Skip to content

Conversation

@github-actions
Copy link

@github-actions github-actions bot commented Dec 9, 2025

https://ciqinc.atlassian.net/browse/KERNEL-309

This PR was created by this WIP workflow: https://github.com/ctrliq/kernel-src-tree/blob/clk-rebase-ga/.github/workflows/clk-rebase.yml The workflow definitely needs more work, but I think the PR it created is sufficient to actually do the rebase to 6.12.61.

The workflow made the commit for the PAHOLE_VERSION config changes, but I manually rewrote the commit message. In this case it was actually a package change (not a kernel change) that caused the config change, but even in the case of future config changes driven by the kernel I think we will always end up rewriting the commit to explain the changes.

You may have noticed that the number of passed kselftests reported in this PR is lower than that for 6.12.60 (562 vs 493). That is mainly because I have disabled the net/forwarding tests in this workflow since they take too long and put the job time over 6 hours. I went back and looked at the kselftest logs from my manual test of 6.12.60 and found that they contributed 107 oks, but they were all skipped. So really, disabling that test here has lost us nothing compared to my manual testing as far as net/forwarding goes, and we've picked up 38 oks from elsewhere.

brett@lycia ~/ciq/le-4734/kselftest-logs
 % grep -a net/forwarding selftest-6.12.60-automation_tmp_ciq-6.12.y-next-0a2394452f7b+-1.log | grep ^ok | wc -l
107
brett@lycia ~/ciq/le-4734/kselftest-logs
 % grep -a net/forwarding selftest-6.12.60-automation_tmp_ciq-6.12.y-next-0a2394452f7b+-1.log | grep ^ok | grep SKIP | wc -l
107
brett@lycia ~/ciq/le-4734/kselftest-logs
 %

Automated Rebase to v6.12.61

Config Changes

commit a40f0da8c3e83dcb28313b6f6c515e08cdd156df (HEAD -> {automation_tmp}_ciq-6.12.y-next, origin/{automation_tmp}_ciq-6.12.y-next)
Author: Brett Mastbergen <[email protected]>
Date:   Wed Dec 10 09:54:23 2025 -0500

    [CIQ] configs: Update PAHOLE_VERSION to 130

    This is shown as an update for 6.12.61, but actually has nothing to
    do with the kernel version.  The dwarves package in rocky 9 was upgraded
    to 1.30 which changes the detected pahole version to 130.

 ciq/configs/kernel-aarch64-64k-debug.config | 4 ++--
 ciq/configs/kernel-aarch64-64k.config       | 4 ++--
 ciq/configs/kernel-aarch64-debug.config     | 4 ++--
 ciq/configs/kernel-aarch64.config           | 4 ++--
 ciq/configs/kernel-x86_64-debug.config      | 4 ++--
 ciq/configs/kernel-x86_64.config            | 4 ++--
 6 files changed, 12 insertions(+), 12 deletions(-)

Build Log

/__w/kernel-src-tree/kernel-src-tree/kernel-src-tree
Running make mrproper...
  CLEAN   scripts/basic
  CLEAN   scripts/kconfig
  CLEAN   include/config include/generated .config .config.old
[TIMER]{MRPROPER}: 4s
x86_64 architecture detected, copying config
'ciq/configs/kernel-x86_64.config' -> '.config'
Setting Local Version for build
CONFIG_LOCALVERSION="-automation_tmp_ciq-6.12.y-next-1dbb47586afb"
Making olddefconfig
--
  HOSTCC  scripts/kconfig/util.o
  HOSTLD  scripts/kconfig/conf
#
# configuration written to .config
#
Starting Build
  GEN     arch/x86/include/generated/asm/orc_hash.h
  WRAP    arch/x86/include/generated/uapi/asm/bpf_perf_event.h
  WRAP    arch/x86/include/generated/uapi/asm/errno.h
  WRAP    arch/x86/include/generated/uapi/asm/fcntl.h
  WRAP    arch/x86/include/generated/uapi/asm/ioctl.h
--
  BTF [M] net/hsr/hsr.ko
  BTF [M] net/qrtr/qrtr-mhi.ko
  BTF [M] net/qrtr/qrtr.ko
  LD [M]  virt/lib/irqbypass.ko
  BTF [M] virt/lib/irqbypass.ko
[TIMER]{BUILD}: 1888s
Making Modules
  SYMLINK /lib/modules/6.12.61-automation_tmp_ciq-6.12.y-next-1dbb47586afb+/build
  INSTALL /lib/modules/6.12.61-automation_tmp_ciq-6.12.y-next-1dbb47586afb+/modules.order
  INSTALL /lib/modules/6.12.61-automation_tmp_ciq-6.12.y-next-1dbb47586afb+/modules.builtin
  INSTALL /lib/modules/6.12.61-automation_tmp_ciq-6.12.y-next-1dbb47586afb+/modules.builtin.modinfo
--
  SIGN    /lib/modules/6.12.61-automation_tmp_ciq-6.12.y-next-1dbb47586afb+/kernel/net/qrtr/qrtr.ko
  STRIP   /lib/modules/6.12.61-automation_tmp_ciq-6.12.y-next-1dbb47586afb+/kernel/virt/lib/irqbypass.ko
  SIGN    /lib/modules/6.12.61-automation_tmp_ciq-6.12.y-next-1dbb47586afb+/kernel/net/qrtr/qrtr-mhi.ko
  SIGN    /lib/modules/6.12.61-automation_tmp_ciq-6.12.y-next-1dbb47586afb+/kernel/virt/lib/irqbypass.ko
  DEPMOD  /lib/modules/6.12.61-automation_tmp_ciq-6.12.y-next-1dbb47586afb+
[TIMER]{MODULES}: 11s
Making Install
  INSTALL /boot
dracut: WARNING: running in hostonly mode in a container!!
[TIMER]{INSTALL}: 14s
Skipping kABI check
Setting Default Kernel to /boot/vmlinuz-6.12.61-automation_tmp_ciq-6.12.y-next-1dbb47586afb+ and Index to 0

Testing

Selftests passed: 493 tests

Artifacts

PlaidCat and others added 10 commits December 9, 2025 16:01
Adding configs based of Fedora-ARK default config from 6.12.15.

We are modifying these with the following configs where available
CONFIG_MODIFY_LDT_SYSCALL=n
CONFIG_LEGACY_VSYSCALL_NONE=n
These options are for old software support which adds performance
overhead and potential attack surfaces with go against the CIQ LT
kernels priority of performance and security.

CONFIG_LIVEPATCH=n
We do not have Live patching on for any road-map, is not even supported
as a config for ARM.

CONFIG_WQ_POWER_EFFICIENT_DEFAULT=y
This should be enabled, it often improves performance funnily enough

CONFIG_PREEMPT_VOLUNTARY=y
CONFIG_HZ=100
These are set to increase throughput CONFIG_PREEMPT_VOLUNTARY=y (default
Fedora config) but CONFIG_HZ=100 for higher throughput over the x86_64
default of CONFIG_HZ=1000 which provides lower latency.
Setting up the default build configs to ensure everything builds when we
update and rebase.
jira LE-2629
feature Additional SecureBoot patches for dynamic lockdown
commit 78c8af872660c31779951583b6f1ebf283d95985
commit-source https://salsa.debian.org/kernel-team/linux.git
commit-patch-path debian/patches/features/all/lockdown
commit-info Checkout the commit sha above and move to the directory
            listed above to find Debian patches matching this commits
	    summary line.

Add a kernel configuration option to lock down the kernel, to restrict
userspace's ability to modify the running kernel when UEFI Secure Boot is
enabled. Based on the x86 patch by Matthew Garrett.

Determine the state of Secure Boot in the EFI stub and pass this to the
kernel using the FDT.

Signed-off-by: Linn Crosetto <[email protected]>
[bwh: Forward-ported to 4.10: adjust context]
[Lukas Wunner: Forward-ported to 4.11: drop parts applied upstream]
[bwh: Forward-ported to 4.15 and lockdown patch set:
 - Pass result of efi_get_secureboot() in stub through to
   efi_set_secure_boot() in main kernel
 - Use lockdown API and naming]
[bwh: Forward-ported to 4.19.3: adjust context in update_fdt()]
[dannf: Moved init_lockdown() call after uefi_init(), fixing SB detection]
[bwh: Drop call to init_lockdown(), as efi_set_secure_boot() now calls this]
[bwh: Forward-ported to 5.6: efi_get_secureboot() no longer takes a
 sys_table parameter]
[bwh: Forward-ported to 5.7: EFI initialisation from FDT was rewritten, so:
 - Add Secure Boot mode to the parameter enumeration in fdtparams.c
 - Add a parameter to efi_get_fdt_params() to return the Secure Boot mode
 - Since Xen does not have a property name defined for Secure Boot mode,
   change efi_get_fdt_prop() to handle a missing property name by clearing
   the output variable]
[Salvatore Bonaccorso: Forward-ported to 5.10: f30f242 ("efi: Rename
arm-init to efi-init common for all arch") renamed arm-init.c to efi-init.c]

Signed-off-by: Jonathan Maple <[email protected]>
jira LE-2629
feature Additional SecureBoot patches for dynamic lockdown
commit 78c8af872660c31779951583b6f1ebf283d95985
commit-source https://salsa.debian.org/kernel-team/linux.git
commit-patch-path debian/patches/features/all/lockdown
commit-info Checkout the commit sha above and move to the directory
            listed above to find Debian patches matching this commits
            summary line.
UEFI machines can be booted in Secure Boot mode.  Add an EFI_SECURE_BOOT
flag that can be passed to efi_enabled() to find out whether secure boot is
enabled.

Move the switch-statement in x86's setup_arch() that inteprets the
secure_boot boot parameter to generic code and set the bit there.

Suggested-by: Ard Biesheuvel <[email protected]>
Signed-off-by: David Howells <[email protected]>
Reviewed-by: Ard Biesheuvel <[email protected]>
cc: [email protected]
[rperier: Forward-ported to 5.5:
 - Use pr_warn()
 - Adjust context]
[bwh: Forward-ported to 5.6: adjust context]
[bwh: Forward-ported to 5.7:
 - Use the next available bit in efi.flags
 - Adjust context]
Signed-off-by: Jonathan Maple <[email protected]>
jira LE-2629
feature Additional SecureBoot patches for dynamic lockdown
commit 78c8af872660c31779951583b6f1ebf283d95985
commit-source https://salsa.debian.org/kernel-team/linux.git
commit-patch-path debian/patches/features/all/lockdown
commit-info Checkout the commit sha above and move to the directory
            listed above to find Debian patches matching this commits
            summary line.

Based on an earlier patch by David Howells, who wrote the following
description:

> UEFI Secure Boot provides a mechanism for ensuring that the firmware will
> only load signed bootloaders and kernels.  Certain use cases may also
> require that all kernel modules also be signed.  Add a configuration option
> that to lock down the kernel - which includes requiring validly signed
> modules - if the kernel is secure-booted.

Signed-off-by: Ben Hutchings <[email protected]>
[Salvatore Bonaccorso: After fixing https://bugs.debian.org/956197 the
help text for LOCK_DOWN_IN_EFI_SECURE_BOOT was adjusted to mention that
lockdown is triggered in integrity mode (https://bugs.debian.org/1025417)]
Signed-off-by: Salvatore Bonaccorso <[email protected]>
Signed-off-by: Jonathan Maple <[email protected]>
jira LE-2629
feature Additional SecureBoot patches for dynamic lockdown
commit 78c8af872660c31779951583b6f1ebf283d95985
commit-source https://salsa.debian.org/kernel-team/linux.git
commit-patch-path debian/patches/features/all/lockdown
commit-info Checkout the commit sha above and move to the directory
            listed above to find Debian patches matching this commits
            summary line.

These drivers allow mapping arbitrary memory ranges as MTD devices.
This should be disabled to preserve the kernel's integrity when it is
locked down.

* Add the HWPARAM flag to the module parameters
* When slram is built-in, it uses __setup() to read kernel parameters,
  so add an explicit check security_locked_down() check

Signed-off-by: Ben Hutchings <[email protected]>
Cc: Matthew Garrett <[email protected]>
Cc: David Howells <[email protected]>
Cc: Joern Engel <[email protected]>
Cc: [email protected]
Signed-off-by: Jonathan Maple <[email protected]>
jira LE-2629
feature Fedora EFI status status
ommit 7a60169d168d6aae70aca10b7b71070666068529
commit-source https://gitlab.com/cki-project/kernel-ark/

This adds efi_status_to_str() for use when printing efi_status_t
messages, and reworks efi_status_to_err() so that the two use a common
list of errors.

Upstream Status: RHEL only
Signed-off-by: Peter Jones <[email protected]>
Signed-off-by: Jonathan Maple <[email protected]>
jira LE-2629

The config option CONFIG_LOCK_DOWN_IN_EFI_SECURE_BOOT is enabled for
x86_64 from our base kernel-ark fork process however since we
prioritized the additional lockdown patches from Debian as they also
support ARM they've also set the config CONFIG_LOCK_DOWN_IN_EFI_SECURE_BOOT
to for their arm configs as well so we must do the same.

For technical reasons its defined here:
https://salsa.debian.org/kernel-team/linux/-/blob/debian/latest/debian/config/config?ref_type=heads#L7762

It was validated that this is the generic setting by downloading their
arm64 configs from here:
https://packages.debian.org/sid/amd64/linux-config-6.12/download
jira LE-2628

The config changes should have been run through make olddefconfig but
were not after making their modifications.  We want to do thsi so that
we can identify easily configs that might be introduced in a Zeta
release of the LT or Stable GKH kernels.

Fixes: 59a132d
[CIQ] v6.12.17 config updates

All configs dropped the follwoing since its dependent on ARCH_MVEBU
which is not configured on so there is no reason to ask.
 # CONFIG_CZNIC_PLATFORMS is not set
See upstream commit: dd0f05b

x86_64 configs also dropped a previously defined y config
 -CONFIG_IMX_SCMI_MISC_DRV=y
 This comes from firmware: imx: IMX_SCMI_MISC_DRV should depend on ARCH_MXC
See Upstream Commit: be6686b
Whats a little confusing is that the fedora kernel-ark says that this is
marked as a `y`
$ cat redhat/configs/rhel/generic/CONFIG_IMX_SCMI_MISC_DRV
CONFIG_IMX_SCMI_MISC_DRV=y

[kernel-ark]$ ls redhat/configs/kernel-6.13.8-x86_64*
redhat/configs/kernel-6.13.8-x86_64-automotive.config
redhat/configs/kernel-6.13.8-x86_64.config
redhat/configs/kernel-6.13.8-x86_64-rt.config
redhat/configs/kernel-6.13.8-x86_64-automotive-debug.config
redhat/configs/kernel-6.13.8-x86_64-debug.config
redhat/configs/kernel-6.13.8-x86_64-rt-debug.config

[kernel-ark]$ grep CONFIG_IMX_SCMI_MISC_DRV redhat/configs/kernel-6.13.8-x86_64*
[kernel-ark]$

Do to this we're leaving this as the default Kconfig of off for x86_64

[CIQ] v6.12.19 - rebased configs

These are all default options that are extending other selections
already present in our configs.

FW_CACHE is enabled ddue to PM_SLEEP being enabled in all kernels
 drm/nouveau: select FW caching
 Upstream commit 6b481ab

DRM_CLIENT_SELECTION is enabled due to this change for nouveau
 drm/nouveau: Run DRM default client setup
 Upstream commit ef35089

DRM_CLIENT_SETUP is selected if DRM_CLIENT_SELECTION is selected and if
DRM_FBDEV_EMULATION is selected which is selected in all configs
 drm: Add client-agnostic setup helper
 Upstream comimt d07fdf9

[CIQ] v6.12.23 - rebased configs

HAVE_EISA is only allowed for 32-bit
 x86/platform: Only allow CONFIG_EISA for 32-bit
 Upstream: commit 3e14d9a

LD_CAN_USE_KEEP_IN_OVERLAY is now enabled if LD_IS_BFD=y
 ARM: 9443/1: Require linker to support KEEP within OVERLAY for DCE
 Upstream: 59fc423

[CIQ] v6.12.24 - rebased configs

CONFIG_IRQ_BYPASS_MANAGER now follows KVM
CONFIG_HAVE_KVM_IRQ_BYPASS now follows KVM
 KVM: Allow building irqbypass.ko as as module when kvm.ko is a module
 Upstream: fae0a87

CONFIG_HID_UNIVERSAL_PIDFF is new
 HID: Add hid-universal-pidff driver and supported device ids
 Upstream: f45f26a

[CIQ] v6.12.25 - rebased configs

CONFIG_SND_HDA_CIRRUS_SCODEC and
CONFIG_SND_HDA_CIRRUS_SCODEC_KUNIT_TEST are no longer
automatically selected on arm64 builds
 ALSA: hda/cirrus_scodec_test: Don't select dependencies
 Upstream: 9b019be

[CIQ] v6.12.27 - rebased configs

The following changes come from :
  crypto: lib/Kconfig - Hide arch options from user
  17ec3e7
  which is a fix and simplificatio for:
    crypto: lib/Kconfig - Fix lib built-in failure when arch is modular
    1047e21

kernel-aarch64-64k-debug.config
kernel-aarch64-64k.config
kernel-aarch64-debug.config
kernel-aarch64.config
kernel-x86_64-debug.config
kernel-x86_64.config
 CONFIG_CRYPTO_LIB_CHACHA_INTERNAL=y
 CONFIG_CRYPTO_LIB_CURVE25519_INTERNAL=m
 CONFIG_CRYPTO_LIB_POLY1305_INTERNAL=y

kernel-x86_64-debug.config
kernel-x86_64.config
 -CONFIG_CRYPTO_ARCH_HAVE_LIB_CURVE25519=m
 +CONFIG_CRYPTO_ARCH_HAVE_LIB_CURVE25519=y

[CIQ] v6.12.29 - rebased configs

CONFIG_MITIGATION_ITS is new and enabled by default for x86
 x86/its: Add support for ITS-safe indirect thunk
 Upstream: 16a7d5b

[CIQ] v6.12.35 - rebased configs

CONFIG_LONGEST_SYM_KUNIT_TEST was added and defaults to =m
because our config already has CONFIG_KUNIT_ALL_TESTS=m
 Kunit to check the longest symbol length
 Upstream: b8abcba

[CIQ] v6.12.37 - rebased configs

CONFIG_MITIGATION_TSA set to yes to deal with AMD TSA hardware attacks
 x86/bugs: Add a Transient Scheduler Attacks mitigation
 Upstream: d8010d4

[CIQ] v6.12.42 - rebased configs

VHOST_ENABLE_FORK_OWNER_CONTROL was added and defaults to y so all
of our configs include it now
 vhost: Reintroduce kthread API and add mode selection
 Upstream: b2a3018

[CIQ] v6.12.44 - rebased configs

Previously the aarch64 64k configs explicitly did not set
DRM_XE.  But now DRM_XE is marked as BROKEN if page size is
not 4k, so DRM_XE is not set by default in these configs
due to the 64k page size.

 Mark xe driver as BROKEN if kernel page size is not 4kBI
 Upstream: ec22f92

[CIQ] v6.12.47 - rebased configs

CONFIG_MITIGATION_VMSCAPE is added and enabled for VMSCAPE attacks.
x86/vmscape: Enable the mitigation
Upstream commit 556c1ad
@bmastbergen bmastbergen force-pushed the {automation_tmp}_ciq-6.12.y-next branch from 1dbb475 to b3648f2 Compare December 10, 2025 14:53
This is shown as an update for 6.12.61, but actually has nothing to
do with the kernel version.  The dwarves package in rocky 9 was upgraded
to 1.30 which changes the detected pahole version to 130.
@bmastbergen bmastbergen force-pushed the {automation_tmp}_ciq-6.12.y-next branch from b3648f2 to a40f0da Compare December 10, 2025 14:54
@bmastbergen bmastbergen changed the title TESTING TESTING TESTING [CIQ 6.12] Rebase to v6.12.61 [CIQ 6.12] Rebase to v6.12.61 Dec 10, 2025
@bmastbergen bmastbergen requested a review from a team December 10, 2025 15:21
@bmastbergen bmastbergen merged commit a40f0da into ciq-6.12.y-next Dec 11, 2025
6 checks passed
@bmastbergen bmastbergen deleted the {automation_tmp}_ciq-6.12.y-next branch December 11, 2025 16:29
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.

8 participants