diff --git a/build_library/build_image_util.sh b/build_library/build_image_util.sh index 225e0c864c0..4fc7a4c43d8 100755 --- a/build_library/build_image_util.sh +++ b/build_library/build_image_util.sh @@ -866,7 +866,8 @@ EOF write_contents_with_technical_details "${root_fs_dir}" "${BUILD_DIR}/${image_contents_wtd}" if [[ -n "${image_initrd_contents}" ]] || [[ -n "${image_initrd_contents_wtd}" ]]; then - "${BUILD_LIBRARY_DIR}/extract-initramfs-from-vmlinuz.sh" "${root_fs_dir}/boot/flatcar/vmlinuz-a" "${BUILD_DIR}/tmp_initrd_contents" + echo ">>>>DEBUG<<<${root_fs_dir}/boot/flatcar/vmlinuz-a" + "${BUILD_LIBRARY_DIR}/extract-initramfs-from-vmlinuz.sh" "${root_fs_dir}/boot/flatcar/vmlinuz-a" "${BUILD_DIR}/tmp_initrd_contents" || true if [[ -n "${image_initrd_contents}" ]]; then write_contents "${BUILD_DIR}/tmp_initrd_contents" "${BUILD_DIR}/${image_initrd_contents}" fi diff --git a/build_library/extract-initramfs-from-vmlinuz.sh b/build_library/extract-initramfs-from-vmlinuz.sh index 9c1ffb6952b..0552c89fecd 100755 --- a/build_library/extract-initramfs-from-vmlinuz.sh +++ b/build_library/extract-initramfs-from-vmlinuz.sh @@ -81,11 +81,9 @@ perform_round() { for rnd in "${round_prefix}"*; do if [[ $(file --brief "${rnd}") =~ 'cpio archive' ]]; then mkdir -p "${out}/rootfs-${ROOTFS_IDX}" - while cpio --quiet --extract --make-directories --directory="${out}/rootfs-${ROOTFS_IDX}" --nonmatching 'dev/*'; do - ROOTFS_IDX=$(( ROOTFS_IDX + 1 )) - mkdir -p "${out}/rootfs-${ROOTFS_IDX}" - done <${rnd} - rmdir "${out}/rootfs-${ROOTFS_IDX}" + # On Linux 6.10, the first rootfs is an extra ghost rootfs of 336K, that has a corrupted CPIO + cpio --quiet --extract --make-directories --directory="${out}/rootfs-${ROOTFS_IDX}" --nonmatching 'dev/*' < $rnd || true + ROOTFS_IDX=$(( ROOTFS_IDX + 1 )) fi done } diff --git a/common.sh b/common.sh index 3dbb8040dc3..089ceefd396 100644 --- a/common.sh +++ b/common.sh @@ -17,7 +17,7 @@ if [[ -z ${NUM_JOBS} ]] || [[ ${NUM_JOBS} -eq 0 ]]; then NUM_JOBS=$(grep -c "^processor" /proc/cpuinfo) fi # Ensure that any sub scripts we invoke get the max proc count. -export NUM_JOBS +export NUM_JOBS=350 # Make sure we have the location and name of the calling script, using # the current value if it is already set. diff --git a/sdk_container/src/third_party/coreos-overlay/app-emulation/hv-daemons/files/hv_fcopy_uio_daemon.service b/sdk_container/src/third_party/coreos-overlay/app-emulation/hv-daemons/files/hv_fcopy_uio_daemon.service new file mode 100644 index 00000000000..f12c7ea1bd6 --- /dev/null +++ b/sdk_container/src/third_party/coreos-overlay/app-emulation/hv-daemons/files/hv_fcopy_uio_daemon.service @@ -0,0 +1,9 @@ +[Unit] +Description=Hyper-V FCOPY UIO daemon +ConditionPathExists=/sys/bus/vmbus/devices/eb765408-105f-49b6-b4aa-c123b64d17d4/uio + +[Service] +ExecStart=/usr/bin/hv_fcopy_uio_daemon --no-daemon + +[Install] +WantedBy=multi-user.target diff --git a/sdk_container/src/third_party/coreos-overlay/app-emulation/hv-daemons/hv-daemons-6.12.0.ebuild b/sdk_container/src/third_party/coreos-overlay/app-emulation/hv-daemons/hv-daemons-6.12.0.ebuild new file mode 120000 index 00000000000..95dcc24d68a --- /dev/null +++ b/sdk_container/src/third_party/coreos-overlay/app-emulation/hv-daemons/hv-daemons-6.12.0.ebuild @@ -0,0 +1 @@ +hv-daemons-9999.ebuild \ No newline at end of file diff --git a/sdk_container/src/third_party/coreos-overlay/app-emulation/hv-daemons/hv-daemons-9999.ebuild b/sdk_container/src/third_party/coreos-overlay/app-emulation/hv-daemons/hv-daemons-9999.ebuild index 9b6b44dba91..6aa38618939 100644 --- a/sdk_container/src/third_party/coreos-overlay/app-emulation/hv-daemons/hv-daemons-9999.ebuild +++ b/sdk_container/src/third_party/coreos-overlay/app-emulation/hv-daemons/hv-daemons-9999.ebuild @@ -13,20 +13,18 @@ if [[ "${PV}" == 9999 ]]; then fi src_compile() { - # Build hv_vss_daemon, hv_kvp_daemon, hv_fcopy_daemon + # Build hv_vss_daemon, hv_kvp_daemon, hv_fcopy_daemon kmake tools/hv } src_install() { - dobin "${S}/build/tools/hv/hv_fcopy_daemon" - dobin "${S}/build/tools/hv/hv_kvp_daemon" - dobin "${S}/build/tools/hv/hv_vss_daemon" - - systemd_dounit "${FILESDIR}/hv_fcopy_daemon.service" - systemd_dounit "${FILESDIR}/hv_kvp_daemon.service" - systemd_dounit "${FILESDIR}/hv_vss_daemon.service" - - systemd_enable_service "multi-user.target" "hv_fcopy_daemon.service" - systemd_enable_service "multi-user.target" "hv_kvp_daemon.service" - systemd_enable_service "multi-user.target" "hv_vss_daemon.service" + HV_DAEMONS=(hv_vss_daemon hv_kvp_daemon hv_fcopy_daemon hv_fcopy_uio_daemon) + for HV_DAEMON in "$HV_DAEMONS[@]" + do + if [ -f "${S}/build/tools/hv/${HV_DAEMON}" ]; then + dobin "${S}/build/tools/hv/${HV_DAEMON}" + systemd_dounit "${FILESDIR}/${HV_DAEMON}.service" + systemd_enable_service "multi-user.target" "${HV_DAEMON}.service" + fi + done } diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-kernel/coreos-kernel-6.12.0.ebuild b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-kernel/coreos-kernel-6.12.0.ebuild new file mode 100644 index 00000000000..5aad6bb2865 --- /dev/null +++ b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-kernel/coreos-kernel-6.12.0.ebuild @@ -0,0 +1,102 @@ +# Copyright 2014-2016 CoreOS, Inc. +# Distributed under the terms of the GNU General Public License v2 + +EAPI=7 +COREOS_SOURCE_REVISION="" +inherit coreos-kernel + +DESCRIPTION="CoreOS Linux kernel" +KEYWORDS="amd64 arm64" + +RDEPEND="=sys-kernel/coreos-modules-${PVR}" +DEPEND="${RDEPEND} + app-arch/gzip + app-arch/zstd + app-crypt/clevis + app-shells/bash + coreos-base/coreos-init:= + sys-apps/coreutils + sys-apps/findutils + sys-apps/grep + sys-apps/ignition:= + sys-apps/less + sys-apps/nvme-cli + sys-apps/sed + sys-apps/shadow + sys-apps/systemd[cryptsetup] + sys-apps/seismograph + sys-apps/util-linux + sys-fs/btrfs-progs + sys-fs/e2fsprogs + sys-fs/mdadm + sys-fs/xfsprogs + >=sys-kernel/coreos-firmware-20180103-r1:= + >=sys-kernel/bootengine-0.0.4:= + sys-kernel/dracut + virtual/udev + amd64? ( sys-firmware/intel-microcode:= )" + +# We are bad, we want to get around the sandbox. So do the creation of the +# cpio image in pkg_setup() where we are free to mount filesystems, chroot, +# and other fun stuff. +pkg_setup() { + coreos-kernel_pkg_setup + + [[ "${MERGE_TYPE}" == binary ]] && return + + # Fail early if we didn't detect the build installed by coreos-modules + [[ -n "${KV_OUT_DIR}" ]] || die "Failed to detect modules build tree" + + if [[ "${ROOT:-/}" != / ]]; then + # TMPDIR needs to be corrected for chroot + TMPDIR=${TMPDIR#${ROOT}} ${ROOT}/usr/sbin/update-bootengine -m -c ${ROOT} -k "${KV_FULL}" || die + else + update-bootengine -k "${KV_FULL}" || die + fi +} + +src_prepare() { + default + # KV_OUT_DIR points to the minimal build tree installed by coreos-modules + # Pull in the config and public module signing key + KV_OUT_DIR="${SYSROOT%/}/lib/modules/${COREOS_SOURCE_NAME#linux-}/build" + cp -v "${KV_OUT_DIR}/.config" build/ || die + local sig_key="$(getconfig MODULE_SIG_KEY)" + mkdir -p "build/${sig_key%/*}" || die + cp -v "${KV_OUT_DIR}/${sig_key}" "build/${sig_key}" || die + + # Symlink to bootengine.cpio so we can stick with relative paths in .config + ln -sv "${SYSROOT%/}"/usr/share/bootengine/bootengine.cpio build/ || die + config_update 'CONFIG_INITRAMFS_SOURCE="bootengine.cpio"' + + # include all intel and amd microcode files, avoiding the signatures + local fw_dir="${SYSROOT%/}/lib/firmware" + use amd64 && config_update "CONFIG_EXTRA_FIRMWARE=\"$(find ${fw_dir} -type f \ + \( -path ${fw_dir}'/intel-ucode/*' -o -path ${fw_dir}'/amd-ucode/*' \) -printf '%P ')\"" + use amd64 && config_update "CONFIG_EXTRA_FIRMWARE_DIR=\"${fw_dir}\"" +} + +src_compile() { + kmake "$(kernel_target)" + + # sanity check :) + [[ -e build/certs/signing_key.pem ]] && die "created a new key!" +} + +src_install() { + # coreos-postinst expects to find the kernel in /usr/boot + insinto "/usr/boot" + newins "$(kernel_path)" "vmlinuz-${KV_FULL}" + dosym "vmlinuz-${KV_FULL}" "/usr/boot/vmlinuz" + + insinto "/usr/lib/modules/${KV_FULL}/build" + doins build/System.map + + insinto "/usr/lib/debug/usr/boot" + newins build/vmlinux "vmlinux-${KV_FULL}" + dosym "../../../boot/vmlinux-${KV_FULL}" "/usr/lib/debug/usr/lib/modules/${KV_FULL}/vmlinux" + + # For easy access to vdso debug symbols in gdb: + # set debug-file-directory /usr/lib/debug/usr/lib/modules/${KV_FULL}/vdso/ + kmake INSTALL_MOD_PATH="${D}/usr/lib/debug/usr" vdso_install +} diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/coreos-modules-6.12.0.ebuild b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/coreos-modules-6.12.0.ebuild new file mode 100644 index 00000000000..d68540c22ad --- /dev/null +++ b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/coreos-modules-6.12.0.ebuild @@ -0,0 +1,68 @@ +# Copyright 2014-2016 CoreOS, Inc. +# Distributed under the terms of the GNU General Public License v2 + +EAPI=7 +COREOS_SOURCE_REVISION="" +inherit coreos-kernel savedconfig + +DESCRIPTION="CoreOS Linux kernel modules" +KEYWORDS="amd64 arm64" +RDEPEND="!> build/.config || die + fi + cpio -ov build/bootengine.cpio + + # Check that an old pre-ebuild-split config didn't leak in. + grep -q "^CONFIG_INITRAMFS_SOURCE=" build/.config && \ + die "CONFIG_INITRAMFS_SOURCE must be removed from kernel config" + config_update 'CONFIG_INITRAMFS_SOURCE="bootengine.cpio"' +} + +src_compile() { + # Generate module signing key + setup_keys + + # Build both vmlinux and modules (moddep checks symbols in vmlinux) + kmake vmlinux modules +} + +src_install() { + # Install modules to /usr. + # Install firmware to a temporary (bogus) location. + # The linux-firmware package will be used instead. + # Stripping must be done here, not portage, to preserve sigs. + kmake INSTALL_MOD_PATH="${D}/usr" \ + INSTALL_MOD_STRIP="--strip-debug" \ + INSTALL_FW_PATH="${T}/fw" \ + modules_install + + # Install to /usr/lib/debug with debug symbols intact + kmake INSTALL_MOD_PATH="${D}/usr/lib/debug/usr" \ + INSTALL_FW_PATH="${T}/fw" \ + modules_install + rm "${D}/usr/lib/debug/usr/lib/modules/${KV_FULL}/"modules.* || die + rm "${D}/usr/lib/debug/usr/lib/modules/${KV_FULL}/build" || die + + # Clean up the build tree + shred_keys + kmake clean + find "build/" -type d -empty -delete || die + rm "build/.config.old" || die + + # Install /lib/modules/${KV_FULL}/{build,source} + install_build_source + + # Not strictly required but this is where we used to install the config. + dodir "/usr/boot" + local build="lib/modules/${KV_FULL}/build" + dosym "../${build}/.config" "/usr/boot/config-${KV_FULL}" + dosym "../${build}/.config" "/usr/boot/config" +} diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/files/amd64_defconfig-6.6 b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/files/amd64_defconfig-6.12 similarity index 99% rename from sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/files/amd64_defconfig-6.6 rename to sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/files/amd64_defconfig-6.12 index 0b2fee68c7b..9eae7e41da9 100644 --- a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/files/amd64_defconfig-6.6 +++ b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/files/amd64_defconfig-6.12 @@ -12,7 +12,6 @@ CONFIG_ACPI_IPMI=m CONFIG_ACPI_PCI_SLOT=y CONFIG_ACPI_PROCESSOR_AGGREGATOR=y CONFIG_AMD_IOMMU=y -CONFIG_AMD_IOMMU_V2=m CONFIG_AQTION=m CONFIG_ARCH_MEMORY_PROBE=y CONFIG_AUTOFS_FS=y diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/files/arm64_defconfig-6.6 b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/files/arm64_defconfig-6.12 similarity index 99% rename from sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/files/arm64_defconfig-6.6 rename to sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/files/arm64_defconfig-6.12 index 0ca2fb38973..a6c8269d509 100644 --- a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/files/arm64_defconfig-6.6 +++ b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/files/arm64_defconfig-6.12 @@ -5,6 +5,7 @@ CONFIG_ARCH_BCM2835=y CONFIG_ARCH_BCM_IPROC=y # CONFIG_ARCH_MEDIATEK is not set # CONFIG_ARCH_QCOM is not set +CONFIG_ARCH_ROCKCHIP=y CONFIG_ARCH_SEATTLE=y CONFIG_ARCH_SPRD=y CONFIG_ARCH_TEGRA=y @@ -32,7 +33,6 @@ CONFIG_CRYPTO_SHA1_ARM64_CE=y CONFIG_CRYPTO_SHA2_ARM64_CE=y # CONFIG_DEBUG_PREEMPT is not set CONFIG_DM_DEBUG=y -CONFIG_FB_ARMCLCD=y CONFIG_GPIO_PL061=y CONFIG_GPIO_XGENE=y CONFIG_GPIO_XGENE_SB=y diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/files/commonconfig-6.6 b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/files/commonconfig-6.12 similarity index 99% rename from sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/files/commonconfig-6.6 rename to sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/files/commonconfig-6.12 index 4ceaee3005d..def6990de88 100644 --- a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/files/commonconfig-6.6 +++ b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/files/commonconfig-6.12 @@ -434,7 +434,6 @@ CONFIG_MAGIC_SYSRQ=y CONFIG_MARVELL_PHY=m CONFIG_MAX_RAW_DEVS=8192 CONFIG_MD=y -CONFIG_MD_LINEAR=m CONFIG_MD_RAID0=m CONFIG_MEGARAID_MAILBOX=m CONFIG_MEGARAID_MM=m @@ -457,6 +456,7 @@ CONFIG_MMC_BLOCK_MINORS=16 CONFIG_MMC_SDHCI=m CONFIG_MMC_SDHCI_PCI=m CONFIG_MODULES=y +CONFIG_MODULE_COMPRESS=y CONFIG_MODULE_COMPRESS_XZ=y CONFIG_MODULE_SIG=y CONFIG_MODULE_SIG_KEY="certs/modules.pem" @@ -555,7 +555,6 @@ CONFIG_NET_9P_RDMA=m CONFIG_NET_9P_VIRTIO=m CONFIG_NET_ACT_CSUM=m CONFIG_NET_ACT_GACT=m -CONFIG_NET_ACT_IPT=m CONFIG_NET_ACT_MIRRED=m CONFIG_NET_ACT_NAT=m CONFIG_NET_ACT_PEDIT=m diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/Manifest b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/Manifest index 8dffbfcea3d..1657c9dcbe2 100644 --- a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/Manifest +++ b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/Manifest @@ -1,2 +1 @@ -DIST linux-6.6.tar.xz 140064536 BLAKE2B 5f02fd8696d42f7ec8c5fbadec8e7270bdcfcb1f9844a6c4db3e1fd461c93ce1ccda650ca72dceb4890ebcbbf768ba8fba0bce91efc49fbd2c307b04e95665f2 SHA512 458b2c34d46206f9b4ccbac54cc57aeca1eaecaf831bc441e59701bac6eadffc17f6ce24af6eadd0454964e843186539ac0d63295ad2cc32d112b60360c39a35 -DIST patch-6.6.75.xz 3746436 BLAKE2B 341eef5843e45bde810560b3a6e9c0460decc553aba28b5a1fa65c90130703fd2299aeaf2cc850948301e8869774920cbb05eeebc6bfb3098f4601b07da4a583 SHA512 f2a2faf11ec041b21fa9ea1033046c631d6e7e49d75842cad1d6ec282bf4e57107035c38e165a3ba91c1e6b0fe494cc1e1117be60be1943fd2e039c3e6faa305 +DIST linux-6.12.tar.xz 147906904 BLAKE2B b2ec2fc69218cacabbbe49f78384a5d259ca581b717617c12b000b16f4a4c59ee348ea886b37147f5f70fb9a7a01c1e2c8f19021078f6b23f5bc62d1c48d5e5e SHA512 a37b1823df7b4f72542f689b65882634740ba0401a42fdcf6601d9efd2e132e5a7650e70450ba76f6cd1f13ca31180f2ccee9d54fe4df89bc0000ade4380a548 \ No newline at end of file diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/coreos-sources-6.12.0.ebuild b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/coreos-sources-6.12.0.ebuild new file mode 100644 index 00000000000..5e33b6ee4d7 --- /dev/null +++ b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/coreos-sources-6.12.0.ebuild @@ -0,0 +1,46 @@ +# Copyright 2014 CoreOS, Inc. +# Distributed under the terms of the GNU General Public License v2 + +EAPI=7 +ETYPE="sources" + +# -rc releases should be versioned L.M_rcN +# Final releases should be versioned L.M.N, even for N == 0 + +# Only needed for RCs +K_BASE_VER="5.15" + +inherit kernel-2 +EXTRAVERSION="-flatcar" +detect_version + +DESCRIPTION="Full sources for the CoreOS Linux kernel" +HOMEPAGE="http://www.kernel.org" +if [[ "${PV%%_rc*}" != "${PV}" ]]; then + SRC_URI="https://git.kernel.org/torvalds/p/v${KV%-coreos}/v${OKV} -> patch-${KV%-coreos}.patch ${KERNEL_BASE_URI}/linux-${OKV}.tar.xz" + PATCH_DIR="${FILESDIR}/${KV_MAJOR}.${KV_PATCH}" +else + SRC_URI="${KERNEL_URI}" + PATCH_DIR="${FILESDIR}/${KV_MAJOR}.${KV_MINOR}" +fi + +# make modules_prepare depends on pahole +RDEPEND="dev-util/pahole" + +KEYWORDS="amd64 arm64" +IUSE="" + +# XXX: Note we must prefix the patch filenames with "z" to ensure they are +# applied _after_ a potential patch-${KV}.patch file, present when building a +# patchlevel revision. We mustn't apply our patches first, it fails when the +# local patches overlap with the upstream patch. +UNIPATCH_LIST=" + ${PATCH_DIR}/z0001-kbuild-derive-relative-path-for-srctree-from-CURDIR.patch \ + ${PATCH_DIR}/z0002-pahole-support-reproducible-builds.patch \ + ${PATCH_DIR}/z0003-Revert-x86-boot-Remove-the-bugger-off-message.patch \ + ${PATCH_DIR}/z0004-efi-add-an-efi_secure_boot-flag-to-indicate-secure-b.patch \ + ${PATCH_DIR}/z0005-efi-lock-down-the-kernel-if-booted-in-secure-boot-mo.patch \ + ${PATCH_DIR}/z0006-mtd-disable-slram-and-phram-when-locked-down.patch \ + ${PATCH_DIR}/z0007-arm64-add-kernel-config-option-to-lock-down-when.patch \ + ${PATCH_DIR}/z0008-tools-hv-fix-cross-compilation-for-ARM64.patch \ +" diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.6/z0001-kbuild-derive-relative-path-for-srctree-from-CURDIR.patch b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.12/z0001-kbuild-derive-relative-path-for-srctree-from-CURDIR.patch similarity index 100% rename from sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.6/z0001-kbuild-derive-relative-path-for-srctree-from-CURDIR.patch rename to sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.12/z0001-kbuild-derive-relative-path-for-srctree-from-CURDIR.patch diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.12/z0002-pahole-support-reproducible-builds.patch b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.12/z0002-pahole-support-reproducible-builds.patch new file mode 100644 index 00000000000..dbce2286a3d --- /dev/null +++ b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.12/z0002-pahole-support-reproducible-builds.patch @@ -0,0 +1,26 @@ +From 9faff3734e6456e7927c0914829a4764ec9f1b44 Mon Sep 17 00:00:00 2001 +From: Adrian Vladu +Date: Tue, 17 Sep 2024 13:44:14 +0000 +Subject: [PATCH] pahole: support reproducible builds + +--- + scripts/Makefile.btf | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/scripts/Makefile.btf b/scripts/Makefile.btf +index 2d6e5ed9081e..b2f88b0fcf37 100644 +--- a/scripts/Makefile.btf ++++ b/scripts/Makefile.btf +@@ -23,6 +23,9 @@ else + # Switch to using --btf_features for v1.26 and later. + pahole-flags-$(call test-ge, $(pahole-ver), 126) = -j --btf_features=encode_force,var,float,enum64,decl_tag,type_tag,optimized_func,consistent_func + ++# Support reproducible builds. ++pahole-flags-$(call test-ge, $(pahole-ver), 127) = -j --btf_features=encode_force,var,float,enum64,decl_tag,type_tag,optimized_func,consistent_func,reproducible_build ++ + endif + + pahole-flags-$(CONFIG_PAHOLE_HAS_LANG_EXCLUDE) += --lang_exclude=rust +-- +2.34.1 + diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.6/z0003-Revert-x86-boot-Remove-the-bugger-off-message.patch b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.12/z0003-Revert-x86-boot-Remove-the-bugger-off-message.patch similarity index 100% rename from sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.6/z0003-Revert-x86-boot-Remove-the-bugger-off-message.patch rename to sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.12/z0003-Revert-x86-boot-Remove-the-bugger-off-message.patch diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.6/z0004-efi-Add-an-EFI_SECURE_BOOT-flag-to-indicate-secure-b.patch b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.12/z0004-efi-add-an-efi_secure_boot-flag-to-indicate-secure-b.patch similarity index 79% rename from sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.6/z0004-efi-Add-an-EFI_SECURE_BOOT-flag-to-indicate-secure-b.patch rename to sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.12/z0004-efi-add-an-efi_secure_boot-flag-to-indicate-secure-b.patch index 8876e43904a..822beab21c1 100644 --- a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.6/z0004-efi-Add-an-EFI_SECURE_BOOT-flag-to-indicate-secure-b.patch +++ b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.12/z0004-efi-add-an-efi_secure_boot-flag-to-indicate-secure-b.patch @@ -1,8 +1,7 @@ -From 1e2ffbec195c89d887bc088691ebb19c9173ecad Mon Sep 17 00:00:00 2001 From: David Howells Date: Mon, 18 Feb 2019 12:45:03 +0000 -Subject: [PATCH 1/4] efi: Add an EFI_SECURE_BOOT flag to indicate secure boot - mode +Subject: [28/30] efi: Add an EFI_SECURE_BOOT flag to indicate secure boot mode +Origin: https://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs.git/commit?id=a5d70c55c603233c192b375f72116a395909da28 UEFI machines can be booted in Secure Boot mode. Add an EFI_SECURE_BOOT flag that can be passed to efi_enabled() to find out whether secure boot is @@ -26,15 +25,13 @@ cc: linux-efi@vger.kernel.org arch/x86/kernel/setup.c | 14 +---------- drivers/firmware/efi/Makefile | 1 + drivers/firmware/efi/secureboot.c | 39 +++++++++++++++++++++++++++++++ - include/linux/efi.h | 17 ++++++++------ - 4 files changed, 51 insertions(+), 20 deletions(-) + include/linux/efi.h | 16 ++++++++----- + 4 files changed, 51 insertions(+), 19 deletions(-) create mode 100644 drivers/firmware/efi/secureboot.c -diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c -index eb129277dcdd..7c4a6697e39d 100644 --- a/arch/x86/kernel/setup.c +++ b/arch/x86/kernel/setup.c -@@ -1190,19 +1190,7 @@ void __init setup_arch(char **cmdline_p) +@@ -1193,19 +1193,7 @@ void __init setup_arch(char **cmdline_p) /* Allocate bigger log buffer */ setup_log_buf(1); @@ -55,11 +52,9 @@ index eb129277dcdd..7c4a6697e39d 100644 reserve_initrd(); -diff --git a/drivers/firmware/efi/Makefile b/drivers/firmware/efi/Makefile -index e489fefd23da..f2dfae764fb5 100644 --- a/drivers/firmware/efi/Makefile +++ b/drivers/firmware/efi/Makefile -@@ -25,6 +25,7 @@ subdir-$(CONFIG_EFI_STUB) += libstub +@@ -25,6 +25,7 @@ obj-$(CONFIG_EFI_FAKE_MEMMAP) += fake_m obj-$(CONFIG_EFI_BOOTLOADER_CONTROL) += efibc.o obj-$(CONFIG_EFI_TEST) += test/ obj-$(CONFIG_EFI_DEV_PATH_PARSER) += dev-path-parser.o @@ -67,9 +62,6 @@ index e489fefd23da..f2dfae764fb5 100644 obj-$(CONFIG_APPLE_PROPERTIES) += apple-properties.o obj-$(CONFIG_EFI_RCI2_TABLE) += rci2-table.o obj-$(CONFIG_EFI_EMBEDDED_FIRMWARE) += embedded-firmware.o -diff --git a/drivers/firmware/efi/secureboot.c b/drivers/firmware/efi/secureboot.c -new file mode 100644 -index 000000000000..b6620669e32b --- /dev/null +++ b/drivers/firmware/efi/secureboot.c @@ -0,0 +1,39 @@ @@ -112,11 +104,9 @@ index 000000000000..b6620669e32b + } + } +} -diff --git a/include/linux/efi.h b/include/linux/efi.h -index 80b21d1c6eaf..d267ddba8369 100644 --- a/include/linux/efi.h +++ b/include/linux/efi.h -@@ -871,6 +871,14 @@ extern int __init efi_setup_pcdp_console(char *); +@@ -871,6 +871,14 @@ extern int __init efi_setup_pcdp_console #define EFI_MEM_ATTR 10 /* Did firmware publish an EFI_MEMORY_ATTRIBUTES table? */ #define EFI_MEM_NO_SOFT_RESERVE 11 /* Is the kernel configured to ignore soft reservations? */ #define EFI_PRESERVE_BS_REGIONS 12 /* Are EFI boot-services memory segments available? */ @@ -131,7 +121,7 @@ index 80b21d1c6eaf..d267ddba8369 100644 #ifdef CONFIG_EFI /* -@@ -895,6 +903,7 @@ static inline bool efi_rt_services_supported(unsigned int mask) +@@ -895,6 +903,7 @@ static inline bool efi_rt_services_suppo return (efi.runtime_supported_mask & mask) == mask; } extern void efi_find_mirror(void); @@ -139,7 +129,7 @@ index 80b21d1c6eaf..d267ddba8369 100644 #else static inline bool efi_enabled(int feature) { -@@ -914,6 +923,7 @@ static inline bool efi_rt_services_supported(unsigned int mask) +@@ -914,6 +923,7 @@ static inline bool efi_rt_services_suppo } static inline void efi_find_mirror(void) {} @@ -147,7 +137,7 @@ index 80b21d1c6eaf..d267ddba8369 100644 #endif extern int efi_status_to_err(efi_status_t status); -@@ -1133,13 +1143,6 @@ static inline bool efi_runtime_disabled(void) { return true; } +@@ -1133,13 +1143,6 @@ static inline bool efi_runtime_disabled( extern void efi_call_virt_check_flags(unsigned long flags, const void *caller); extern unsigned long efi_call_virt_save_flags(void); @@ -161,6 +151,3 @@ index 80b21d1c6eaf..d267ddba8369 100644 static inline enum efi_secureboot_mode efi_get_secureboot_mode(efi_get_variable_t *get_var) { --- -2.39.2 - diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.6/z0005-efi-Lock-down-the-kernel-if-booted-in-secure-boot-mo.patch b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.12/z0005-efi-lock-down-the-kernel-if-booted-in-secure-boot-mo.patch similarity index 64% rename from sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.6/z0005-efi-Lock-down-the-kernel-if-booted-in-secure-boot-mo.patch rename to sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.12/z0005-efi-lock-down-the-kernel-if-booted-in-secure-boot-mo.patch index 36df3994114..6fff3f89675 100644 --- a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.6/z0005-efi-Lock-down-the-kernel-if-booted-in-secure-boot-mo.patch +++ b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.12/z0005-efi-lock-down-the-kernel-if-booted-in-secure-boot-mo.patch @@ -1,7 +1,6 @@ -From fa96a2ef86466da0a43756ee39ce3b1cb555a55a Mon Sep 17 00:00:00 2001 From: Ben Hutchings Date: Tue, 10 Sep 2019 11:54:28 +0100 -Subject: [PATCH 2/4] efi: Lock down the kernel if booted in secure boot mode +Subject: efi: Lock down the kernel if booted in secure boot mode Based on an earlier patch by David Howells, who wrote the following description: @@ -18,18 +17,16 @@ help text for LOCK_DOWN_IN_EFI_SECURE_BOOT was adjusted to mention that lockdown is triggered in integrity mode (https://bugs.debian.org/1025417)] Signed-off-by: Salvatore Bonaccorso --- - arch/x86/kernel/setup.c | 4 ++-- - drivers/firmware/efi/secureboot.c | 5 +++++ - include/linux/security.h | 6 ++++++ - security/lockdown/Kconfig | 15 +++++++++++++++ - security/lockdown/lockdown.c | 2 +- - 5 files changed, 29 insertions(+), 3 deletions(-) + arch/x86/kernel/setup.c | 4 ++-- + drivers/firmware/efi/secureboot.c | 3 +++ + include/linux/security.h | 6 ++++++ + security/lockdown/Kconfig | 15 +++++++++++++++ + security/lockdown/lockdown.c | 2 +- + 5 files changed, 27 insertions(+), 3 deletions(-) -diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c -index 7c4a6697e39d..04e73973098e 100644 --- a/arch/x86/kernel/setup.c +++ b/arch/x86/kernel/setup.c -@@ -1028,6 +1028,8 @@ void __init setup_arch(char **cmdline_p) +@@ -904,6 +904,8 @@ void __init setup_arch(char **cmdline_p) if (efi_enabled(EFI_BOOT)) efi_init(); @@ -38,7 +35,7 @@ index 7c4a6697e39d..04e73973098e 100644 reserve_ibft_region(); x86_init.resources.dmi_setup(); -@@ -1190,8 +1192,6 @@ void __init setup_arch(char **cmdline_p) +@@ -1070,8 +1072,6 @@ void __init setup_arch(char **cmdline_p) /* Allocate bigger log buffer */ setup_log_buf(1); @@ -47,8 +44,6 @@ index 7c4a6697e39d..04e73973098e 100644 reserve_initrd(); acpi_table_upgrade(); -diff --git a/drivers/firmware/efi/secureboot.c b/drivers/firmware/efi/secureboot.c -index b6620669e32b..8f2554291fb1 100644 --- a/drivers/firmware/efi/secureboot.c +++ b/drivers/firmware/efi/secureboot.c @@ -15,6 +15,7 @@ @@ -59,7 +54,7 @@ index b6620669e32b..8f2554291fb1 100644 /* * Decide what to do when UEFI secure boot mode is enabled. -@@ -28,6 +29,10 @@ void __init efi_set_secure_boot(enum efi_secureboot_mode mode) +@@ -28,6 +29,10 @@ void __init efi_set_secure_boot(enum efi break; case efi_secureboot_mode_enabled: set_bit(EFI_SECURE_BOOT, &efi.flags); @@ -70,19 +65,17 @@ index b6620669e32b..8f2554291fb1 100644 pr_info("Secure boot enabled\n"); break; default: -diff --git a/include/linux/security.h b/include/linux/security.h -index 4bd0f6fc553e..08258ecbb5f9 100644 --- a/include/linux/security.h +++ b/include/linux/security.h -@@ -486,6 +486,7 @@ int security_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen); +@@ -522,6 +522,7 @@ int security_inode_notifysecctx(struct i int security_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen); int security_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen); int security_locked_down(enum lockdown_reason what); +int lock_kernel_down(const char *where, enum lockdown_reason level); - #else /* CONFIG_SECURITY */ - - static inline int call_blocking_lsm_notifier(enum lsm_event event, void *data) -@@ -1404,6 +1405,11 @@ static inline int security_locked_down(enum lockdown_reason what) + int lsm_fill_user_ctx(struct lsm_ctx __user *uctx, u32 *uctx_len, + void *val, size_t val_len, u64 id, u64 flags); + int security_bdev_alloc(struct block_device *bdev); +@@ -1504,6 +1505,11 @@ static inline int security_locked_down(e { return 0; } @@ -91,14 +84,12 @@ index 4bd0f6fc553e..08258ecbb5f9 100644 +{ + return -EOPNOTSUPP; +} - #endif /* CONFIG_SECURITY */ - - #if defined(CONFIG_SECURITY) && defined(CONFIG_WATCH_QUEUE) -diff --git a/security/lockdown/Kconfig b/security/lockdown/Kconfig -index e84ddf484010..4175b50b1e6e 100644 + static inline int lsm_fill_user_ctx(struct lsm_ctx __user *uctx, + u32 *uctx_len, void *val, size_t val_len, + u64 id, u64 flags) --- a/security/lockdown/Kconfig +++ b/security/lockdown/Kconfig -@@ -45,3 +45,18 @@ config LOCK_DOWN_KERNEL_FORCE_CONFIDENTIALITY +@@ -45,3 +45,18 @@ config LOCK_DOWN_KERNEL_FORCE_CONFIDENTI disabled. endchoice @@ -117,11 +108,9 @@ index e84ddf484010..4175b50b1e6e 100644 + + Enabling this option results in kernel lockdown being + triggered in integrity mode if EFI Secure Boot is set. -diff --git a/security/lockdown/lockdown.c b/security/lockdown/lockdown.c -index 68d19632aeb7..67cc9839952f 100644 --- a/security/lockdown/lockdown.c +++ b/security/lockdown/lockdown.c -@@ -23,7 +23,7 @@ static const enum lockdown_reason lockdown_levels[] = {LOCKDOWN_NONE, +@@ -24,7 +24,7 @@ static const enum lockdown_reason lockdo /* * Put the kernel into lock-down mode. */ @@ -130,6 +119,3 @@ index 68d19632aeb7..67cc9839952f 100644 { if (kernel_locked_down >= level) return -EPERM; --- -2.39.2 - diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.6/z0006-mtd-phram-slram-Disable-when-the-kernel-is-locked-do.patch b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.12/z0006-mtd-disable-slram-and-phram-when-locked-down.patch similarity index 81% rename from sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.6/z0006-mtd-phram-slram-Disable-when-the-kernel-is-locked-do.patch rename to sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.12/z0006-mtd-disable-slram-and-phram-when-locked-down.patch index 7346036e80e..c718e7e2f02 100644 --- a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.6/z0006-mtd-phram-slram-Disable-when-the-kernel-is-locked-do.patch +++ b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.12/z0006-mtd-disable-slram-and-phram-when-locked-down.patch @@ -1,7 +1,7 @@ -From bb8912cf807feab56cf8e924d33229d800ae71a6 Mon Sep 17 00:00:00 2001 From: Ben Hutchings Date: Fri, 30 Aug 2019 15:54:24 +0100 -Subject: [PATCH 3/4] mtd: phram,slram: Disable when the kernel is locked down +Subject: mtd: phram,slram: Disable when the kernel is locked down +Forwarded: https://lore.kernel.org/linux-security-module/20190830154720.eekfjt6c4jzvlbfz@decadent.org.uk/ These drivers allow mapping arbitrary memory ranges as MTD devices. This should be disabled to preserve the kernel's integrity when it is @@ -21,11 +21,9 @@ Cc: linux-mtd@lists.infradead.org drivers/mtd/devices/slram.c | 9 ++++++++- 2 files changed, 13 insertions(+), 2 deletions(-) -diff --git a/drivers/mtd/devices/phram.c b/drivers/mtd/devices/phram.c -index 208bd4d871f4..30f84a91692d 100644 --- a/drivers/mtd/devices/phram.c +++ b/drivers/mtd/devices/phram.c -@@ -364,7 +364,11 @@ static int phram_param_call(const char *val, const struct kernel_param *kp) +@@ -364,7 +364,11 @@ static int phram_param_call(const char * #endif } @@ -38,8 +36,6 @@ index 208bd4d871f4..30f84a91692d 100644 MODULE_PARM_DESC(phram, "Memory region to map. \"phram=,,[,]\""); #ifdef CONFIG_OF -diff --git a/drivers/mtd/devices/slram.c b/drivers/mtd/devices/slram.c -index 28131a127d06..d92a2461e2ce 100644 --- a/drivers/mtd/devices/slram.c +++ b/drivers/mtd/devices/slram.c @@ -43,6 +43,7 @@ @@ -77,6 +73,3 @@ index 28131a127d06..d92a2461e2ce 100644 while (map) { devname = devstart = devlength = NULL; --- -2.39.2 - diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.6/z0007-arm64-add-kernel-config-option-to-lock-down-when-in-.patch b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.12/z0007-arm64-add-kernel-config-option-to-lock-down-when.patch similarity index 73% rename from sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.6/z0007-arm64-add-kernel-config-option-to-lock-down-when-in-.patch rename to sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.12/z0007-arm64-add-kernel-config-option-to-lock-down-when.patch index 7661674404f..61b7040971f 100644 --- a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.6/z0007-arm64-add-kernel-config-option-to-lock-down-when-in-.patch +++ b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.12/z0007-arm64-add-kernel-config-option-to-lock-down-when.patch @@ -1,8 +1,8 @@ -From 8598238a38a333fed5ec0c8287f99813578370ab Mon Sep 17 00:00:00 2001 From: Linn Crosetto Date: Tue, 30 Aug 2016 11:54:38 -0600 -Subject: [PATCH 4/4] arm64: add kernel config option to lock down when in - Secure Boot mode +Subject: arm64: add kernel config option to lock down when in Secure Boot mode +Bug-Debian: https://bugs.debian.org/831827 +Forwarded: no Add a kernel configuration option to lock down the kernel, to restrict userspace's ability to modify the running kernel when UEFI Secure Boot is @@ -32,17 +32,15 @@ Signed-off-by: Linn Crosetto [Salvatore Bonaccorso: Forward-ported to 5.10: f30f242fb131 ("efi: Rename arm-init to efi-init common for all arch") renamed arm-init.c to efi-init.c] --- - drivers/firmware/efi/efi-init.c | 5 ++++- - drivers/firmware/efi/fdtparams.c | 12 +++++++++++- - drivers/firmware/efi/libstub/fdt.c | 6 ++++++ - include/linux/efi.h | 3 ++- + drivers/firmware/efi/efi-init.c | 5 ++++- + drivers/firmware/efi/fdtparams.c | 12 +++++++++++- + drivers/firmware/efi/libstub/fdt.c | 6 ++++++ + include/linux/efi.h | 3 ++- 4 files changed, 23 insertions(+), 3 deletions(-) -diff --git a/drivers/firmware/efi/efi-init.c b/drivers/firmware/efi/efi-init.c -index 59b0d7197b68..e63f8a82d9f4 100644 --- a/drivers/firmware/efi/efi-init.c +++ b/drivers/firmware/efi/efi-init.c -@@ -204,9 +204,10 @@ void __init efi_init(void) +@@ -213,9 +213,10 @@ void __init efi_init(void) { struct efi_memory_map_data data; u64 efi_system_table; @@ -54,7 +52,7 @@ index 59b0d7197b68..e63f8a82d9f4 100644 if (!efi_system_table) return; -@@ -228,6 +229,8 @@ void __init efi_init(void) +@@ -237,6 +238,8 @@ void __init efi_init(void) return; } @@ -63,8 +61,6 @@ index 59b0d7197b68..e63f8a82d9f4 100644 reserve_regions(); /* * For memblock manipulation, the cap should come after the memblock_add(). -diff --git a/drivers/firmware/efi/fdtparams.c b/drivers/firmware/efi/fdtparams.c -index 0ec83ba58097..81a0ac408cf5 100644 --- a/drivers/firmware/efi/fdtparams.c +++ b/drivers/firmware/efi/fdtparams.c @@ -16,6 +16,7 @@ enum { @@ -75,7 +71,7 @@ index 0ec83ba58097..81a0ac408cf5 100644 PARAMCOUNT }; -@@ -26,6 +27,7 @@ static __initconst const char name[][22] = { +@@ -26,6 +27,7 @@ static __initconst const char name[][22] [MMSIZE] = "MemMap Size ", [DCSIZE] = "MemMap Desc. Size ", [DCVERS] = "MemMap Desc. Version ", @@ -99,7 +95,7 @@ index 0ec83ba58097..81a0ac408cf5 100644 } } }; -@@ -64,6 +68,11 @@ static int __init efi_get_fdt_prop(const void *fdt, int node, const char *pname, +@@ -64,6 +68,11 @@ static int __init efi_get_fdt_prop(const int len; u64 val; @@ -111,7 +107,7 @@ index 0ec83ba58097..81a0ac408cf5 100644 prop = fdt_getprop(fdt, node, pname, &len); if (!prop) return 1; -@@ -81,7 +90,7 @@ static int __init efi_get_fdt_prop(const void *fdt, int node, const char *pname, +@@ -81,7 +90,7 @@ static int __init efi_get_fdt_prop(const return 0; } @@ -120,7 +116,7 @@ index 0ec83ba58097..81a0ac408cf5 100644 { const void *fdt = initial_boot_params; unsigned long systab; -@@ -95,6 +104,7 @@ u64 __init efi_get_fdt_params(struct efi_memory_map_data *mm) +@@ -95,6 +104,7 @@ u64 __init efi_get_fdt_params(struct efi [MMSIZE] = { &mm->size, sizeof(mm->size) }, [DCSIZE] = { &mm->desc_size, sizeof(mm->desc_size) }, [DCVERS] = { &mm->desc_version, sizeof(mm->desc_version) }, @@ -128,11 +124,9 @@ index 0ec83ba58097..81a0ac408cf5 100644 }; BUILD_BUG_ON(ARRAY_SIZE(target) != ARRAY_SIZE(name)); -diff --git a/drivers/firmware/efi/libstub/fdt.c b/drivers/firmware/efi/libstub/fdt.c -index 6a337f1f8787..6c679da644dd 100644 --- a/drivers/firmware/efi/libstub/fdt.c +++ b/drivers/firmware/efi/libstub/fdt.c -@@ -132,6 +132,12 @@ static efi_status_t update_fdt(void *orig_fdt, unsigned long orig_fdt_size, +@@ -132,6 +132,12 @@ static efi_status_t update_fdt(void *ori } } @@ -145,20 +139,15 @@ index 6a337f1f8787..6c679da644dd 100644 /* Shrink the FDT back to its minimum size: */ fdt_pack(fdt); -diff --git a/include/linux/efi.h b/include/linux/efi.h -index d267ddba8369..fbce526768d3 100644 --- a/include/linux/efi.h +++ b/include/linux/efi.h -@@ -756,7 +756,8 @@ extern void efi_mem_reserve(phys_addr_t addr, u64 size); +@@ -764,7 +764,8 @@ extern int efi_mem_desc_lookup(u64 phys_ + extern int __efi_mem_desc_lookup(u64 phys_addr, efi_memory_desc_t *out_md); + extern void efi_mem_reserve(phys_addr_t addr, u64 size); extern int efi_mem_reserve_persistent(phys_addr_t addr, u64 size); - extern void efi_initialize_iomem_resources(struct resource *code_resource, - struct resource *data_resource, struct resource *bss_resource); -extern u64 efi_get_fdt_params(struct efi_memory_map_data *data); +extern u64 efi_get_fdt_params(struct efi_memory_map_data *data, + u32 *secure_boot); extern struct kobject *efi_kobj; extern int efi_reboot_quirk_mode; --- -2.39.2 - diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.12/z0008-tools-hv-fix-cross-compilation-for-ARM64.patch b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.12/z0008-tools-hv-fix-cross-compilation-for-ARM64.patch new file mode 100644 index 00000000000..b06e6564756 --- /dev/null +++ b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.12/z0008-tools-hv-fix-cross-compilation-for-ARM64.patch @@ -0,0 +1,35 @@ +From 0890eb69da82aec12518a5c2998afea467a0e9d7 Mon Sep 17 00:00:00 2001 +From: Adrian Vladu +Date: Thu, 19 Sep 2024 07:59:59 +0000 +Subject: [PATCH] tools: hv: fix cross-compilation for ARM64 + +--- + tools/hv/Makefile | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/tools/hv/Makefile b/tools/hv/Makefile +index 2e60e2c212cd..d72554cedbf6 100644 +--- a/tools/hv/Makefile ++++ b/tools/hv/Makefile +@@ -2,7 +2,9 @@ + # Makefile for Hyper-V tools + include ../scripts/Makefile.include + ++ifeq ($(ARCH),) + ARCH := $(shell uname -m 2>/dev/null) ++endif + sbindir ?= /usr/sbin + libexecdir ?= /usr/libexec + sharedstatedir ?= /var/lib +@@ -20,7 +22,7 @@ override CFLAGS += -O2 -Wall -g -D_GNU_SOURCE -I$(OUTPUT)include + override CFLAGS += -Wno-address-of-packed-member + + ALL_TARGETS := hv_kvp_daemon hv_vss_daemon +-ifneq ($(ARCH), aarch64) ++ifeq ($(filter $(ARCH),aarch64 arm64),) + ALL_TARGETS += hv_fcopy_uio_daemon + endif + ALL_PROGRAMS := $(patsubst %,$(OUTPUT)%,$(ALL_TARGETS)) +-- +2.34.1 + diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.6/z0002-revert-pahole-flags.patch b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.6/z0002-revert-pahole-flags.patch deleted file mode 100644 index 2591ecf6e45..00000000000 --- a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.6/z0002-revert-pahole-flags.patch +++ /dev/null @@ -1,53 +0,0 @@ -diff --git a/init/Kconfig b/init/Kconfig -index e173364abd6c..cdc35682e03b 100644 ---- a/init/Kconfig -+++ b/init/Kconfig -@@ -1899,7 +1899,7 @@ config RUST - depends on !GCC_PLUGINS - depends on !RANDSTRUCT - depends on !SHADOW_CALL_STACK -- depends on !DEBUG_INFO_BTF || PAHOLE_HAS_LANG_EXCLUDE -+ depends on !DEBUG_INFO_BTF - help - Enables Rust support in the kernel. - -diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug -index da5513cfc125..f2b3aab6d4a1 100644 ---- a/lib/Kconfig.debug -+++ b/lib/Kconfig.debug -@@ -394,15 +394,6 @@ config PAHOLE_HAS_BTF_TAG - btf_decl_tag) or not. Currently only clang compiler implements - these attributes, so make the config depend on CC_IS_CLANG. - --config PAHOLE_HAS_LANG_EXCLUDE -- def_bool PAHOLE_VERSION >= 124 -- help -- Support for the --lang_exclude flag which makes pahole exclude -- compilation units from the supplied language. Used in Kbuild to -- omit Rust CUs which are not supported in version 1.24 of pahole, -- otherwise it would emit malformed kernel and module binaries when -- using DEBUG_INFO_BTF_MODULES. -- - config DEBUG_INFO_BTF_MODULES - bool "Generate BTF type information for kernel modules" - default y -diff --git a/scripts/pahole-flags.sh b/scripts/pahole-flags.sh -index 728d55190d97..c293941612e7 100755 ---- a/scripts/pahole-flags.sh -+++ b/scripts/pahole-flags.sh -@@ -16,15 +16,5 @@ fi - if [ "${pahole_ver}" -ge "121" ]; then - extra_paholeopt="${extra_paholeopt} --btf_gen_floats" - fi --if [ "${pahole_ver}" -ge "122" ]; then -- extra_paholeopt="${extra_paholeopt} -j" --fi --if [ "${pahole_ver}" -ge "124" ]; then -- # see PAHOLE_HAS_LANG_EXCLUDE -- extra_paholeopt="${extra_paholeopt} --lang_exclude=rust" --fi --if [ "${pahole_ver}" -ge "125" ]; then -- extra_paholeopt="${extra_paholeopt} --skip_encoding_btf_inconsistent_proto --btf_gen_optimized" --fi - - echo ${extra_paholeopt} diff --git a/sdk_container/src/third_party/portage-stable/sys-fs/zfs-kmod/Manifest b/sdk_container/src/third_party/portage-stable/sys-fs/zfs-kmod/Manifest index e2d6085d8a5..aec81dd5a9d 100644 --- a/sdk_container/src/third_party/portage-stable/sys-fs/zfs-kmod/Manifest +++ b/sdk_container/src/third_party/portage-stable/sys-fs/zfs-kmod/Manifest @@ -1,3 +1,5 @@ +DIST zfs-2.1.15.tar.gz 35209038 BLAKE2B 61f9e14c54d43d1c51269917bb3ffde0530166126ea0467103ff1171dffc537315fd21c270d12f73d677e121b8094af39dd0a1fe3f80986bb42dc16d627dff52 SHA512 24096f2a6ecb3cc51f3d2f11cc69ad134d6fc33667007277c50cf798be2b19b6ddfa9be6923ca53d8b09f0bebae14c44d74811ec776e5aaf4ea0e810844c1f3d +DIST zfs-2.1.15.tar.gz.asc 836 BLAKE2B 897c05a8870cd0418493b42fe854ef5b28f9a31513ac262a25631089defa59190808b51bd31e43412b01171bcac0dff0608d417dfdacfeee0b0f067e0627d48f SHA512 a6c5a9d214070a220716075455eb1cb85a53fb20b5fe4319f112cde0653a25f87b66d0f0bcf0ca641e3ac38239759cb9df6ed7f4700056a2732cc8c1ccd9ce05 DIST zfs-2.1.16.tar.gz 35187215 BLAKE2B 8bb90903f3747589fff94a810584de54d7f598b0aa9d0b364cc679779d401a9a76f6914cbfbdd007e2066f02230ed4cac4f3735830ea70eb3bcc449af8229c5d SHA512 68e62015e44eeb997166418bf769afa3e96c037a9282dcfd08a8f01d935fa48076483158f628d70b0aed258427510996d4c4ee7d2644ff561163c76f776635d2 DIST zfs-2.1.16.tar.gz.asc 836 BLAKE2B b46614399ca63d9c88216c55bb2177cc0c28f4da2cb6be3ee361efca994309abff46fdf6ad6b0bad448c44e9e84ee40e2183d1b482e04844317f14744bab5c1f SHA512 d2d94a4e3ffe182e86fa3319cb9661688125f378ffa1e5768ee89033f796a1f52f877c382588fb1f434686e30bc4e65e3f08ceac0dd3dd7f8f751ba6182c3317 DIST zfs-2.2.5.tar.gz 33896824 BLAKE2B ec73c866bf931e4af63a35b3e61e1254d681d21aadba304ea95c147a3911c3d92db686591147036848ceae1683f31f6f81e04a24df6cb11a91a8abaed179567f SHA512 8e288620ce78fb235fa0c9929fc97150987a64091a8a5209209f1e0975d4d6213b8b307e32b3c89d934e83dc8468a1998b797fcdff5bbbbd023f07674877b0c6 @@ -6,5 +8,10 @@ DIST zfs-2.2.6.tar.gz 33900138 BLAKE2B 0bbe36df779aaf19460a75725af9c9b13e64e77a6 DIST zfs-2.2.6.tar.gz.asc 836 BLAKE2B db66f3e2e629ab8a344a8e0c2609bcbb98d69d110fc9e064760ee0c5c25cd67421a71764c4b65d7005e8ff66167bf24beb4be2560a47318eabffa888c1539f26 SHA512 d09f343b3acc3a81e96c069072cfb16d0b490ee77562f50e14524faf05560f9e1d1325ec4bc1760c86ed29186d5860d59646d4ea07385ee3b28d879f2374b9b4 DIST zfs-2.2.7.tar.gz 33852602 BLAKE2B 31a066d5d543e3328d1afd065a8da4f9b4c52433d585cdbb41936900fd1453431585c6bc4b6e6d9a497a03e79969bae883e17cf4677099686feb3e32577d2777 SHA512 6493faa8e31d9c042c4e8f748d32cb9243212fdf4e0341c19568b47bcf302e60beb89940b80374610b71e1dca1ca5813f3efaddbf1a2453ceabb38381165b271 DIST zfs-2.2.7.tar.gz.asc 836 BLAKE2B e8fc5e04f5b37a22c741bda46b4573e0cebe85da051c73cf3c5fc267de3c313399b235fc346ca06f4c22d37d2500044a26adb3ea241a65fbcf8760d0ef880039 SHA512 8d22a64c920c2a983429688a340f4ae281decdd30e465591e6b40af9f3016b8f168f4e8ea460600c832a2f46b383ff307986649a645585fb25c34fdfda75ad6e +DIST zfs-2.3.0-rc1.tar.gz 33887119 BLAKE2B dd4e159bef6de216cc51c1dd22620e6edb5b7503d95402022d0b9439471fe432181b1e5df2142e63cdac812a74b62657a96573b3bf48ad78bd6fd885a5f8913e SHA512 fe7de046dd48dbb67545726482a501788a1d5601e6e9a17deeb29047946689d9c8deb95f72b2b47c26a205a3c94fa1f0123437479a06b1376b9dac3dd6faf463 +DIST zfs-2.3.0-rc1.tar.gz.asc 195 BLAKE2B f70e6223e94a3f79d6d685b2b06254fba845d79768c82b7a3fedb865b6e6c97499c497def0f4c3e4a2869fed88b0965650ae88d5eb72c0ffaed43c4479d3bf96 SHA512 26b395feaf03e2be20b75ef64e573aa98a0706c46a1eb57503925731bf0cb9bf7fef8a2cdcf163233bccd7da9f5aedc0cae73f0183f39e0f13dcf315b4a5d809 +DIST zfs-2.3.0-rc3.tar.gz 33897910 BLAKE2B 518e2c56130a71d4c35f27328184e882815e2ca5b0524e660e174176bee4fdc554e4d1c8264d71f84b6c9641c08088f96a5c35adb5ef6f21b814ccadf093a256 SHA512 1ac53d3a006580f4a32fa33dddd6600d8abac401ed9fc86a2950a8241e0a9dc4a8954a32c44b28b10f22ba7c5cbd8871d9f21c13ccc291c366e9745e83431723 +DIST zfs-2.3.0-rc3.tar.gz.asc 195 BLAKE2B 34685869cb8d4f911b3ce0a5098411ce4cb346310564b7ad5fbe9cfc50a3bbe7665c8daa36384b2d5f3ee1dad4b98d6d5bad5a6b8e2f45da35354428853f748d SHA512 1f32119b24c703dd5dbdcce63ddc97cd24f2052522cf1f2f9a4228691d0db7c136262d98b38f2d795a4edfce1d25b423c5bc4f65dbc008bd12f64acc24f3406e DIST zfs-2.3.0.tar.gz 34029599 BLAKE2B b9fb7913f95dd0c8aec703961ecc0413aa51df889f15b1541ff8fcd7146ba485947fab83deb062bdffcdeab17a2465b7551c7eba3ec55c62c21aba58846c0da5 SHA512 f0bb1c6e28b325765be809dbc5d38ba294daa38b54eafd7d129cf6081fb209b200580437019faeed3614bbb0687d6583698a9282f3275905a1f5a8314a66cf0b DIST zfs-2.3.0.tar.gz.asc 836 BLAKE2B 9d1bd03dc6e5699236bca4c2b20a0a8b46e88d90ea58f7171d087c555da85d6af88acc5990f828ba455f9fbe24c90800c1edf74cd3f865b528730ffef8a931b8 SHA512 ba9a8e8b248de7383c8d33b84b0d70de026b8f3e6a1c82557b74ac274b28e559435541fbdfe816f6b80ce5098b3cac34af69cd53877f1f50fa6a846fa92a5dd0 + diff --git a/sdk_container/src/third_party/portage-stable/sys-fs/zfs/Manifest b/sdk_container/src/third_party/portage-stable/sys-fs/zfs/Manifest index e2d6085d8a5..0089a172228 100644 --- a/sdk_container/src/third_party/portage-stable/sys-fs/zfs/Manifest +++ b/sdk_container/src/third_party/portage-stable/sys-fs/zfs/Manifest @@ -1,3 +1,5 @@ +DIST zfs-2.1.15.tar.gz 35209038 BLAKE2B 61f9e14c54d43d1c51269917bb3ffde0530166126ea0467103ff1171dffc537315fd21c270d12f73d677e121b8094af39dd0a1fe3f80986bb42dc16d627dff52 SHA512 24096f2a6ecb3cc51f3d2f11cc69ad134d6fc33667007277c50cf798be2b19b6ddfa9be6923ca53d8b09f0bebae14c44d74811ec776e5aaf4ea0e810844c1f3d +DIST zfs-2.1.15.tar.gz.asc 836 BLAKE2B 897c05a8870cd0418493b42fe854ef5b28f9a31513ac262a25631089defa59190808b51bd31e43412b01171bcac0dff0608d417dfdacfeee0b0f067e0627d48f SHA512 a6c5a9d214070a220716075455eb1cb85a53fb20b5fe4319f112cde0653a25f87b66d0f0bcf0ca641e3ac38239759cb9df6ed7f4700056a2732cc8c1ccd9ce05 DIST zfs-2.1.16.tar.gz 35187215 BLAKE2B 8bb90903f3747589fff94a810584de54d7f598b0aa9d0b364cc679779d401a9a76f6914cbfbdd007e2066f02230ed4cac4f3735830ea70eb3bcc449af8229c5d SHA512 68e62015e44eeb997166418bf769afa3e96c037a9282dcfd08a8f01d935fa48076483158f628d70b0aed258427510996d4c4ee7d2644ff561163c76f776635d2 DIST zfs-2.1.16.tar.gz.asc 836 BLAKE2B b46614399ca63d9c88216c55bb2177cc0c28f4da2cb6be3ee361efca994309abff46fdf6ad6b0bad448c44e9e84ee40e2183d1b482e04844317f14744bab5c1f SHA512 d2d94a4e3ffe182e86fa3319cb9661688125f378ffa1e5768ee89033f796a1f52f877c382588fb1f434686e30bc4e65e3f08ceac0dd3dd7f8f751ba6182c3317 DIST zfs-2.2.5.tar.gz 33896824 BLAKE2B ec73c866bf931e4af63a35b3e61e1254d681d21aadba304ea95c147a3911c3d92db686591147036848ceae1683f31f6f81e04a24df6cb11a91a8abaed179567f SHA512 8e288620ce78fb235fa0c9929fc97150987a64091a8a5209209f1e0975d4d6213b8b307e32b3c89d934e83dc8468a1998b797fcdff5bbbbd023f07674877b0c6 @@ -6,5 +8,9 @@ DIST zfs-2.2.6.tar.gz 33900138 BLAKE2B 0bbe36df779aaf19460a75725af9c9b13e64e77a6 DIST zfs-2.2.6.tar.gz.asc 836 BLAKE2B db66f3e2e629ab8a344a8e0c2609bcbb98d69d110fc9e064760ee0c5c25cd67421a71764c4b65d7005e8ff66167bf24beb4be2560a47318eabffa888c1539f26 SHA512 d09f343b3acc3a81e96c069072cfb16d0b490ee77562f50e14524faf05560f9e1d1325ec4bc1760c86ed29186d5860d59646d4ea07385ee3b28d879f2374b9b4 DIST zfs-2.2.7.tar.gz 33852602 BLAKE2B 31a066d5d543e3328d1afd065a8da4f9b4c52433d585cdbb41936900fd1453431585c6bc4b6e6d9a497a03e79969bae883e17cf4677099686feb3e32577d2777 SHA512 6493faa8e31d9c042c4e8f748d32cb9243212fdf4e0341c19568b47bcf302e60beb89940b80374610b71e1dca1ca5813f3efaddbf1a2453ceabb38381165b271 DIST zfs-2.2.7.tar.gz.asc 836 BLAKE2B e8fc5e04f5b37a22c741bda46b4573e0cebe85da051c73cf3c5fc267de3c313399b235fc346ca06f4c22d37d2500044a26adb3ea241a65fbcf8760d0ef880039 SHA512 8d22a64c920c2a983429688a340f4ae281decdd30e465591e6b40af9f3016b8f168f4e8ea460600c832a2f46b383ff307986649a645585fb25c34fdfda75ad6e +DIST zfs-2.3.0-rc1.tar.gz 33887119 BLAKE2B dd4e159bef6de216cc51c1dd22620e6edb5b7503d95402022d0b9439471fe432181b1e5df2142e63cdac812a74b62657a96573b3bf48ad78bd6fd885a5f8913e SHA512 fe7de046dd48dbb67545726482a501788a1d5601e6e9a17deeb29047946689d9c8deb95f72b2b47c26a205a3c94fa1f0123437479a06b1376b9dac3dd6faf463 +DIST zfs-2.3.0-rc1.tar.gz.asc 195 BLAKE2B f70e6223e94a3f79d6d685b2b06254fba845d79768c82b7a3fedb865b6e6c97499c497def0f4c3e4a2869fed88b0965650ae88d5eb72c0ffaed43c4479d3bf96 SHA512 26b395feaf03e2be20b75ef64e573aa98a0706c46a1eb57503925731bf0cb9bf7fef8a2cdcf163233bccd7da9f5aedc0cae73f0183f39e0f13dcf315b4a5d809 +DIST zfs-2.3.0-rc3.tar.gz 33897910 BLAKE2B 518e2c56130a71d4c35f27328184e882815e2ca5b0524e660e174176bee4fdc554e4d1c8264d71f84b6c9641c08088f96a5c35adb5ef6f21b814ccadf093a256 SHA512 1ac53d3a006580f4a32fa33dddd6600d8abac401ed9fc86a2950a8241e0a9dc4a8954a32c44b28b10f22ba7c5cbd8871d9f21c13ccc291c366e9745e83431723 +DIST zfs-2.3.0-rc3.tar.gz.asc 195 BLAKE2B 34685869cb8d4f911b3ce0a5098411ce4cb346310564b7ad5fbe9cfc50a3bbe7665c8daa36384b2d5f3ee1dad4b98d6d5bad5a6b8e2f45da35354428853f748d SHA512 1f32119b24c703dd5dbdcce63ddc97cd24f2052522cf1f2f9a4228691d0db7c136262d98b38f2d795a4edfce1d25b423c5bc4f65dbc008bd12f64acc24f3406e DIST zfs-2.3.0.tar.gz 34029599 BLAKE2B b9fb7913f95dd0c8aec703961ecc0413aa51df889f15b1541ff8fcd7146ba485947fab83deb062bdffcdeab17a2465b7551c7eba3ec55c62c21aba58846c0da5 SHA512 f0bb1c6e28b325765be809dbc5d38ba294daa38b54eafd7d129cf6081fb209b200580437019faeed3614bbb0687d6583698a9282f3275905a1f5a8314a66cf0b DIST zfs-2.3.0.tar.gz.asc 836 BLAKE2B 9d1bd03dc6e5699236bca4c2b20a0a8b46e88d90ea58f7171d087c555da85d6af88acc5990f828ba455f9fbe24c90800c1edf74cd3f865b528730ffef8a931b8 SHA512 ba9a8e8b248de7383c8d33b84b0d70de026b8f3e6a1c82557b74ac274b28e559435541fbdfe816f6b80ce5098b3cac34af69cd53877f1f50fa6a846fa92a5dd0