| Age | Commit message (Collapse) | Author |
|---|
|
Upgrade rolling release Kernel version.
This is not a routine bump: 6.18.39 through 6.18.41 are unbootable on Intel
Denverton (DNV), Ice Lake Xeon D (ICX-D/CDF) and Snowridge (SNR) platforms,
which covers a large part of the small-form-factor hardware VyOS is deployed
on. We moved to 6.18.41 in 97c2a87c0 (T9067).
Upstream b1b4efea05a5 ("serial: 8250_mid: Disable DMA for selected platforms",
in stable since v6.18.39) set dnv_board.setup and dnv_board.exit to
PTR_IF(false, ...) to work around a DMA errata, but left the three call sites
in mid8250_probe() and mid8250_remove() dereferencing them unguarded. Since
CONFIG_SERIAL_8250_MID=y in our defconfig, the driver is built in and the
resulting NULL function pointer call happens during early PCI probe, killing
the probing kworker with interrupts disabled and wedging the boot:
CPU: 0 UID: 0 PID: 11 Comm: kworker/0:1 Not tainted 6.18.41-vyos #1
Hardware name: Supermicro SYS-510D-10C-FN6P/X12SDV-10C-SP6F, BIOS 2.2a
Workqueue: events work_for_cpu_fn
RIP: 0010:0x0
Call Trace:
mid8250_probe.part.0+0x10c/0x230
local_pci_probe+0x41/0x90
work_for_cpu_fn+0x16/0x20
note: kworker/0:1[11] exited with irqs disabled
The missing NULL checks were added by 7fb13fd7e9a5 ("serial: 8250_mid: Fix
NULL function pointer dereference on DNV/ICX-D/SNR platforms"), which is in
stable as of v6.18.42, so any release from .42 onwards resolves this. Taking
.44 as the current 6.18.y tip.
All five patches under patches/kernel/ still apply: of the files they touch,
only net/ipv6/route.c saw upstream changes in this range (1db34097998c, in
__ip6_del_rt_siblings() around line 4011), which does not overlap the
rt6_link_filter()/rt6_score_route() hunks of 0001 around line 717.
Changelogs:
* 6.18.44 https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.18.44
* 6.18.43 https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.18.43
* 6.18.42 https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.18.42
|
|
T8329: Make the Azure VF-naming helper script 'vyos_vf_name' available in initramfs
|
|
Upgrade rolling release Kernel version.
Changelogs:
* 6.18.41 https://lwn.net/Articles/1086227/
* 6.18.40 https://lwn.net/Articles/1084923/
* 6.18.39 https://lwn.net/Articles/1083464/
|
|
|
|
initramfs so that VFs with add events appearing in early stage can be renamed using this script
|
|
|
|
`icon_heigh` is a typo of the GRUB2 boot_menu property `icon_height`. Icons are
already disabled in this menu via `icon_width = 0` + `item_icon_space = 0`, so
correcting the property name is behaviour-neutral. Clears the lone typos-check
hit on this repo ahead of the T8490 ruleset pilot active flip.
đŸ¤– Generated by [robots](https://vyos.io)
|
|
|
|
T8099: Update strongswan to 6.0.6
|
|
geoip: T5746: Download ASN database
|
|
|
|
* Upgrade to 6.0.6
* Update 30-strongswan-configs.chroot to not change
/etc/strongswan.d/charon.conf as the file is part of package
strongswan-charon that should not be installed
* Rebase all patches
* Enable ML-KEM for Post Quantum
|
|
As salt has been marked deprecated via T8056 and is thus deprecated in VyOS 1.5
and VyOS 1.4 it is time to remove it from the rolling release.
|
|
|
|
|
|
|
|
* T8947: migrate remaining current→rolling residuals on rolling branch
Post-1c the default branch is `rolling`, but several build-config values
on this branch still referenced the old `current` repo path / codename /
train identity. These are not cosmetic — they break the rolling ISO build:
- docker/vyos-dev.list: apt source baked into vyos/vyos-build:rolling still
pointed at repositories/current (Hit/Err on package builds). Now
repositories/rolling + codename `rolling` (verified against live repo:
Suite/Codename `rolling`, Components `main`).
- data/defaults.toml: vyos_mirror → repositories/rolling; vyos_branch →
rolling (build-vyos-image checks out vyos-1x at this branch — `current`
no longer exists post-1c); release_train → rolling (apt pin codename +
os-release identity).
- data/live-build-config/archives/vyos-dev.pref.chroot: Pin codename
n=rolling to match the repo.
- data/versions: key current→rolling. build-vyos-image looks up
version_mapping[git_branch]; git_branch is `rolling`, so the `current`
key KeyErrored and the version fell back to 999.<timestamp>.
- .github/config/smoketest-branches.json: rolling-train entry key
current→rolling (looked up by branch name; was already 404ing on
rolling) + mirror + container_image to rolling.
os-release impact (intended): rolling images now report
VERSION_CODENAME=rolling and "(rolling)" in PRETTY_NAME/VERSION. The
-rolling version suffix is hardcoded and unaffected.
Companion to Rollout 1c (T8943). Ref IS-504.
đŸ¤– Generated by [robots](https://vyos.io)
* T8947: finish current→rolling residuals in docs/Dockerfile examples
Address adversarial-review findings (Codex) — stale current refs on the
rolling branch outside build config:
- .github/PULL_REQUEST_TEMPLATE.md: CONTRIBUTING link vyos-1x/blob/current
→ blob/rolling (was a broken link — vyos-1x renamed current→rolling in 1c).
- README.md: "Development Branches" section described the default branch as
`current`; updated to `rolling` (dropped the obsolete "may switch to main"
note — the rename already happened, to rolling).
- docker/Dockerfile: build-example comments vyos-build:current* →
vyos-build:rolling*.
Ref IS-504, companion to T8943.
đŸ¤– Generated by [robots](https://vyos.io)
|
|
The Kernel 6.18.33 now has an upstream fix for the fragnesia vulnerability
|
|
This fixes the LPE https://github.com/0xdeadbeefnetwork/ssh-keysign-pwn
|
|
serial: T8844: fix default config injection leading to invalid boot console
|
|
With all the latest serial interface changes - and the resulting patching of
the default configuration based on the build flavor - the serial console
was always injected by a helper named write-config-file-value.py, even if the
console_type was set to tty instead of ttyS or ttyAMA.
This was a pending issue in the rolling tests for the PROXMOX flavor. It is
applicable to every other flavor using tty as default console.
|
|
Kernel: T6847: update Intel Out-Of-Tree drivers for IGB, IXGBE, I40e, ICE and IAVF
|
|
Stable kernels with Hyunwoo Kim's patch [1] for the second vulnerability
CVE-2026-43500 reported with Dirty Frag and Copy Fail 2.
1: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=aa54b1d27fe0c2b78e664a34fd0fdf7cd1960d71
|
|
The Intel iavf driver (formerly i40evf) is the Linux virtual function driver
for modern Intel Ethernet adapters supporting SR-IOV, including the X700/E800
series.
Renamed to iavf to support future devices, it replaced i40evf entirely by 2019.
The driver facilitates high-performance networking in virtualized environments.
This commit contains custom patches to make the driver build.
|
|
The current version of the Intel ice driver does not compile with a recent
LTS Kernel due to missing internal Kernel API adjustments in the Intel driver.
This commit contains custom patches to make the driver build.
|
|
The current version of the Intel i40e driver does not compile with a recent
LTS Kernel due to missing internal Kernel API adjustments in the Intel driver.
This commit contains custom patches to make the driver build.
|
|
These kernels contain a partial fix for the Dirty Frag [1] and
Copy Fail 2 [2] security flaws.
1: https://github.com/V4bel/dirtyfrag#dirty-frag-universal-linux-lpe
2: https://www.openwall.com/lists/oss-security/2026/05/07/12
|
|
* Forwared port all out-of-tree driver patches
* Add Intel QAT patch to make it compile for LInux 6.18
* Remove out-of-tree OpenVPN DCO module - now available upstream
|
|
|
|
Kernel: T861: add custom VyOS CA to Kernel builds for later module signing
|
|
With this addition we can always sign a Kernel module later and ship it if
needed, without re-compiling the Kernel.
Kernel will report:
[ 1.223891] Loaded X.509 cert 'VyOS Networks Secure Boot Signer 2025 - linux: 6ca57e2add335babd08da69b48c70693edd2b037'
Issuer: CN = VyOS Networks Secure Boot CA
Validity
Not Before: Apr 26 09:07:06 2025 GMT
Not After : Apr 24 09:07:06 2035 GMT
Subject: CN = VyOS Networks Secure Boot Signer 2025 - linux
|
|
config.boot.default
We do have different default console configurations per flavor used. We will
set the serial console to the default configuration for the flavor once during
ISO image assembly.
|
|
image: T8375: honor already existing boot_settings
|
|
VyOS flavors might come with boot_settings which already provided additional
serial interface settings if required. Instead of using our own definitions,
re-use what's already existing.
scripts/image-build/build-vyos-image comes with an implicit default for
boot_settings like console number and speed, thus we do not need to redefine
the existing default - again.
|
|
* 6.6.135 https://lwn.net/Articles/1068477/
* 6.6.134 https://lwn.net/Articles/1067276/
|
|
|
|
flavor: T8375: add flavor.json during build into resulting image
|
|
T8047: replace netplugd with vyos-netlinkd
|
|
In order for amd64 or arm64 images to know their serial console settings, we
embed a new file named "flavor.json" under "/usr/share/vyos" into the resulting
image. The file holds configuration parameters unique to the build flavor.
Corresponding library functions are available via a Python vyos.flavor module.
|
|
T8410: Fix typos and mistakes in scripts and comments
|
|
Fix typos and mistakes in the comments
No functional changes
|
|
The custom patch "nft_ct: Added nfct_seqadj_ext_add() for DNAT'ed - conntrack."
is now available upstream in the Kernel tree.
|
|
|
|
|
|
found error
|
|
|
|
T8311: move to GNU coreutils when building GLIBC multiarch variable
|
|
T8330: ARM64: vyos-ipt-netflow package is missing in the build
|
|
Related to commit 39dc9c98c68 ("T8311: fix initramfs hook "dpkg-architecture:
command not found"). Drop dpkg-dev implementation in favour of GNU coreutils.
On x86_64 (aka amd64) both yield the same result:
$ echo $(uname -m)-linux-gnu
x86_64-linux-gnu
$ echo $(dpkg-architecture -qDEB_HOST_MULTIARCH)
x86_64-linux-gnu
On aarch64 (aka arm64) both yield the same result:
$ echo $(uname -m)-linux-gnu
aarch64-linux-gnu
$ echo $(dpkg-architecture -qDEB_HOST_MULTIARCH)
aarch64-linux-gnu
|
|
T8120: add support for per CPU architecture serial interface name
|
