Update Linux to 6.18

[sayanchowdhury]

Testing done

CI: https://jenkins.flatcar.org/job/container/job/packages_all_arches/490/

• Changelog entries added in the respective changelog/ directory (user-facing change, bug fix, security fix, update)
• Inspected CI output for image differences: /boot and /usr size, packages, list files for any missing binaries, kernel modules, config files, kernel modules, etc.

[Copilot]

Pull request overview

This PR updates the Flatcar/CoreOS kernel stack to Linux 6.18.26, including new kernel sources/modules/kernel ebuilds, updated kernel configuration for amd64/arm64, and compatibility fixes for the legacy NVIDIA 550.163.01 driver against newer kernel APIs.

Changes:

• Bump kernel sources to 6.18.26 (new coreos-sources, coreos-modules, coreos-kernel ebuilds + updated Manifest).
• Add/refresh downstream kernel patch set under coreos-sources/files/6.18/ (secure-boot/lockdown-related, build tooling tweaks).
• Extend old-nvidia-drivers-550.163.01 to support kernels up to 6.18 via additional patching and src_prepare adjustments.

Reviewed changes

Copilot reviewed 23 out of 23 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
sdk_container/src/third_party/coreos-overlay/x11-drivers/old-nvidia-drivers/old-nvidia-drivers-550.163.01-r2.ebuild	Bump supported kernel max to 6.18 and add NVIDIA 550 build-fix patches + in-tree sed adjustments.
sdk_container/src/third_party/coreos-overlay/x11-drivers/old-nvidia-drivers/files/0001-mm-use-vm_flags_reset-to-avoid-GPL-only-vma_start_wr.patch	Adapts NVIDIA mm/VMA flag helpers for Linux 6.15+ GPL/export changes.
sdk_container/src/third_party/coreos-overlay/x11-drivers/old-nvidia-drivers/files/0002-nvidia-drm-550.163.01-pass-drm_format_info-to-nv_drm.patch	Updates NVIDIA DRM fb_create plumbing for Linux 6.17+ API change (format info param).
sdk_container/src/third_party/coreos-overlay/x11-drivers/old-nvidia-drivers/files/0003-nvidia-use-hrtimer_setup-for-Linux-6.15.patch	Switches to hrtimer_setup() for Linux 6.15+ in the open kernel module path.
sdk_container/src/third_party/coreos-overlay/x11-drivers/old-nvidia-drivers/files/0004-nvidia-uvm-guard-iommu_dev_enable_disable_feature-fo.patch	Guards removed IOMMU SVA enable/disable calls for Linux 6.16+.
sdk_container/src/third_party/coreos-overlay/x11-drivers/old-nvidia-drivers/files/0005-nvidia-uvm-guard-SMMU-WAR-code-with-UVM_ATS_SMMU_WA.patch	Makes ARM64 SMMU WAR code conditional to avoid non-ARM build issues.
sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/Manifest	Adds distfiles entries for linux-6.18 + patch-6.18.26.
sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/coreos-sources-6.18.26.ebuild	New kernel sources ebuild for 6.18.26 with patch list for Flatcar deltas.
sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.18/z0001-pahole-support-reproducible-builds.patch	Enables reproducible-build support in pahole flags.
sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.18/z0002-Revert-x86-boot-Remove-the-bugger-off-message.patch	Reverts upstream removal needed for dm-verity hash storage per commit message.
sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.18/z0003-efi-Add-an-EFI_SECURE_BOOT-flag-to-indicate-secure-b.patch	Adds EFI secure boot flag plumbing and secureboot.c addition.
sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.18/z0003-efi-add-an-efi_secure_boot-flag-to-indicate-secure-b.patch	Duplicate alternate-form patch file for EFI secure boot flag plumbing.
sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.18/z0004-efi-Lock-down-the-kernel-if-booted-in-secure-boot-mo.patch	Adds lockdown-on-secure-boot behavior and related Kconfig/API changes.
sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.18/z0004-efi-lock-down-the-kernel-if-booted-in-secure-boot-mo.patch	Duplicate alternate-form patch file for secure-boot lockdown.
sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.18/z0005-mtd-phram-slram-Disable-when-the-kernel-is-locked-do.patch	Disables phram/slram mappings under kernel lockdown (security hardening).
sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.18/z0005-mtd-disable-slram-and-phram-when-locked-do.patch	Duplicate alternate-form patch file for phram/slram lockdown behavior.
sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.18/z0006-arm64-add-kernel-config-option-to-lock-down-when-in-.patch	Adds arm64 secure-boot lockdown config/plumbing via FDT params.
sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.18/z0007-tools-hv-fix-cross-compilation-for-ARM64.patch	Fixes Hyper-V tools Makefile logic for ARM64 cross builds.
sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/coreos-modules-6.18.26.ebuild	New modules ebuild for 6.18.26: builds vmlinux+modules and installs minimal build tree.
sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/files/commonconfig-6.18	New shared kernel config fragment for 6.18 (common options).
sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/files/amd64_defconfig-6.18	New amd64-specific config fragment for 6.18.
sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/files/arm64_defconfig-6.18	New arm64-specific config fragment for 6.18.
sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-kernel/coreos-kernel-6.18.26.ebuild	New kernel build/install ebuild for 6.18.26 (dracut/bootengine integration).

Suppressed comments (1)

sdk_container/src/third_party/coreos-overlay/x11-drivers/old-nvidia-drivers/old-nvidia-drivers-550.163.01-r2.ebuild:167

• Same issue as above: \b is not a portable/working word-boundary in sed. If this substitution doesn't match, del_timer_sync() won't be renamed and the build will still fail on kernels where it was renamed/removed. Prefer \< / \> for word boundaries.

	find "${S}" \( -name '*.c' -o -name '*.h' \) \
		-exec sed -i 's/\bdel_timer_sync\b/timer_delete_sync/g' {} + || die

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[dongsupark]

I think we should run Jenkins CI for all providers, especially for such a big Kernel bump.

[dongsupark]

Why is the kernel config CRYPTO_CRC32C is needed for building old nvidia drivers?

[dongsupark]

Huge thanks for working on old nvidia drivers.
When I was recently touching those, I was wondering if it would worth keeping this one, because of a huge amount of build issues with newer Kernel versions. Ideally we should deprecate them...? ;-)

[sayanchowdhury]

Yes, The problem is we don't have a deprecation plan with the older-sysext. We should urgently start discussing this as because we will start piling old versions on our end and it quite difficult to maintain.

[ader1990]

There were some new patches recently, maybe we can reuse the official one instead of this one: torvalds/linux@ca5ee0e

[Copilot]

Pull request overview

Copilot reviewed 22 out of 25 changed files in this pull request and generated 3 comments.

Suppressed comments (4)

sdk_container/src/third_party/coreos-overlay/x11-drivers/old-nvidia-drivers/old-nvidia-drivers-550.163.01-r2.ebuild:162

• The sed expression uses \b as a word-boundary, but in GNU sed regex \b is a backspace escape, not a word-boundary. This means the replacement likely never happens and the EXTRA_CFLAGS→ccflags-y migration won’t take effect on 6.15+ builds.

	find "${S}" \( -name 'Kbuild' -o -name 'Makefile' \) \
		-exec sed -i 's/\bEXTRA_CFLAGS\b/ccflags-y/g' {} + || die

sdk_container/src/third_party/coreos-overlay/x11-drivers/old-nvidia-drivers/old-nvidia-drivers-550.163.01-r2.ebuild:167

• Same issue here: \bdel_timer_sync\b won’t match as a word-boundary in GNU sed (\b is backspace). The rename to timer_delete_sync likely won’t be applied, defeating the intended compatibility fix.

	find "${S}" \( -name '*.c' -o -name '*.h' \) \
		-exec sed -i 's/\bdel_timer_sync\b/timer_delete_sync/g' {} + || die

sdk_container/src/third_party/coreos-overlay/x11-drivers/old-nvidia-drivers/files/0002-nvidia-drm-550.163.01-pass-drm_format_info-to-nv_drm.patch:143

• This patch claims to use the conftest symbol (NV_DRM_FB_CREATE_TAKES_FORMAT_INFO) instead of a hardcoded kernel version check, but the function prototype in nvidia-drm-fb.h is guarded by LINUX_VERSION_CODE >= 6.17. That can desync the prototype from the call sites guarded by defined(NV_DRM_FB_CREATE_TAKES_FORMAT_INFO) (e.g. with backports), causing build failures.

+#if LINUX_VERSION_CODE >= KERNEL_VERSION(6, 17, 0)
+    const struct drm_format_info *info,
+#endif

sdk_container/src/third_party/coreos-overlay/x11-drivers/old-nvidia-drivers/files/0002-nvidia-drm-550.163.01-pass-drm_format_info-to-nv_drm.patch:263

• Same conftest-vs-version mismatch in the non-open kernel/nvidia-drm/nvidia-drm-fb.h hunk: the prototype is guarded by LINUX_VERSION_CODE >= 6.17, while the rest of the patch uses defined(NV_DRM_FB_CREATE_TAKES_FORMAT_INFO). These need to use the same condition to avoid signature mismatches on backports/custom kernels.

+#if LINUX_VERSION_CODE >= KERNEL_VERSION(6, 17, 0)
+    const struct drm_format_info *info,
+#endif

[chewi]

Why? We explicitly include that in bootengine.

[Copilot]

Pull request overview

Copilot reviewed 24 out of 27 changed files in this pull request and generated 2 comments.

[Copilot]

Pull request overview

Copilot reviewed 23 out of 26 changed files in this pull request and generated no new comments.

Suppressed comments (4)

sdk_container/src/third_party/coreos-overlay/x11-drivers/old-nvidia-drivers/old-nvidia-drivers-550.163.01-r2.ebuild:167

• The del_timer_sync -> timer_delete_sync rewrite is applied unconditionally. That will break builds against kernels where timer_delete_sync() doesn't exist (older than the rename), even though this ebuild doesn't set a minimum supported kernel. Gate the rewrite on the target kernel version so older kernels keep del_timer_sync().

	# Linux 6.15 renamed del_timer_sync() to timer_delete_sync() (commit
	# d4b4c87). NVIDIA 550 calls del_timer_sync in nv.c and nv-nano-timer.c.
	find "${S}" \( -name '*.c' -o -name '*.h' \) \
		-exec sed -i 's/\bdel_timer_sync\b/timer_delete_sync/g' {} + || die

sdk_container/src/third_party/coreos-overlay/x11-drivers/old-nvidia-drivers/files/0002-nvidia-drm-550.163.01-pass-drm_format_info-to-nv_drm.patch:143

• This patch introduces NV_DRM_FB_CREATE_TAKES_FORMAT_INFO as a conftest-based feature probe, but the nvidia-drm-fb.h prototype is guarded by a hardcoded LINUX_VERSION_CODE check. That can cause prototype/definition mismatches on backported kernels where the conftest macro is defined but the version check is false. Guard the prototype with the same conftest macro used everywhere else in this patch.

+#if LINUX_VERSION_CODE >= KERNEL_VERSION(6, 17, 0)
+    const struct drm_format_info *info,
+#endif

sdk_container/src/third_party/coreos-overlay/x11-drivers/old-nvidia-drivers/files/0002-nvidia-drm-550.163.01-pass-drm_format_info-to-nv_drm.patch:263

• Same issue as above: the proprietary-tree nvidia-drm-fb.h prototype uses a LINUX_VERSION_CODE guard, but the rest of the patch uses the conftest macro. This can break on backports/non-standard versioning. Use NV_DRM_FB_CREATE_TAKES_FORMAT_INFO for the prototype guard.

+#if LINUX_VERSION_CODE >= KERNEL_VERSION(6, 17, 0)
+    const struct drm_format_info *info,
+#endif

sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/coreos-sources-6.18.45.ebuild:45

• There are duplicate 6.18 patch variants in files/6.18 (e.g. z0003-efi-add-..., z0004-efi-lock-down-..., z0005-mtd-disable-...) that are not listed in UNIPATCH_LIST, so they won't be applied by this ebuild. Keeping unused duplicate patches is confusing and makes it harder to tell what actually ships; either delete the unused variants or switch UNIPATCH_LIST to reference them.

UNIPATCH_LIST="
  ${PATCH_DIR}/z0001-pahole-support-reproducible-builds.patch \
  ${PATCH_DIR}/z0002-Revert-x86-boot-Remove-the-bugger-off-message.patch \
  ${PATCH_DIR}/z0003-efi-Add-an-EFI_SECURE_BOOT-flag-to-indicate-secure-b.patch \
  ${PATCH_DIR}/z0004-efi-Lock-down-the-kernel-if-booted-in-secure-boot-mo.patch \
  ${PATCH_DIR}/z0005-mtd-phram-slram-Disable-when-the-kernel-is-locked-do.patch \
  ${PATCH_DIR}/z0006-arm64-add-kernel-config-option-to-lock-down-when-in-.patch \
  ${PATCH_DIR}/z0007-tools-hv-fix-cross-compilation.patch \
"

[Copilot]

Pull request overview

Copilot reviewed 22 out of 27 changed files in this pull request and generated no new comments.

Suppressed comments (2)

sdk_container/src/third_party/coreos-overlay/x11-drivers/old-nvidia-drivers/files/0002-nvidia-drm-550.163.01-pass-drm_format_info-to-nv_drm.patch:143

• This patch introduces NV_DRM_FB_CREATE_TAKES_FORMAT_INFO specifically to avoid hardcoding a kernel version check, but the nv_drm_internal_framebuffer_create() prototype is still guarded by LINUX_VERSION_CODE >= 6.17. That can break builds on kernels with backports/non-standard versioning (prototype won’t match the call sites guarded by NV_DRM_FB_CREATE_TAKES_FORMAT_INFO). Guard the prototype with the conftest macro instead.

+#if LINUX_VERSION_CODE >= KERNEL_VERSION(6, 17, 0)
+    const struct drm_format_info *info,
+#endif

sdk_container/src/third_party/coreos-overlay/x11-drivers/old-nvidia-drivers/files/0002-nvidia-drm-550.163.01-pass-drm_format_info-to-nv_drm.patch:263

• Same issue as above for the proprietary kernel/ tree: the prototype is version-guarded (6.17) while the implementation/call sites use NV_DRM_FB_CREATE_TAKES_FORMAT_INFO. Use the conftest macro for the prototype guard to keep the patch backport-friendly.

+#if LINUX_VERSION_CODE >= KERNEL_VERSION(6, 17, 0)
+    const struct drm_format_info *info,
+#endif

[Copilot]

🟡 Changes recommended

The newly added NVIDIA conftest probes (and one DRM prototype guard) are currently inconsistent/incorrect in a way that can prevent feature detection and break builds, especially with backported kernel APIs.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review details

Suppressed comments (3)

sdk_container/src/third_party/coreos-overlay/x11-drivers/old-nvidia-drivers/files/0006-nvidia-uvm-adapt-to-page_pgmap-and-make_device_excl.patch:75

• The conftest probe for make_device_exclusive() calls it with no arguments, which will fail compilation if the function exists with parameters (as expected). This prevents NV_MAKE_DEVICE_EXCLUSIVE_PRESENT from ever being defined and will select the wrong code path.

+            void conftest_make_device_exclusive(void) {
+                make_device_exclusive();
+            }"

sdk_container/src/third_party/coreos-overlay/x11-drivers/old-nvidia-drivers/files/0002-nvidia-drm-550.163.01-pass-drm_format_info-to-nv_drm.patch:143

• This declaration guards the extra info parameter with LINUX_VERSION_CODE, but the definitions/callers in this patch use the conftest macro NV_DRM_FB_CREATE_TAKES_FORMAT_INFO. On a kernel with backported API changes (signature update without version bump), that mismatch will cause a prototype/definition conflict and fail the build.

+#if LINUX_VERSION_CODE >= KERNEL_VERSION(6, 17, 0)
+    const struct drm_format_info *info,
+#endif

sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/coreos-sources-6.18.45.ebuild:45

• The 6.18 patch directory contains duplicate/alternate patch files (e.g. z0003/z0004/z0005 lower-case variants) that are not referenced by UNIPATCH_LIST. Leaving unused patch files around is easy to trip over during future bumps (someone may edit the wrong one or assume it’s applied).

UNIPATCH_LIST="
  ${PATCH_DIR}/z0001-pahole-support-reproducible-builds.patch \
  ${PATCH_DIR}/z0002-Revert-x86-boot-Remove-the-bugger-off-message.patch \
  ${PATCH_DIR}/z0003-efi-Add-an-EFI_SECURE_BOOT-flag-to-indicate-secure-b.patch \
  ${PATCH_DIR}/z0004-efi-Lock-down-the-kernel-if-booted-in-secure-boot-mo.patch \
  ${PATCH_DIR}/z0005-mtd-phram-slram-Disable-when-the-kernel-is-locked-do.patch \
  ${PATCH_DIR}/z0006-arm64-add-kernel-config-option-to-lock-down-when-in-.patch \
  ${PATCH_DIR}/z0007-tools-hv-fix-cross-compilation.patch \
"

• Files reviewed: 24/28 changed files
• Comments generated: 1
• Review effort level: Lite

[Copilot]

🟡 Changes recommended

There is at least one confirmed functional packaging issue (a new NVIDIA 6.18 compatibility patch is present but not applied) plus a confirmed case-collision hazard from duplicate patch filenames.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review details

Suppressed comments (1)

sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/coreos-sources-6.18.45.ebuild:42

• The 6.18 patch directory contains both z0003-efi-Add-… and z0003-efi-add-… (and similarly z0004-efi-Lock-… vs z0004-efi-lock-…). These differ only by filename case, which breaks checkouts/archives on case-insensitive filesystems and makes it ambiguous which variant should be used. Please drop the unused duplicates (or rename them so they don’t collide) and keep UNIPATCH_LIST pointing at the single canonical copy.

  ${PATCH_DIR}/z0001-pahole-support-reproducible-builds.patch \
  ${PATCH_DIR}/z0002-Revert-x86-boot-Remove-the-bugger-off-message.patch \
  ${PATCH_DIR}/z0003-efi-Add-an-EFI_SECURE_BOOT-flag-to-indicate-secure-b.patch \
  ${PATCH_DIR}/z0004-efi-Lock-down-the-kernel-if-booted-in-secure-boot-mo.patch \
  ${PATCH_DIR}/z0005-mtd-phram-slram-Disable-when-the-kernel-is-locked-do.patch \

• Files reviewed: 24/28 changed files
• Comments generated: 1
• Review effort level: Lite

[Copilot]

🔵 Needs a closer look

There is at least one concrete packaging regression (missing /usr/lib/modules/.../source compatibility symlink) and several duplicate/unreferenced kernel patch files that should be cleaned up to avoid maintenance confusion.

Review details

Suppressed comments (1)

sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/coreos-modules-6.18.45.ebuild:63

• The 6.12.x coreos-modules ebuild installed a /usr/lib/modules/${KV_FULL}/source -> build symlink for compatibility (many external module build systems expect it). The new 6.18 ebuild omits this, which can break out-of-tree module builds that rely on the conventional "source" path.

	# Not strictly required but this is where we used to install the config.
	dosym "../${build}/.config" "/usr/boot/config-${KV_FULL}"
	dosym "../${build}/.config" "/usr/boot/config"
}

• Files reviewed: 24/28 changed files
• Comments generated: 0 new
• Review effort level: Lite

[Copilot]

🟡 Changes recommended

The new NVIDIA 6.18 compatibility patch contains a broken error-path return and a conftest probe that may fail under -Werror, risking module build failures.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review details

Suppressed comments (1)

sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/coreos-sources-6.18.45.ebuild:41

• The PATCH_DIR contains both the new format-patch style patches (e.g. z0003-efi-Add-… / z0004-efi-Lock-down-… / z0005-mtd-phram-…) and older duplicate variants (z0003-efi-add-…, z0004-efi-lock-down-…, z0005-mtd-disable-…). Since only one set is referenced in UNIPATCH_LIST, the extra patch files are dead weight and a future footgun (someone edits the wrong one).

UNIPATCH_LIST="
  ${PATCH_DIR}/z0001-pahole-support-reproducible-builds.patch \
  ${PATCH_DIR}/z0002-Revert-x86-boot-Remove-the-bugger-off-message.patch \
  ${PATCH_DIR}/z0003-efi-Add-an-EFI_SECURE_BOOT-flag-to-indicate-secure-b.patch \
  ${PATCH_DIR}/z0004-efi-Lock-down-the-kernel-if-booted-in-secure-boot-mo.patch \

• Files reviewed: 24/28 changed files
• Comments generated: 3
• Review effort level: Lite