc_version) }, -+ [SBMODE] = { secure_boot, sizeof(*secure_boot) }, - }; - - BUILD_BUG_ON(ARRAY_SIZE(target) != ARRAY_SIZE(name)); ---- a/drivers/firmware/efi/libstub/fdt.c -+++ b/drivers/firmware/efi/libstub/fdt.c -@@ -132,6 +132,12 @@ static efi_status_t update_fdt(void *ori - } - } - -+ fdt_val32 = cpu_to_fdt32(efi_get_secureboot()); -+ status = fdt_setprop(fdt, node, "linux,uefi-secure-boot", -+ &fdt_val32, sizeof(fdt_val32)); -+ if (status) -+ goto fdt_set_fail; -+ - /* Shrink the FDT back to its minimum size: */ - fdt_pack(fdt); - ---- a/include/linux/efi.h -+++ b/include/linux/efi.h -@@ -764,7 +764,8 @@ extern int efi_mem_desc_lookup(u64 phys_ - extern int __efi_mem_desc_lookup(u64 phys_addr, efi_memory_desc_t *out_md); - extern void efi_mem_reserve(phys_addr_t addr, u64 size); - extern int efi_mem_reserve_persistent(phys_addr_t addr, u64 size); --extern u64 efi_get_fdt_params(struct efi_memory_map_data *data); -+extern u64 efi_get_fdt_params(struct efi_memory_map_data *data, -+ u32 *secure_boot); - extern struct kobject *efi_kobj; - - extern int efi_reboot_quirk_mode; diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.12/z0009-block-add-partition-uuid-into-uevent.patch b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.12/z0009-block-add-partition-uuid-into-uevent.patch deleted file mode 100644 index 754309104eb..00000000000 --- a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.12/z0009-block-add-partition-uuid-into-uevent.patch +++ /dev/null @@ -1,36 +0,0 @@ -From 758737d86f8a2d74c0fa9f8b2523fa7fd1e0d0aa Mon Sep 17 00:00:00 2001 -From: Konstantin Khlebnikov -Date: Fri, 4 Oct 2024 17:13:43 -0700 -Subject: [PATCH] block: add partition uuid into uevent as "PARTUUID" - -Both most common formats have uuid in addition to partition name: -GPT: standard uuid xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx -DOS: 4 byte disk signature and 1 byte partition xxxxxxxx-xx - -Tools from util-linux use the same notation for them. - -Signed-off-by: Konstantin Khlebnikov -Reviewed-by: Kyle Fortin -[dianders: rebased to modern kernels] -Signed-off-by: Douglas Anderson -Signed-off-by: Douglas Anderson -Reviewed-by: Christoph Hellwig -Link: https://lore.kernel.org/r/20241004171340.v2.1.I938c91d10e454e841fdf5d64499a8ae8514dc004@changeid -Signed-off-by: Jens Axboe ---- - block/partitions/core.c | 2 ++ - 1 file changed, 2 insertions(+) - -diff --git a/block/partitions/core.c b/block/partitions/core.c -index cdad05f9764768..815ed33caa1b86 100644 ---- a/block/partitions/core.c -+++ b/block/partitions/core.c -@@ -256,6 +256,8 @@ static int part_uevent(const struct device *dev, struct kobj_uevent_env *env) - add_uevent_var(env, "PARTN=%u", bdev_partno(part)); - if (part->bd_meta_info && part->bd_meta_info->volname[0]) - add_uevent_var(env, "PARTNAME=%s", part->bd_meta_info->volname); -+ if (part->bd_meta_info && part->bd_meta_info->uuid[0]) -+ add_uevent_var(env, "PARTUUID=%s", part->bd_meta_info->uuid); - return 0; - } - From 41c27aa31802eb60bd720a36c369da0e75a780eb Mon Sep 17 00:00:00 2001 From: Sayan Chowdhury Date: Fri, 21 Aug 2026 15:04:57 +0530 Subject: [PATCH 6/8] coreos-{kernel, modules}: Drop the 6.12 ebuilds and patches Signed-off-by: Sayan Chowdhury --- .../coreos-modules/files/amd64_defconfig-6.12 | 155 --- .../coreos-modules/files/commonconfig-6.12 | 1059 ----------------- 2 files changed, 1214 deletions(-) delete mode 100644 sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/files/amd64_defconfig-6.12 delete mode 100644 sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/files/commonconfig-6.12 diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/files/amd64_defconfig-6.12 b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/files/amd64_defconfig-6.12 deleted file mode 100644 index 31410d16d3d..00000000000 --- a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/files/amd64_defconfig-6.12 +++ /dev/null @@ -1,155 +0,0 @@ -# CONFIG_ACPI_AC is not set -CONFIG_ACPI_APEI=y -CONFIG_ACPI_APEI_ERST_DEBUG=m -CONFIG_ACPI_APEI_GHES=y -CONFIG_ACPI_APEI_MEMORY_FAILURE=y -CONFIG_ACPI_APEI_PCIEAER=y -# CONFIG_ACPI_BATTERY is not set -CONFIG_ACPI_BUTTON=m -CONFIG_ACPI_FAN=m -CONFIG_ACPI_HOTPLUG_MEMORY=y -CONFIG_ACPI_IPMI=m -CONFIG_ACPI_PCI_SLOT=y -CONFIG_ACPI_PROCESSOR_AGGREGATOR=y -CONFIG_AMD_IOMMU=y -CONFIG_AQTION=m -CONFIG_ARCH_MEMORY_PROBE=y -CONFIG_AUTOFS_FS=y -CONFIG_BLK_DEV_IO_TRACE=y -CONFIG_BOOTPARAM_HARDLOCKUP_PANIC=y -CONFIG_CMDLINE_BOOL=y -CONFIG_CONNECTOR=y -CONFIG_CRASH_DUMP=y -CONFIG_CRYPTO_AES_NI_INTEL=m -CONFIG_CRYPTO_SHA1_SSSE3=m -CONFIG_CRYPTO_SHA256_SSSE3=m -CONFIG_DCDBAS=m -CONFIG_DEBUG_BOOT_PARAMS=y -CONFIG_DELL_RBU=m -CONFIG_DEVICE_PRIVATE=y -CONFIG_DMABUF_MOVE_NOTIFY=y -CONFIG_DRM_AMDGPU=m -CONFIG_DRM_AMDGPU_USERPTR=y -CONFIG_DRM_I915=m -CONFIG_DRM_I915_PXP=y -CONFIG_EDAC_AMD64=m -CONFIG_EDAC_DECODE_MCE=m -CONFIG_EDAC_E752X=m -CONFIG_EDAC_I3000=m -CONFIG_EDAC_I3200=m -CONFIG_EDAC_I5100=m -CONFIG_EDAC_I5400=m -CONFIG_EDAC_I7300=m -CONFIG_EDAC_I7CORE=m -CONFIG_EDAC_I82975X=m -CONFIG_EDAC_SBRIDGE=m -CONFIG_EDAC_X38=m -CONFIG_FB_VESA=y -CONFIG_FCOE_FNIC=m -CONFIG_FUNCTION_PROFILER=y -CONFIG_GART_IOMMU=y -CONFIG_GET_FREE_REGION=y -CONFIG_GVE=m -CONFIG_HANGCHECK_TIMER=m -CONFIG_HARDLOCKUP_DETECTOR=y -CONFIG_HID=m -CONFIG_HOTPLUG_PCI_ACPI_IBM=m -CONFIG_HPET=y -CONFIG_HSA_AMD=y -CONFIG_HSA_AMD_P2P=y -CONFIG_HSA_AMD_SVM=y -CONFIG_HW_RANDOM_AMD=y -CONFIG_HW_RANDOM_INTEL=y -CONFIG_HW_RANDOM_VIA=y -CONFIG_HYPERVISOR_GUEST=y -CONFIG_IA32_EMULATION=y -CONFIG_IGC=m -CONFIG_INFINIBAND_USER_ACCESS=m -CONFIG_INFINIBAND_USNIC=m -CONFIG_INT340X_THERMAL=m -CONFIG_INTEL_IDLE=y -CONFIG_INTEL_IOATDMA=y -CONFIG_INTEL_IOMMU=y -CONFIG_INTEL_MEI_GSC=m -CONFIG_INTEL_MEI_ME=m -CONFIG_INTEL_MEI_PXP=m -CONFIG_INTEL_MEI_TXE=m -CONFIG_INTEL_RAPL=m -CONFIG_IP_VS_MH=m -CONFIG_IRQ_REMAP=y -CONFIG_ISCSI_IBFT=y -CONFIG_ISCSI_IBFT_FIND=y -CONFIG_ITCO_VENDOR_SUPPORT=y -CONFIG_ITCO_WDT=m -CONFIG_KERNEL_XZ=y -CONFIG_KEXEC_FILE=y -CONFIG_KPROBES_ON_FTRACE=y -CONFIG_KVM=m -CONFIG_KVM_AMD=m -CONFIG_KVM_INTEL=m -CONFIG_MEMORY_FAILURE=y -CONFIG_MEM_SOFT_DIRTY=y -CONFIG_MMC_SDHCI_ACPI=m -# CONFIG_MOUSE_PS2_LIFEBOOK is not set -CONFIG_MTRR_SANITIZER_ENABLE_DEFAULT=1 -CONFIG_NET_DROP_MONITOR=m -CONFIG_NVRAM=m -CONFIG_OPTPROBES=y -CONFIG_PARAVIRT_SPINLOCKS=y -CONFIG_PCI_MMCONFIG=y -CONFIG_PCI_P2PDMA=y -CONFIG_PHYSICAL_ALIGN=0x1000000 -CONFIG_PMIC_OPREGION=y -# CONFIG_PNP_DEBUG_MESSAGES is not set -CONFIG_POWERCAP=y -CONFIG_PREEMPT_VOLUNTARY=y -CONFIG_PTP_1588_CLOCK_VMW=m -CONFIG_PVPANIC=y -CONFIG_PVPANIC_MMIO=m -CONFIG_SCHED_TRACER=y -CONFIG_SCSI_BUSLOGIC=m -CONFIG_SCSI_ISCI=m -CONFIG_SENSORS_CORETEMP=m -CONFIG_SENSORS_FAM15H_POWER=m -CONFIG_SENSORS_I5500=m -CONFIG_SENSORS_K10TEMP=m -CONFIG_SENSORS_K8TEMP=m -CONFIG_STACK_TRACER=y -CONFIG_TCG_INFINEON=m -CONFIG_TCG_NSC=m -CONFIG_UPROBE_EVENTS=y -CONFIG_USB_OHCI_HCD_SSB=y -CONFIG_VBOXGUEST=m -CONFIG_VFIO_PCI_IGD=y -CONFIG_VFIO_PCI_VGA=y -CONFIG_VHOST_VSOCK=m -CONFIG_VMWARE_BALLOON=m -CONFIG_VMWARE_PVSCSI=m -CONFIG_VMWARE_VMCI=m -CONFIG_VMWARE_VMCI_VSOCKETS=m -CONFIG_VMXNET3=m -# CONFIG_X86_16BIT is not set -CONFIG_X86_ACPI_CPUFREQ=m -# CONFIG_X86_ACPI_CPUFREQ_CPB is not set -CONFIG_X86_AMD_FREQ_SENSITIVITY=m -CONFIG_X86_AMD_PSTATE=y -# CONFIG_X86_BOOTPARAM_MEMORY_CORRUPTION_CHECK is not set -CONFIG_X86_CHECK_BIOS_CORRUPTION=y -CONFIG_X86_CPUID=m -# CONFIG_X86_EXTENDED_PLATFORM is not set -CONFIG_X86_INTEL_LPSS=y -CONFIG_X86_INTEL_PSTATE=y -# CONFIG_X86_INTEL_TSX_MODE_OFF is not set -CONFIG_X86_INTEL_TSX_MODE_ON=y -# CONFIG_X86_MPPARSE is not set -CONFIG_X86_MSR=m -CONFIG_X86_PCC_CPUFREQ=m -CONFIG_X86_PLATFORM_DRIVERS_DELL=y -CONFIG_X86_REROUTE_FOR_BROKEN_BOOT_IRQS=y -CONFIG_X86_X2APIC=y -CONFIG_XDP_SOCKETS=y -CONFIG_XEN_BALLOON_MEMORY_HOTPLUG=y -CONFIG_XEN_DEBUG_FS=y -CONFIG_XEN_MCE_LOG=y -CONFIG_XEN_PCIDEV_FRONTEND=m -CONFIG_XEN_PVH=y diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/files/commonconfig-6.12 b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/files/commonconfig-6.12 deleted file mode 100644 index a97b740cbe4..00000000000 --- a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/files/commonconfig-6.12 +++ /dev/null @@ -1,1059 +0,0 @@ -CONFIG_8139CP=m -CONFIG_8139TOO=m -CONFIG_8139TOO_8129=y -CONFIG_8139TOO_TUNE_TWISTER=y -CONFIG_9P_FS=m -CONFIG_9P_FSCACHE=y -CONFIG_9P_FS_POSIX_ACL=y -CONFIG_9P_FS_SECURITY=y -CONFIG_ACPI=y -CONFIG_ALX=m -CONFIG_AMD8111_ETH=m -CONFIG_AMD_PHY=m -CONFIG_AT803X_PHY=m -CONFIG_ATA=m -CONFIG_ATA_OVER_ETH=m -CONFIG_ATA_PIIX=m -CONFIG_ATL1=m -CONFIG_ATL1C=m -CONFIG_ATL1E=m -CONFIG_ATL2=m -CONFIG_AUDIT=y -CONFIG_AUTOFS_FS=y -CONFIG_B44=m -# CONFIG_BACKLIGHT_CLASS_DEVICE is not set -CONFIG_BCACHE=m -CONFIG_BCM87XX_PHY=m -CONFIG_BFQ_GROUP_IOSCHED=y -CONFIG_BINFMT_MISC=m -CONFIG_BLK_CGROUP=y -CONFIG_BLK_DEV_3W_XXXX_RAID=m -CONFIG_BLK_DEV_DM=m -CONFIG_BLK_DEV_DRBD=m -CONFIG_BLK_DEV_INITRD=y -CONFIG_BLK_DEV_LOOP=m -CONFIG_BLK_DEV_NBD=m -CONFIG_BLK_DEV_NVME=m -CONFIG_BLK_DEV_PCIESSD_MTIP32XX=m -CONFIG_BLK_DEV_RAM=m -CONFIG_BLK_DEV_RBD=m -CONFIG_BLK_DEV_SD=m -CONFIG_BLK_DEV_SR=m -CONFIG_BLK_DEV_THROTTLING=y -CONFIG_BLK_WBT=y -CONFIG_BNA=m -CONFIG_BNX2X=m -CONFIG_BNXT=m -CONFIG_BONDING=m -CONFIG_BOOTPARAM_SOFTLOCKUP_PANIC=y -CONFIG_BOOT_PRINTK_DELAY=y -CONFIG_BPF_EVENTS=y -CONFIG_BPF_JIT=y -CONFIG_BPF_JIT_ALWAYS_ON=y -CONFIG_BPF_LSM=y -CONFIG_BPF_SYSCALL=y -CONFIG_BRIDGE=m -CONFIG_BRIDGE_EBT_802_3=m -CONFIG_BRIDGE_EBT_AMONG=m -CONFIG_BRIDGE_EBT_ARP=m -CONFIG_BRIDGE_EBT_ARPREPLY=m -CONFIG_BRIDGE_EBT_BROUTE=m -CONFIG_BRIDGE_EBT_DNAT=m -CONFIG_BRIDGE_EBT_IP=m -CONFIG_BRIDGE_EBT_IP6=m -CONFIG_BRIDGE_EBT_LIMIT=m -CONFIG_BRIDGE_EBT_LOG=m -CONFIG_BRIDGE_EBT_MARK=m -CONFIG_BRIDGE_EBT_MARK_T=m -CONFIG_BRIDGE_EBT_NFLOG=m -CONFIG_BRIDGE_EBT_PKTTYPE=m -CONFIG_BRIDGE_EBT_REDIRECT=m -CONFIG_BRIDGE_EBT_SNAT=m -CONFIG_BRIDGE_EBT_STP=m -CONFIG_BRIDGE_EBT_T_FILTER=m -CONFIG_BRIDGE_EBT_T_NAT=m -CONFIG_BRIDGE_EBT_VLAN=m -CONFIG_BRIDGE_NETFILTER=y -CONFIG_BRIDGE_NF_EBTABLES=m -CONFIG_BRIDGE_VLAN_FILTERING=y -CONFIG_BROADCOM_PHY=m -CONFIG_BSD_DISKLABEL=y -CONFIG_BSD_PROCESS_ACCT=y -CONFIG_BSD_PROCESS_ACCT_V3=y -CONFIG_BTRFS_FS=m -CONFIG_BTRFS_FS_POSIX_ACL=y -CONFIG_CACHEFILES=m -CONFIG_CEPH_FS=m -CONFIG_CEPH_FSCACHE=y -CONFIG_CEPH_FS_POSIX_ACL=y -CONFIG_CEPH_LIB_USE_DNS_RESOLVER=y -CONFIG_CFS_BANDWIDTH=y -CONFIG_CGROUP_BPF=y -CONFIG_CGROUP_CPUACCT=y -CONFIG_CGROUP_DEVICE=y -CONFIG_CGROUP_FREEZER=y -CONFIG_CGROUP_HUGETLB=y -CONFIG_CGROUP_NET_PRIO=y -CONFIG_CGROUP_PERF=y -CONFIG_CGROUP_PIDS=y -CONFIG_CHECKPOINT_RESTORE=y -CONFIG_CHELSIO_T1=m -CONFIG_CHELSIO_T1_1G=y -CONFIG_CHELSIO_T3=m -CONFIG_CHELSIO_T4=m -CONFIG_CHELSIO_T4VF=m -CONFIG_CHR_DEV_SG=m -CONFIG_CIFS=m -CONFIG_CIFS_DFS_UPCALL=y -CONFIG_CIFS_FSCACHE=y -CONFIG_CIFS_POSIX=y -CONFIG_CIFS_STATS2=y -CONFIG_CIFS_UPCALL=y -CONFIG_CIFS_XATTR=y -CONFIG_CLS_U32_MARK=y -CONFIG_CLS_U32_PERF=y -CONFIG_CMDLINE="rootflags=rw mount.usrflags=ro" -CONFIG_CNIC=m -# CONFIG_COMPAT_BRK is not set -CONFIG_CPUSETS=y -CONFIG_CPUSETS_V1=y -CONFIG_CPU_FREQ=y -CONFIG_CPU_FREQ_GOV_CONSERVATIVE=m -CONFIG_CPU_FREQ_GOV_ONDEMAND=m -CONFIG_CPU_FREQ_GOV_POWERSAVE=m -CONFIG_CPU_FREQ_GOV_USERSPACE=m -CONFIG_CPU_FREQ_STAT=y -# CONFIG_CROSS_MEMORY_ATTACH is not set -CONFIG_CRYPTO_AES=m -CONFIG_CRYPTO_CTR=m -CONFIG_CRYPTO_CTS=m -CONFIG_CRYPTO_DES=m -CONFIG_CRYPTO_FIPS=y -CONFIG_CRYPTO_GCM=m -CONFIG_CRYPTO_GHASH=m -CONFIG_CRYPTO_HMAC=y -CONFIG_CRYPTO_LIB_AES=m -CONFIG_CRYPTO_LIB_DES=m -CONFIG_CRYPTO_LIB_GF128MUL=m -CONFIG_CRYPTO_LZO=m -# CONFIG_CRYPTO_MANAGER_DISABLE_TESTS is not set -CONFIG_CRYPTO_NULL=m -CONFIG_CRYPTO_NULL2=m -CONFIG_CRYPTO_SHA1=y -CONFIG_CRYPTO_USER_API_HASH=m -CONFIG_CRYPTO_USER_API_SKCIPHER=m -CONFIG_CUSE=m -CONFIG_DCB=y -CONFIG_DEBUG_FS=y -CONFIG_DEBUG_INFO_BTF=y -CONFIG_DEBUG_INFO_DWARF_TOOLCHAIN_DEFAULT=y -CONFIG_DEBUG_SHIRQ=y -# CONFIG_DEVKMEM is not set -CONFIG_DEVTMPFS=y -CONFIG_DEVTMPFS_MOUNT=y -CONFIG_DL2K=m -CONFIG_DLM=m -CONFIG_DMADEVICES=y -CONFIG_DMI_SYSFS=m -CONFIG_DM_CACHE=m -CONFIG_DM_CRYPT=m -CONFIG_DM_MIRROR=m -CONFIG_DM_MULTIPATH=m -CONFIG_DM_MULTIPATH_QL=m -CONFIG_DM_MULTIPATH_ST=m -CONFIG_DM_RAID=m -CONFIG_DM_SNAPSHOT=m -CONFIG_DM_THIN_PROVISIONING=m -CONFIG_DM_UEVENT=y -CONFIG_DM_VERITY=m -CONFIG_DM_ZERO=m -CONFIG_DNS_RESOLVER=y -CONFIG_DRM=y -CONFIG_DRM_FBDEV_EMULATION=y -CONFIG_DRM_QXL=m -CONFIG_DRM_SIMPLEDRM=m -CONFIG_DRM_TTM_HELPER=m -CONFIG_DRM_VIRTIO_GPU=y -CONFIG_DST_CACHE=y -CONFIG_DUMMY=m -CONFIG_DYNAMIC_DEBUG=y -CONFIG_DYNAMIC_FTRACE=y -CONFIG_E100=m -CONFIG_E1000=m -CONFIG_E1000E=m -CONFIG_EDAC=m -# CONFIG_EDAC_LEGACY_SYSFS is not set -CONFIG_EFI=y -CONFIG_EFIVAR_FS=y -CONFIG_EFI_STUB=y -# CONFIG_ENABLE_WARN_DEPRECATED is not set -CONFIG_ENA_ETHERNET=m -CONFIG_ENCLOSURE_SERVICES=m -CONFIG_ENCRYPTED_KEYS=m -CONFIG_EROFS_FS=m -CONFIG_EROFS_FS_XATTR=y -CONFIG_EXPERT=y -CONFIG_EXT4_FS=m -CONFIG_EXT4_FS_POSIX_ACL=y -CONFIG_EXT4_FS_SECURITY=y -CONFIG_FANOTIFY=y -CONFIG_FANOTIFY_ACCESS_PERMISSIONS=y -CONFIG_FAT_DEFAULT_IOCHARSET="ascii" -CONFIG_FB=y -CONFIG_FB_EFI=y -CONFIG_FB_HYPERV=m -CONFIG_FCOE=m -# CONFIG_FIRMWARE_IN_KERNEL is not set -CONFIG_FORCEDETH=m -CONFIG_FORTIFY_SOURCE=y -CONFIG_FRAMEBUFFER_CONSOLE=y -CONFIG_FRAMEBUFFER_CONSOLE_DETECT_PRIMARY=y -CONFIG_FRAMEBUFFER_CONSOLE_ROTATION=y -CONFIG_FSCACHE=m -CONFIG_FSCACHE_STATS=y -CONFIG_FS_DAX=y -CONFIG_FS_ENCRYPTION=y -CONFIG_FTRACE_SYSCALLS=y -CONFIG_FUNCTION_TRACER=y -CONFIG_FUSE_DAX=y -CONFIG_FUSE_FS=m -CONFIG_FUSION=y -CONFIG_FUSION_CTL=m -CONFIG_FUSION_LOGGING=y -CONFIG_FUSION_MAX_SGE=40 -CONFIG_FUSION_SAS=m -CONFIG_FUSION_SPI=m -CONFIG_FW_CFG_SYSFS=m -CONFIG_GACT_PROB=y -CONFIG_GENEVE=m -CONFIG_GPIOLIB=y -CONFIG_GPIO_SYSFS=y -CONFIG_GRO_CELLS=y -CONFIG_GTP=m -CONFIG_HARDENED_USERCOPY=y -CONFIG_HIDRAW=y -CONFIG_HID_A4TECH=m -CONFIG_HID_APPLE=m -CONFIG_HID_BELKIN=m -CONFIG_HID_CHERRY=m -CONFIG_HID_EZKEY=m -CONFIG_HID_HYPERV_MOUSE=m -CONFIG_HID_LOGITECH=m -CONFIG_HID_MICROSOFT=m -CONFIG_HID_MONTEREY=m -CONFIG_HIGH_RES_TIMERS=y -CONFIG_HOTPLUG_PCI=y -CONFIG_HOTPLUG_PCI_ACPI=y -CONFIG_HOTPLUG_PCI_PCIE=y -CONFIG_HP_ILO=m -CONFIG_HUGETLBFS=y -CONFIG_HWMON=m -CONFIG_HW_RANDOM=y -CONFIG_HW_RANDOM_TIMERIOMEM=m -CONFIG_HW_RANDOM_VIRTIO=y -CONFIG_HYPERV=m -CONFIG_HYPERV_BALLOON=m -CONFIG_HYPERV_NET=m -CONFIG_HYPERV_UTILS=m -CONFIG_HZ_1000=y -CONFIG_I2C_AMD756=m -CONFIG_I2C_AMD8111=m -# CONFIG_I2C_COMPAT is not set -CONFIG_I2C_I801=m -CONFIG_I2C_PIIX4=m -CONFIG_I40E=m -CONFIG_I40EVF=m -CONFIG_ICE=m -CONFIG_IFB=m -CONFIG_IGB=m -CONFIG_IGBVF=m -CONFIG_IKCONFIG=y -CONFIG_IKCONFIG_PROC=y -CONFIG_IKHEADERS=m -CONFIG_IMA=y -CONFIG_IMA_APPRAISE=y -CONFIG_IMA_DEFAULT_HASH="sha1" -CONFIG_IMA_DEFAULT_HASH_SHA1=y -CONFIG_IMA_DEFAULT_TEMPLATE="ima-ng" -CONFIG_IMA_LSM_RULES=y -CONFIG_IMA_MEASURE_PCR_IDX=10 -CONFIG_IMA_NG_TEMPLATE=y -CONFIG_IMA_READ_POLICY=y -CONFIG_IMA_WRITE_POLICY=y -CONFIG_INET=y -CONFIG_INET6_AH=m -CONFIG_INET6_ESP=m -CONFIG_INET6_ESP_OFFLOAD=m -CONFIG_INET6_IPCOMP=m -CONFIG_INET_AH=m -CONFIG_INET_DIAG=m -CONFIG_INET_DIAG_DESTROY=y -CONFIG_INET_ESP=m -CONFIG_INET_ESP_OFFLOAD=m -CONFIG_INET_IPCOMP=m -CONFIG_INET_UDP_DIAG=m -CONFIG_INFINIBAND=m -CONFIG_INFINIBAND_CXGB4=m -CONFIG_INFINIBAND_IPOIB=m -CONFIG_INFINIBAND_IPOIB_CM=y -CONFIG_INFINIBAND_IPOIB_DEBUG_DATA=y -CONFIG_INFINIBAND_ISER=m -CONFIG_INFINIBAND_MTHCA=m -CONFIG_INFINIBAND_OCRDMA=m -CONFIG_INFINIBAND_SRP=m -CONFIG_INFINIBAND_USER_MAD=m -CONFIG_INITRAMFS_COMPRESSION_XZ=y -CONFIG_INIT_STACK_NONE=y -CONFIG_INPUT_EVDEV=m -CONFIG_INPUT_MISC=y -CONFIG_INPUT_MOUSEDEV=m -# CONFIG_INPUT_MOUSEDEV_PSAUX is not set -CONFIG_IOSCHED_BFQ=y -CONFIG_IO_STRICT_DEVMEM=y -CONFIG_IP6_NF_FILTER=m -CONFIG_IP6_NF_IPTABLES=m -CONFIG_IP6_NF_MANGLE=m -CONFIG_IP6_NF_MATCH_AH=m -CONFIG_IP6_NF_MATCH_EUI64=m -CONFIG_IP6_NF_MATCH_FRAG=m -CONFIG_IP6_NF_MATCH_HL=m -CONFIG_IP6_NF_MATCH_IPV6HEADER=m -CONFIG_IP6_NF_MATCH_MH=m -CONFIG_IP6_NF_MATCH_OPTS=m -CONFIG_IP6_NF_MATCH_RPFILTER=m -CONFIG_IP6_NF_MATCH_RT=m -CONFIG_IP6_NF_MATCH_SRH=m -CONFIG_IP6_NF_NAT=m -CONFIG_IP6_NF_RAW=m -CONFIG_IP6_NF_SECURITY=m -CONFIG_IP6_NF_TARGET_HL=m -CONFIG_IP6_NF_TARGET_MASQUERADE=m -CONFIG_IP6_NF_TARGET_NPT=m -CONFIG_IP6_NF_TARGET_REJECT=m -CONFIG_IP6_NF_TARGET_SYNPROXY=m -CONFIG_IPMI_DEVICE_INTERFACE=m -CONFIG_IPMI_HANDLER=m -CONFIG_IPMI_PANIC_EVENT=y -CONFIG_IPMI_PANIC_STRING=y -CONFIG_IPMI_POWEROFF=m -CONFIG_IPMI_SI=m -CONFIG_IPMI_SSIF=m -CONFIG_IPMI_WATCHDOG=m -CONFIG_IPV6_GRE=m -CONFIG_IPV6_MIP6=m -CONFIG_IPV6_MROUTE=y -CONFIG_IPV6_MROUTE_MULTIPLE_TABLES=y -CONFIG_IPV6_MULTIPLE_TABLES=y -CONFIG_IPV6_OPTIMISTIC_DAD=y -CONFIG_IPV6_PIMSM_V2=y -CONFIG_IPV6_ROUTER_PREF=y -CONFIG_IPV6_ROUTE_INFO=y -CONFIG_IPV6_SIT=m -CONFIG_IPV6_SIT_6RD=y -CONFIG_IPV6_SUBTREES=y -CONFIG_IPV6_VTI=m -CONFIG_IPVLAN=m -CONFIG_IP_ADVANCED_ROUTER=y -CONFIG_IP_DCCP=m -CONFIG_IP_FIB_TRIE_STATS=y -CONFIG_IP_MROUTE=y -CONFIG_IP_MROUTE_MULTIPLE_TABLES=y -CONFIG_IP_MULTICAST=y -CONFIG_IP_MULTIPLE_TABLES=y -CONFIG_IP_NF_ARPFILTER=m -CONFIG_IP_NF_ARPTABLES=m -CONFIG_IP_NF_ARP_MANGLE=m -CONFIG_IP_NF_FILTER=m -CONFIG_IP_NF_IPTABLES=y -CONFIG_IP_NF_MANGLE=m -CONFIG_IP_NF_MATCH_AH=m -CONFIG_IP_NF_MATCH_ECN=m -CONFIG_IP_NF_MATCH_RPFILTER=m -CONFIG_IP_NF_MATCH_TTL=m -CONFIG_IP_NF_NAT=m -CONFIG_IP_NF_RAW=m -CONFIG_IP_NF_SECURITY=m -CONFIG_IP_NF_TARGET_ECN=m -CONFIG_IP_NF_TARGET_MASQUERADE=m -CONFIG_IP_NF_TARGET_NETMAP=m -CONFIG_IP_NF_TARGET_REDIRECT=m -CONFIG_IP_NF_TARGET_REJECT=m -CONFIG_IP_NF_TARGET_SYNPROXY=m -CONFIG_IP_NF_TARGET_TTL=m -CONFIG_IP_PIMSM_V1=y -CONFIG_IP_PIMSM_V2=y -# CONFIG_IP_PNP is not set -CONFIG_IP_ROUTE_MULTIPATH=y -CONFIG_IP_ROUTE_VERBOSE=y -CONFIG_IP_SET=m -CONFIG_IP_SET_BITMAP_IP=m -CONFIG_IP_SET_BITMAP_IPMAC=m -CONFIG_IP_SET_BITMAP_PORT=m -CONFIG_IP_SET_HASH_IP=m -CONFIG_IP_SET_HASH_IPMARK=m -CONFIG_IP_SET_HASH_IPPORT=m -CONFIG_IP_SET_HASH_IPPORTIP=m -CONFIG_IP_SET_HASH_IPPORTNET=m -CONFIG_IP_SET_HASH_MAC=m -CONFIG_IP_SET_HASH_NET=m -CONFIG_IP_SET_HASH_NETIFACE=m -CONFIG_IP_SET_HASH_NETNET=m -CONFIG_IP_SET_HASH_NETPORT=m -CONFIG_IP_SET_HASH_NETPORTNET=m -CONFIG_IP_SET_LIST_SET=m -CONFIG_IP_VS=m -CONFIG_IP_VS_DH=m -CONFIG_IP_VS_FO=m -CONFIG_IP_VS_FTP=m -CONFIG_IP_VS_IPV6=y -CONFIG_IP_VS_LBLC=m -CONFIG_IP_VS_LBLCR=m -CONFIG_IP_VS_LC=m -CONFIG_IP_VS_NQ=m -CONFIG_IP_VS_PE_SIP=m -CONFIG_IP_VS_PROTO_AH=y -CONFIG_IP_VS_PROTO_ESP=y -CONFIG_IP_VS_PROTO_SCTP=y -CONFIG_IP_VS_PROTO_TCP=y -CONFIG_IP_VS_PROTO_UDP=y -CONFIG_IP_VS_RR=m -CONFIG_IP_VS_SED=m -CONFIG_IP_VS_SH=m -CONFIG_IP_VS_WLC=m -CONFIG_IP_VS_WRR=m -CONFIG_IRQ_TIME_ACCOUNTING=y -CONFIG_ISCSI_BOOT_SYSFS=m -CONFIG_ISCSI_TARGET=m -CONFIG_ISCSI_TCP=m -CONFIG_ISO9660_FS=m -CONFIG_IXGBE=m -CONFIG_IXGBEVF=m -CONFIG_IXGBEVF_IPSEC=y -CONFIG_IXGBE_IPSEC=y -CONFIG_JME=m -CONFIG_JOLIET=y -CONFIG_JUMP_LABEL=y -CONFIG_KALLSYMS_ALL=y -CONFIG_KEXEC=y -CONFIG_KEYS=y -CONFIG_KEY_DH_OPERATIONS=y -CONFIG_KPROBES=y -CONFIG_KPROBE_EVENTS=y -CONFIG_KRETPROBES=y -CONFIG_KSM=y -CONFIG_LATENCYTOP=y -# CONFIG_LCD_CLASS_DEVICE is not set -CONFIG_LEDS_CLASS=y -# CONFIG_LEGACY_PTYS is not set -CONFIG_LIBFC=m -CONFIG_LIBFCOE=m -# CONFIG_LOCALVERSION_AUTO is not set -CONFIG_LOCK_DOWN_IN_EFI_SECURE_BOOT=y -CONFIG_LOG_BUF_SHIFT=18 -CONFIG_LOOPBACK_TARGET=m -CONFIG_LSM="landlock,lockdown,yama,loadpin,safesetid,integrity,selinux,smack,tomoyo,apparmor" -CONFIG_LWTUNNEL=y -CONFIG_LWTUNNEL_BPF=y -CONFIG_MACSEC=m -CONFIG_MACVLAN=m -CONFIG_MACVTAP=m -CONFIG_MAGIC_SYSRQ=y -CONFIG_MARVELL_PHY=m -CONFIG_MAX_RAW_DEVS=8192 -CONFIG_MD=y -CONFIG_MD_LINEAR=m -CONFIG_MD_RAID0=m -CONFIG_MEGARAID_MAILBOX=m -CONFIG_MEGARAID_MM=m -CONFIG_MEGARAID_NEWGEN=y -CONFIG_MEGARAID_SAS=m -CONFIG_MEMCG=y -CONFIG_MEMCG_V1=y -CONFIG_MEMORY_HOTPLUG=y -CONFIG_MEMORY_HOTREMOVE=y -CONFIG_MEMTEST=y -CONFIG_MICROSOFT_MANA=m -CONFIG_MINIX_SUBPARTITION=y -# CONFIG_MLX4_DEBUG is not set -CONFIG_MLX4_EN=m -CONFIG_MLX4_INFINIBAND=m -CONFIG_MLX5_BRIDGE=y -CONFIG_MLX5_CLS_ACT=y -CONFIG_MLX5_CORE=m -CONFIG_MLX5_CORE_EN=y -CONFIG_MLX5_CORE_EN_DCB=y -CONFIG_MLX5_EN_ARFS=y -CONFIG_MLX5_EN_IPSEC=y -CONFIG_MLX5_EN_RXNFC=y -CONFIG_MLX5_EN_TLS=y -CONFIG_MLX5_ESWITCH=y -CONFIG_MLX5_INFINIBAND=m -CONFIG_MLX5_MACSEC=y -CONFIG_MLX5_MPFS=y -CONFIG_MLX5_SF=y -CONFIG_MLX5_SF_MANAGER=y -CONFIG_MLX5_SW_STEERING=y -CONFIG_MLX5_TC_CT=y -CONFIG_MLX5_TC_SAMPLE=y -CONFIG_MLX5_VDPA=y -CONFIG_MLX5_VDPA_NET=m -CONFIG_MLX5_VFIO_PCI=m -CONFIG_MMC=m -CONFIG_MMC_BLOCK=m -CONFIG_MMC_BLOCK_MINORS=16 -# CONFIG_MMC_RICOH_MMC is not set -CONFIG_MMC_SDHCI=m -CONFIG_MMC_SDHCI_PCI=m -CONFIG_MODULES=y -CONFIG_MODULE_COMPRESS=y -CONFIG_MODULE_COMPRESS_XZ=y -CONFIG_MODULE_SIG=y -CONFIG_MODULE_SIG_KEY="${MODULE_SIGNING_KEY_DIR}/certs/modules.pem" -CONFIG_MODULE_SIG_SHA256=y -CONFIG_MODULE_UNLOAD=y -CONFIG_MOUSE_PS2=m -# CONFIG_MOUSE_PS2_ALPS is not set -# CONFIG_MOUSE_PS2_CYPRESS is not set -# CONFIG_MOUSE_PS2_FOCALTECH is not set -# CONFIG_MOUSE_PS2_LOGIPS2PP is not set -# CONFIG_MOUSE_PS2_SYNAPTICS is not set -# CONFIG_MOUSE_PS2_TRACKPOINT is not set -CONFIG_MPLS_IPTUNNEL=m -CONFIG_MPLS_ROUTING=m -CONFIG_MSDOS_FS=m -CONFIG_MTD=m -CONFIG_MYRI10GE=m -CONFIG_NAMESPACES=y -CONFIG_NATSEMI=m -CONFIG_NET=y -CONFIG_NETCONSOLE=m -CONFIG_NETCONSOLE_DYNAMIC=y -CONFIG_NETDEVICES=y -CONFIG_NETFILTER=y -CONFIG_NETFILTER_ADVANCED=y -CONFIG_NETFILTER_NETLINK_GLUE_CT=y -CONFIG_NETFILTER_NETLINK_QUEUE=m -CONFIG_NETFILTER_XTABLES=y -CONFIG_NETFILTER_XT_MATCH_ADDRTYPE=m -CONFIG_NETFILTER_XT_MATCH_BPF=m -CONFIG_NETFILTER_XT_MATCH_CGROUP=m -CONFIG_NETFILTER_XT_MATCH_CLUSTER=m -CONFIG_NETFILTER_XT_MATCH_COMMENT=m -CONFIG_NETFILTER_XT_MATCH_CONNBYTES=m -CONFIG_NETFILTER_XT_MATCH_CONNLABEL=m -CONFIG_NETFILTER_XT_MATCH_CONNLIMIT=m -CONFIG_NETFILTER_XT_MATCH_CONNMARK=m -CONFIG_NETFILTER_XT_MATCH_CONNTRACK=m -CONFIG_NETFILTER_XT_MATCH_CPU=m -CONFIG_NETFILTER_XT_MATCH_DEVGROUP=m -CONFIG_NETFILTER_XT_MATCH_DSCP=m -CONFIG_NETFILTER_XT_MATCH_ESP=m -CONFIG_NETFILTER_XT_MATCH_HASHLIMIT=m -CONFIG_NETFILTER_XT_MATCH_HELPER=m -CONFIG_NETFILTER_XT_MATCH_IPCOMP=m -CONFIG_NETFILTER_XT_MATCH_IPRANGE=m -CONFIG_NETFILTER_XT_MATCH_IPVS=m -CONFIG_NETFILTER_XT_MATCH_L2TP=m -CONFIG_NETFILTER_XT_MATCH_LENGTH=m -CONFIG_NETFILTER_XT_MATCH_LIMIT=m -CONFIG_NETFILTER_XT_MATCH_MAC=m -CONFIG_NETFILTER_XT_MATCH_MARK=m -CONFIG_NETFILTER_XT_MATCH_MULTIPORT=m -CONFIG_NETFILTER_XT_MATCH_NFACCT=m -CONFIG_NETFILTER_XT_MATCH_OSF=m -CONFIG_NETFILTER_XT_MATCH_OWNER=m -CONFIG_NETFILTER_XT_MATCH_PHYSDEV=m -CONFIG_NETFILTER_XT_MATCH_PKTTYPE=m -CONFIG_NETFILTER_XT_MATCH_POLICY=m -CONFIG_NETFILTER_XT_MATCH_QUOTA=m -CONFIG_NETFILTER_XT_MATCH_RATEEST=m -CONFIG_NETFILTER_XT_MATCH_REALM=m -CONFIG_NETFILTER_XT_MATCH_RECENT=m -CONFIG_NETFILTER_XT_MATCH_SOCKET=m -CONFIG_NETFILTER_XT_MATCH_STATE=m -CONFIG_NETFILTER_XT_MATCH_STATISTIC=m -CONFIG_NETFILTER_XT_MATCH_STRING=m -CONFIG_NETFILTER_XT_MATCH_TCPMSS=m -CONFIG_NETFILTER_XT_MATCH_TIME=m -CONFIG_NETFILTER_XT_MATCH_U32=m -CONFIG_NETFILTER_XT_SET=m -CONFIG_NETFILTER_XT_TARGET_CHECKSUM=m -CONFIG_NETFILTER_XT_TARGET_CLASSIFY=m -CONFIG_NETFILTER_XT_TARGET_CONNMARK=m -CONFIG_NETFILTER_XT_TARGET_CONNSECMARK=m -CONFIG_NETFILTER_XT_TARGET_CT=m -CONFIG_NETFILTER_XT_TARGET_DSCP=m -CONFIG_NETFILTER_XT_TARGET_HMARK=m -CONFIG_NETFILTER_XT_TARGET_IDLETIMER=m -CONFIG_NETFILTER_XT_TARGET_LOG=m -CONFIG_NETFILTER_XT_TARGET_MARK=m -CONFIG_NETFILTER_XT_TARGET_NFLOG=m -CONFIG_NETFILTER_XT_TARGET_NFQUEUE=m -CONFIG_NETFILTER_XT_TARGET_SECMARK=m -CONFIG_NETFILTER_XT_TARGET_TCPMSS=m -CONFIG_NETFILTER_XT_TARGET_TCPOPTSTRIP=m -CONFIG_NETFILTER_XT_TARGET_TEE=m -CONFIG_NETFILTER_XT_TARGET_TPROXY=m -CONFIG_NETFILTER_XT_TARGET_TRACE=m -CONFIG_NETKIT=y -CONFIG_NETLINK_DIAG=m -CONFIG_NETWORK_PHY_TIMESTAMPING=y -CONFIG_NETXEN_NIC=m -CONFIG_NET_9P=m -# CONFIG_NET_9P_DEBUG is not set -CONFIG_NET_9P_RDMA=m -CONFIG_NET_9P_VIRTIO=m -CONFIG_NET_ACT_BPF=m -CONFIG_NET_ACT_CONNMARK=m -CONFIG_NET_ACT_CSUM=m -CONFIG_NET_ACT_CT=m -CONFIG_NET_ACT_CTINFO=m -CONFIG_NET_ACT_GACT=m -CONFIG_NET_ACT_GATE=m -CONFIG_NET_ACT_IFE=m -CONFIG_NET_ACT_MIRRED=m -CONFIG_NET_ACT_MPLS=m -CONFIG_NET_ACT_NAT=m -CONFIG_NET_ACT_PEDIT=m -CONFIG_NET_ACT_POLICE=m -CONFIG_NET_ACT_SAMPLE=m -CONFIG_NET_ACT_SIMP=m -CONFIG_NET_ACT_SKBEDIT=m -CONFIG_NET_ACT_SKBMOD=m -CONFIG_NET_ACT_TUNNEL_KEY=m -CONFIG_NET_ACT_VLAN=m -# CONFIG_NET_CADENCE is not set -CONFIG_NET_CLS_ACT=y -CONFIG_NET_CLS_BASIC=m -CONFIG_NET_CLS_BPF=m -CONFIG_NET_CLS_CGROUP=m -CONFIG_NET_CLS_FLOW=m -CONFIG_NET_CLS_FLOWER=m -CONFIG_NET_CLS_FW=m -CONFIG_NET_CLS_ROUTE4=m -CONFIG_NET_CLS_U32=m -CONFIG_NET_EMATCH=y -CONFIG_NET_EMATCH_CMP=m -CONFIG_NET_EMATCH_IPSET=m -CONFIG_NET_EMATCH_META=m -CONFIG_NET_EMATCH_NBYTE=m -CONFIG_NET_EMATCH_TEXT=m -CONFIG_NET_EMATCH_U32=m -CONFIG_NET_FOU_IP_TUNNELS=y -CONFIG_NET_IFE=m -CONFIG_NET_IPGRE=m -CONFIG_NET_IPGRE_BROADCAST=y -CONFIG_NET_IPGRE_DEMUX=m -CONFIG_NET_IPIP=m -CONFIG_NET_IPVTI=m -CONFIG_NET_KEY=m -CONFIG_NET_L3_MASTER_DEV=y -# CONFIG_NET_PACKET_ENGINE is not set -CONFIG_NET_SCHED=y -CONFIG_NET_SCH_CHOKE=m -CONFIG_NET_SCH_CODEL=m -CONFIG_NET_SCH_DRR=m -CONFIG_NET_SCH_FQ=m -CONFIG_NET_SCH_FQ_CODEL=m -CONFIG_NET_SCH_GRED=m -CONFIG_NET_SCH_HFSC=m -CONFIG_NET_SCH_HHF=m -CONFIG_NET_SCH_HTB=m -CONFIG_NET_SCH_INGRESS=m -CONFIG_NET_SCH_MQPRIO=m -CONFIG_NET_SCH_MULTIQ=m -CONFIG_NET_SCH_NETEM=m -CONFIG_NET_SCH_PIE=m -CONFIG_NET_SCH_PLUG=m -CONFIG_NET_SCH_PRIO=m -CONFIG_NET_SCH_QFQ=m -CONFIG_NET_SCH_RED=m -CONFIG_NET_SCH_SFB=m -CONFIG_NET_SCH_SFQ=m -CONFIG_NET_SCH_TBF=m -CONFIG_NET_SCH_TEQL=m -CONFIG_NET_SWITCHDEV=y -CONFIG_NET_TC_SKB_EXT=y -CONFIG_NET_TULIP=y -# CONFIG_NET_VENDOR_3COM is not set -# CONFIG_NET_VENDOR_ADAPTEC is not set -# CONFIG_NET_VENDOR_AGERE is not set -# CONFIG_NET_VENDOR_ARC is not set -# CONFIG_NET_VENDOR_MICREL is not set -CONFIG_NET_VENDOR_NATSEMI=y -# CONFIG_NET_VENDOR_OKI is not set -# CONFIG_NET_VENDOR_QUALCOMM is not set -# CONFIG_NET_VENDOR_RDC is not set -# CONFIG_NET_VENDOR_ROCKER is not set -# CONFIG_NET_VENDOR_SAMSUNG is not set -# CONFIG_NET_VENDOR_SEEQ is not set -# CONFIG_NET_VENDOR_SILAN is not set -# CONFIG_NET_VENDOR_SIS is not set -# CONFIG_NET_VENDOR_SMSC is not set -# CONFIG_NET_VENDOR_STMICRO is not set -# CONFIG_NET_VENDOR_SUN is not set -# CONFIG_NET_VENDOR_TEHUTI is not set -# CONFIG_NET_VENDOR_TI is not set -CONFIG_NET_VENDOR_VIA=y -# CONFIG_NET_VENDOR_WIZNET is not set -CONFIG_NET_VRF=y -CONFIG_NEW_LEDS=y -CONFIG_NFSD=m -CONFIG_NFSD_V3_ACL=y -CONFIG_NFSD_V4=y -CONFIG_NFS_FS=m -CONFIG_NFS_FSCACHE=y -CONFIG_NFS_V3_ACL=y -CONFIG_NFS_V4=m -CONFIG_NFS_V4_1=y -CONFIG_NFS_V4_2=y -CONFIG_NFS_V4_2_READ_PLUS=n -CONFIG_NFT_BRIDGE_META=m -CONFIG_NFT_BRIDGE_REJECT=m -CONFIG_NFT_COMPAT=m -CONFIG_NFT_CT=m -CONFIG_NFT_DUP_IPV4=m -CONFIG_NFT_DUP_IPV6=m -CONFIG_NFT_DUP_NETDEV=m -CONFIG_NFT_FIB=m -CONFIG_NFT_FIB_INET=m -CONFIG_NFT_FIB_IPV4=m -CONFIG_NFT_FIB_IPV6=m -CONFIG_NFT_FIB_NETDEV=m -CONFIG_NFT_FLOW_OFFLOAD=m -CONFIG_NFT_FWD_NETDEV=m -CONFIG_NFT_HASH=m -CONFIG_NFT_LIMIT=m -CONFIG_NFT_LOG=m -CONFIG_NFT_MASQ=m -CONFIG_NFT_NAT=m -CONFIG_NFT_NUMGEN=m -CONFIG_NFT_QUEUE=m -CONFIG_NFT_QUOTA=m -CONFIG_NFT_REDIR=m -CONFIG_NFT_REJECT=m -CONFIG_NFT_TUNNEL=m -CONFIG_NFT_XFRM=m -CONFIG_NF_CONNTRACK=m -CONFIG_NF_CONNTRACK_AMANDA=m -CONFIG_NF_CONNTRACK_BRIDGE=m -CONFIG_NF_CONNTRACK_EVENTS=y -CONFIG_NF_CONNTRACK_FTP=m -CONFIG_NF_CONNTRACK_H323=m -CONFIG_NF_CONNTRACK_IRC=m -CONFIG_NF_CONNTRACK_NETBIOS_NS=m -CONFIG_NF_CONNTRACK_PPTP=m -# CONFIG_NF_CONNTRACK_PROC_COMPAT is not set -CONFIG_NF_CONNTRACK_SANE=m -CONFIG_NF_CONNTRACK_SECMARK=y -CONFIG_NF_CONNTRACK_SIP=m -CONFIG_NF_CONNTRACK_SNMP=m -CONFIG_NF_CONNTRACK_TFTP=m -CONFIG_NF_CONNTRACK_TIMEOUT=y -CONFIG_NF_CONNTRACK_TIMESTAMP=y -CONFIG_NF_CONNTRACK_ZONES=y -CONFIG_NF_CT_NETLINK=m -CONFIG_NF_CT_NETLINK_HELPER=m -CONFIG_NF_CT_NETLINK_TIMEOUT=m -CONFIG_NF_CT_PROTO_UDPLITE=y -CONFIG_NF_FLOW_TABLE=m -CONFIG_NF_LOG_ARP=m -CONFIG_NF_SOCKET_IPV4=m -CONFIG_NF_SOCKET_IPV6=m -CONFIG_NF_TABLES=m -CONFIG_NF_TABLES_ARP=y -CONFIG_NF_TABLES_BRIDGE=y -CONFIG_NF_TABLES_INET=y -CONFIG_NF_TABLES_IPV4=y -CONFIG_NF_TABLES_IPV6=y -CONFIG_NF_TABLES_NETDEV=y -CONFIG_NLS_ASCII=m -CONFIG_NLS_CODEPAGE_437=m -CONFIG_NLS_DEFAULT="utf8" -CONFIG_NLS_UTF8=m -CONFIG_NODES_SHIFT=7 -CONFIG_NO_HZ=y -CONFIG_NR_CPUS=512 -CONFIG_NUMA=y -CONFIG_NUMA_BALANCING=y -CONFIG_NVME_MULTIPATH=y -CONFIG_NVME_RDMA=m -CONFIG_NVME_TARGET=m -CONFIG_NVME_TARGET_LOOP=m -CONFIG_NVME_TARGET_RDMA=m -CONFIG_NVME_TARGET_TCP=m -CONFIG_NVME_TCP=m -CONFIG_OPENVSWITCH=m -CONFIG_OVERLAY_FS=m -CONFIG_OVERLAY_FS_METACOPY=y -CONFIG_OVERLAY_FS_REDIRECT_DIR=y -CONFIG_PACKET=y -CONFIG_PACKET_DIAG=m -CONFIG_PANIC_ON_OOPS=y -CONFIG_PANIC_TIMEOUT=60 -CONFIG_PARAVIRT=y -CONFIG_PARAVIRT_TIME_ACCOUNTING=y -CONFIG_PARTITION_ADVANCED=y -CONFIG_PATA_JMICRON=m -CONFIG_PATA_VIA=m -CONFIG_PCI=y -CONFIG_PCIEAER=y -CONFIG_PCIEPORTBUS=y -CONFIG_PCIE_ECRC=y -CONFIG_PCI_HYPERV=m -CONFIG_PCI_IOV=y -CONFIG_PCI_MSI=y -CONFIG_PCNET32=m -CONFIG_PDC_ADMA=m -CONFIG_PLDMFW=y -CONFIG_POSIX_MQUEUE=y -CONFIG_POWER_SUPPLY=y -CONFIG_PPP=m -CONFIG_PPPOE=m -CONFIG_PPP_ASYNC=m -CONFIG_PPP_BSDCOMP=m -CONFIG_PPP_DEFLATE=m -CONFIG_PPP_FILTER=y -CONFIG_PPP_MPPE=m -CONFIG_PPP_MULTILINK=y -CONFIG_PPP_SYNC_TTY=m -CONFIG_PRINTK_TIME=y -# CONFIG_PRINT_QUOTA_WARNING is not set -CONFIG_PROC_KCORE=y -CONFIG_PROFILING=y -CONFIG_PSAMPLE=m -CONFIG_PSI=y -# CONFIG_PSI_DEFAULT_DISABLED is not set -CONFIG_PTP_1588_CLOCK=m -CONFIG_PTP_1588_CLOCK_KVM=m -CONFIG_QED=m -CONFIG_QEDE=m -CONFIG_QEDF=m -CONFIG_QEDI=m -CONFIG_QED_FCOE=y -CONFIG_QED_ISCSI=y -CONFIG_QED_LL2=y -CONFIG_QED_OOO=y -CONFIG_QFMT_V2=m -CONFIG_QUOTA=y -CONFIG_QUOTA_NETLINK_INTERFACE=y -CONFIG_R8169=m -CONFIG_RANDOMIZE_BASE=y -CONFIG_RCU_CPU_STALL_TIMEOUT=60 -# CONFIG_RC_CORE is not set -CONFIG_RDS=m -CONFIG_RDS_RDMA=m -CONFIG_RDS_TCP=m -CONFIG_REALTEK_PHY=m -CONFIG_REGULATOR=y -CONFIG_REGULATOR_FIXED_VOLTAGE=y -# CONFIG_RPCSEC_GSS_KRB5 requires some older crypto modules -CONFIG_RPCSEC_GSS_KRB5=m -CONFIG_RTC_CLASS=y -CONFIG_RT_GROUP_SCHED=y -CONFIG_S2IO=m -CONFIG_SATA_AHCI=m -CONFIG_SATA_MV=m -CONFIG_SATA_NV=m -CONFIG_SATA_PROMISE=m -CONFIG_SATA_QSTOR=m -CONFIG_SATA_SIL=m -CONFIG_SATA_SIL24=m -CONFIG_SATA_SIS=m -CONFIG_SATA_SVW=m -CONFIG_SATA_SX4=m -CONFIG_SATA_VIA=m -CONFIG_SATA_VITESSE=m -CONFIG_SCHED_AUTOGROUP=y -CONFIG_SCHED_CLASS_EXT=y -CONFIG_SCHED_SMT=y -CONFIG_SCHED_STACK_END_CHECK=y -CONFIG_SCSI_3W_9XXX=m -CONFIG_SCSI_3W_SAS=m -CONFIG_SCSI_AACRAID=m -CONFIG_SCSI_AIC79XX=m -CONFIG_SCSI_ARCMSR=m -CONFIG_SCSI_BNX2X_FCOE=m -CONFIG_SCSI_CONSTANTS=y -CONFIG_SCSI_DH=y -CONFIG_SCSI_DH_ALUA=m -CONFIG_SCSI_DH_EMC=m -CONFIG_SCSI_DH_RDAC=m -CONFIG_SCSI_ENCLOSURE=m -CONFIG_SCSI_FC_ATTRS=m -CONFIG_SCSI_HPSA=m -CONFIG_SCSI_LOGGING=y -CONFIG_SCSI_LPFC=m -CONFIG_SCSI_MPI3MR=m -CONFIG_SCSI_MPT2SAS=m -CONFIG_SCSI_MVSAS=m -# CONFIG_SCSI_MVSAS_DEBUG is not set -CONFIG_SCSI_MVSAS_TASKLET=y -CONFIG_SCSI_QLA_FC=m -CONFIG_SCSI_QLA_ISCSI=m -CONFIG_SCSI_SAS_ATA=y -CONFIG_SCSI_SCAN_ASYNC=y -CONFIG_SCSI_SMARTPQI=m -CONFIG_SCSI_SYM53C8XX_2=m -CONFIG_SCSI_VIRTIO=m -CONFIG_SCTP_COOKIE_HMAC_SHA1=y -CONFIG_SECURITY=y -CONFIG_SECURITY_LANDLOCK=y -CONFIG_SECURITY_LOCKDOWN_LSM=y -CONFIG_SECURITY_LOCKDOWN_LSM_EARLY=y -CONFIG_SECURITY_NETWORK=y -CONFIG_SECURITY_NETWORK_XFRM=y -CONFIG_SECURITY_SELINUX=y -CONFIG_SECURITY_SELINUX_BOOTPARAM=y -CONFIG_SERIAL_8250=y -CONFIG_SERIAL_8250_CONSOLE=y -CONFIG_SERIAL_8250_EXTENDED=y -CONFIG_SERIAL_8250_MANY_PORTS=y -CONFIG_SERIAL_8250_NR_UARTS=32 -CONFIG_SERIAL_8250_RSA=y -CONFIG_SERIAL_8250_SHARE_IRQ=y -# CONFIG_SERIO_SERPORT is not set -CONFIG_SFC=m -CONFIG_SIGNED_PE_FILE_VERIFICATION=y -CONFIG_SKGE=m -CONFIG_SKY2=m -CONFIG_SLAB_FREELIST_HARDENED=y -CONFIG_SLAB_FREELIST_RANDOM=y -CONFIG_SMP=y -CONFIG_SOCK_VALIDATE_XMIT=y -CONFIG_SOFTLOCKUP_DETECTOR=y -CONFIG_SOFT_WATCHDOG=m -CONFIG_SOLARIS_X86_PARTITION=y -CONFIG_SQUASHFS=m -CONFIG_SQUASHFS_LZ4=y -CONFIG_SQUASHFS_LZO=y -CONFIG_SQUASHFS_XATTR=y -CONFIG_SQUASHFS_XZ=y -CONFIG_SQUASHFS_ZSTD=y -CONFIG_STACKPROTECTOR_STRONG=y -CONFIG_STRICT_DEVMEM=y -CONFIG_STRIP_ASM_SYMS=y -CONFIG_SUNDANCE=m -CONFIG_SUNRPC_DEBUG=y -CONFIG_SYSFS=y -CONFIG_SYSVIPC=y -CONFIG_TARGET_CORE=m -CONFIG_TASKSTATS=y -CONFIG_TASK_IO_ACCOUNTING=y -CONFIG_TASK_XACCT=y -CONFIG_TCG_ATMEL=m -CONFIG_TCG_TIS=m -CONFIG_TCG_TIS_I2C_ATMEL=m -CONFIG_TCG_TIS_I2C_INFINEON=m -CONFIG_TCG_TIS_I2C_NUVOTON=m -CONFIG_TCG_VTPM_PROXY=m -CONFIG_TCG_XEN=m -CONFIG_TCM_FILEIO=m -CONFIG_TCM_IBLOCK=m -CONFIG_TCM_PSCSI=m -CONFIG_TCM_USER2=m -CONFIG_TCP_CONG_ADVANCED=y -CONFIG_TCP_CONG_BBR=m -# CONFIG_TCP_CONG_BIC is not set -# CONFIG_TCP_CONG_HTCP is not set -CONFIG_TCP_CONG_HYBLA=m -# CONFIG_TCP_CONG_WESTWOOD is not set -CONFIG_TCP_MD5SIG=y -CONFIG_TIGON3=m -CONFIG_TLS=m -CONFIG_TLS_DEVICE=y -CONFIG_TLS_TOE=y -CONFIG_TMPFS=y -CONFIG_TMPFS_POSIX_ACL=y -CONFIG_TRANSPARENT_HUGEPAGE=y -CONFIG_TRUSTED_KEYS=m -CONFIG_TTY_PRINTK=y -CONFIG_TULIP=m -CONFIG_TULIP_MMIO=y -CONFIG_TULIP_NAPI=y -CONFIG_TUN=m -CONFIG_UDF_FS=m -# CONFIG_UEVENT_HELPER is not set -CONFIG_UNIX=y -CONFIG_UNIXWARE_DISKLABEL=y -CONFIG_UNIX_DIAG=m -CONFIG_USB=m -CONFIG_USB_ACM=m -CONFIG_USB_EHCI_HCD=m -CONFIG_USB_HIDDEV=y -CONFIG_USB_NET_AX8817X=m -CONFIG_USB_NET_DRIVERS=m -CONFIG_USB_OHCI_HCD=m -CONFIG_USB_RTL8152=m -CONFIG_USB_SERIAL=m -CONFIG_USB_SERIAL_CP210X=m -CONFIG_USB_SERIAL_FTDI_SIO=m -CONFIG_USB_SERIAL_GENERIC=y -CONFIG_USB_SERIAL_PL2303=m -CONFIG_USB_STORAGE=m -CONFIG_USB_UAS=m -CONFIG_USB_UHCI_HCD=m -CONFIG_USB_USBNET=m -CONFIG_USB_XHCI_HCD=m -CONFIG_USER_NS=y -CONFIG_VDPA=m -CONFIG_VETH=m -CONFIG_VFAT_FS=m -CONFIG_VFIO=m -CONFIG_VFIO_PCI=m -CONFIG_VFIO_PCI_CORE=m -CONFIG_VFIO_PCI_INTX=y -CONFIG_VFIO_PCI_MMAP=y -CONFIG_VHOST_IOTLB=m -CONFIG_VHOST_NET=m -CONFIG_VHOST_RING=m -CONFIG_VIA_RHINE=m -CONFIG_VIA_RHINE_MMIO=y -CONFIG_VIRTIO_BALLOON=m -CONFIG_VIRTIO_BLK=m -CONFIG_VIRTIO_CONSOLE=y -CONFIG_VIRTIO_FS=m -CONFIG_VIRTIO_INPUT=m -CONFIG_VIRTIO_MMIO=y -CONFIG_VIRTIO_MMIO_CMDLINE_DEVICES=y -CONFIG_VIRTIO_NET=m -CONFIG_VIRTIO_PCI=y -CONFIG_VIRTIO_VSOCKETS=m -CONFIG_VIRT_DRIVERS=y -CONFIG_VLAN_8021Q=m -CONFIG_VLAN_8021Q_GVRP=y -CONFIG_VLAN_8021Q_MVRP=y -CONFIG_VSOCKETS=m -CONFIG_VXLAN=m -CONFIG_WATCHDOG=y -CONFIG_WIREGUARD=m -# CONFIG_WIRELESS is not set -# CONFIG_WLAN is not set -CONFIG_XEN=y -CONFIG_XENFS=m -CONFIG_XEN_BLKDEV_BACKEND=m -CONFIG_XEN_BLKDEV_FRONTEND=m -CONFIG_XEN_DEV_EVTCHN=m -CONFIG_XEN_FBDEV_FRONTEND=m -CONFIG_XEN_NETDEV_BACKEND=m -CONFIG_XEN_NETDEV_FRONTEND=m -CONFIG_XEN_SCSI_FRONTEND=m -CONFIG_XEN_WDT=m -CONFIG_XFRM=y -CONFIG_XFRM_MIGRATE=y -CONFIG_XFRM_OFFLOAD=y -CONFIG_XFRM_STATISTICS=y -CONFIG_XFRM_SUB_POLICY=y -CONFIG_XFRM_USER=m -CONFIG_XFS_FS=m -CONFIG_XFS_POSIX_ACL=y -CONFIG_XFS_QUOTA=y -# CONFIG_XZ_DEC_ARM is not set -# CONFIG_XZ_DEC_ARMTHUMB is not set -# CONFIG_XZ_DEC_IA64 is not set -# CONFIG_XZ_DEC_POWERPC is not set -# CONFIG_XZ_DEC_SPARC is not set -CONFIG_ZISOFS=y -CONFIG_ZONE_DEVICE=y -CONFIG_ZRAM=m -CONFIG_ZSMALLOC=m From ebafa61a789c644fe333e36a5b3eb1144ed47256 Mon Sep 17 00:00:00 2001 From: Sayan Chowdhury Date: Fri, 21 Aug 2026 15:37:17 +0530 Subject: [PATCH 7/8] coreos-sources: Update the cross-compilation patch to upstream This commits also retabs the ebuilds Signed-off-by: Sayan Chowdhury --- .../coreos-sources-6.18.45.ebuild | 22 ++++----- ...s-hv-fix-cross-compilation-for-ARM64.patch | 35 --------------- ...z0007-tools-hv-fix-cross-compilation.patch | 45 +++++++++++++++++++ 3 files changed, 56 insertions(+), 46 deletions(-) delete mode 100644 sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.18/z0007-tools-hv-fix-cross-compilation-for-ARM64.patch create mode 100644 sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.18/z0007-tools-hv-fix-cross-compilation.patch diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/coreos-sources-6.18.45.ebuild b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/coreos-sources-6.18.45.ebuild index 87d0374887e..c86dfe82872 100644 --- a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/coreos-sources-6.18.45.ebuild +++ b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/coreos-sources-6.18.45.ebuild @@ -17,11 +17,11 @@ detect_version DESCRIPTION="Full sources for the CoreOS Linux kernel" HOMEPAGE="http://www.kernel.org" if [[ "${PV%%_rc*}" != "${PV}" ]]; then - SRC_URI="https://git.kernel.org/torvalds/p/v${KV%-coreos}/v${OKV} -> patch-${KV%-coreos}.patch ${KERNEL_BASE_URI}/linux-${OKV}.tar.xz" - PATCH_DIR="${FILESDIR}/${KV_MAJOR}.${KV_PATCH}" + SRC_URI="https://git.kernel.org/torvalds/p/v${KV%-coreos}/v${OKV} -> patch-${KV%-coreos}.patch ${KERNEL_BASE_URI}/linux-${OKV}.tar.xz" + PATCH_DIR="${FILESDIR}/${KV_MAJOR}.${KV_PATCH}" else - SRC_URI="${KERNEL_URI}" - PATCH_DIR="${FILESDIR}/${KV_MAJOR}.${KV_MINOR}" + SRC_URI="${KERNEL_URI}" + PATCH_DIR="${FILESDIR}/${KV_MAJOR}.${KV_MINOR}" fi # make modules_prepare depends on pahole @@ -35,11 +35,11 @@ IUSE="" # patchlevel revision. We mustn't apply our patches first, it fails when the # local patches overlap with the upstream patch. UNIPATCH_LIST=" - ${PATCH_DIR}/z0001-pahole-support-reproducible-builds.patch \ - ${PATCH_DIR}/z0002-Revert-x86-boot-Remove-the-bugger-off-message.patch \ - ${PATCH_DIR}/z0003-efi-Add-an-EFI_SECURE_BOOT-flag-to-indicate-secure-b.patch \ - ${PATCH_DIR}/z0004-efi-Lock-down-the-kernel-if-booted-in-secure-boot-mo.patch \ - ${PATCH_DIR}/z0005-mtd-phram-slram-Disable-when-the-kernel-is-locked-do.patch \ - ${PATCH_DIR}/z0006-arm64-add-kernel-config-option-to-lock-down-when-in-.patch \ - ${PATCH_DIR}/z0007-tools-hv-fix-cross-compilation-for-ARM64.patch \ + ${PATCH_DIR}/z0001-pahole-support-reproducible-builds.patch \ + ${PATCH_DIR}/z0002-Revert-x86-boot-Remove-the-bugger-off-message.patch \ + ${PATCH_DIR}/z0003-efi-Add-an-EFI_SECURE_BOOT-flag-to-indicate-secure-b.patch \ + ${PATCH_DIR}/z0004-efi-Lock-down-the-kernel-if-booted-in-secure-boot-mo.patch \ + ${PATCH_DIR}/z0005-mtd-phram-slram-Disable-when-the-kernel-is-locked-do.patch \ + ${PATCH_DIR}/z0006-arm64-add-kernel-config-option-to-lock-down-when-in-.patch \ + ${PATCH_DIR}/z0007-tools-hv-fix-cross-compilation.patch \ " diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.18/z0007-tools-hv-fix-cross-compilation-for-ARM64.patch b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.18/z0007-tools-hv-fix-cross-compilation-for-ARM64.patch deleted file mode 100644 index eed99bf2f49..00000000000 --- a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.18/z0007-tools-hv-fix-cross-compilation-for-ARM64.patch +++ /dev/null @@ -1,35 +0,0 @@ -From 52fe3ead528c899b7db29870c97d25cec0671625 Mon Sep 17 00:00:00 2001 -From: Adrian Vladu -Date: Thu, 19 Sep 2024 07:59:59 +0000 -Subject: [PATCH 7/8] tools: hv: fix cross-compilation for ARM64 - ---- - tools/hv/Makefile | 4 +++- - 1 file changed, 3 insertions(+), 1 deletion(-) - -diff --git a/tools/hv/Makefile b/tools/hv/Makefile -index 34ffcec264ab..7a7ece3cdf03 100644 ---- a/tools/hv/Makefile -+++ b/tools/hv/Makefile -@@ -2,7 +2,9 @@ - # Makefile for Hyper-V tools - include ../scripts/Makefile.include - -+ifeq ($(ARCH),) - ARCH := $(shell uname -m 2>/dev/null) -+endif - sbindir ?= /usr/sbin - libexecdir ?= /usr/libexec - sharedstatedir ?= /var/lib -@@ -20,7 +22,7 @@ override CFLAGS += -O2 -Wall -g -D_GNU_SOURCE -I$(OUTPUT)include - override CFLAGS += -Wno-address-of-packed-member - - ALL_TARGETS := hv_kvp_daemon hv_vss_daemon --ifneq ($(ARCH), aarch64) -+ifeq ($(filter $(ARCH),aarch64 arm64),) - ALL_TARGETS += hv_fcopy_uio_daemon - endif - ALL_PROGRAMS := $(patsubst %,$(OUTPUT)%,$(ALL_TARGETS)) --- -2.51.0 - diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.18/z0007-tools-hv-fix-cross-compilation.patch b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.18/z0007-tools-hv-fix-cross-compilation.patch new file mode 100644 index 00000000000..3fb2dd48f09 --- /dev/null +++ b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.18/z0007-tools-hv-fix-cross-compilation.patch @@ -0,0 +1,45 @@ +From ca5ee0e918115fb5cf626d75461d9fca06e06caf Mon Sep 17 00:00:00 2001 +From: Aditya Garg +Date: Thu, 9 Apr 2026 03:32:18 -0700 +Subject: [PATCH] tools: hv: Fix cross-compilation + +Use the native ARCH only in case it is not set, this will allow the +cross-compilation where ARCH is explicitly set. + +Additionally, simplify the ARCH check to build the fcopy daemon only +for x86 and x86_64. + +Fixes: 82b0945ce2c2 ("tools: hv: Add new fcopy application based on uio driver") +Reported-by: Adrian Vladu +Closes: https://lore.kernel.org/linux-hyperv/PR3PR09MB54119DB2FD76977C62D8DD6AB04D2@PR3PR09MB5411.eurprd09.prod.outlook.com/ +Co-developed-by: Saurabh Sengar +Signed-off-by: Saurabh Sengar +Signed-off-by: Aditya Garg +Reviewed-by: Roman Kisel +Signed-off-by: Wei Liu +--- + tools/hv/Makefile | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/tools/hv/Makefile b/tools/hv/Makefile +index 34ffcec264ab0f..016753f3dd7f61 100644 +--- a/tools/hv/Makefile ++++ b/tools/hv/Makefile +@@ -2,7 +2,7 @@ + # Makefile for Hyper-V tools + include ../scripts/Makefile.include + +-ARCH := $(shell uname -m 2>/dev/null) ++ARCH ?= $(shell uname -m 2>/dev/null) + sbindir ?= /usr/sbin + libexecdir ?= /usr/libexec + sharedstatedir ?= /var/lib +@@ -20,7 +20,7 @@ override CFLAGS += -O2 -Wall -g -D_GNU_SOURCE -I$(OUTPUT)include + override CFLAGS += -Wno-address-of-packed-member + + ALL_TARGETS := hv_kvp_daemon hv_vss_daemon +-ifneq ($(ARCH), aarch64) ++ifneq ($(filter x86_64 x86,$(ARCH)),) + ALL_TARGETS += hv_fcopy_uio_daemon + endif + ALL_PROGRAMS := $(patsubst %,$(OUTPUT)%,$(ALL_TARGETS)) From 61787d721755d998cc6b767ffbbbd582a667d9ed Mon Sep 17 00:00:00 2001 From: Sayan Chowdhury Date: Fri, 28 Aug 2026 09:03:18 +0530 Subject: [PATCH 8/8] app-emulation/hv-daemons: Version bump to 6.18.45 Signed-off-by: Sayan Chowdhury --- .../{hv-daemons-6.12.105.ebuild => hv-daemons-6.18.45.ebuild} | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename sdk_container/src/third_party/coreos-overlay/app-emulation/hv-daemons/{hv-daemons-6.12.105.ebuild => hv-daemons-6.18.45.ebuild} (100%) diff --git a/sdk_container/src/third_party/coreos-overlay/app-emulation/hv-daemons/hv-daemons-6.12.105.ebuild b/sdk_container/src/third_party/coreos-overlay/app-emulation/hv-daemons/hv-daemons-6.18.45.ebuild similarity index 100% rename from sdk_container/src/third_party/coreos-overlay/app-emulation/hv-daemons/hv-daemons-6.12.105.ebuild rename to sdk_container/src/third_party/coreos-overlay/app-emulation/hv-daemons/hv-daemons-6.18.45.ebuild